[Swordmaker]

What they mean is that during 98% of 2004, there were known, unpatched vulnerabilities in IE. This is being somewhat charitable. The flaws in question were there in 2003, 2002, 2001... and so on. (And, there are flaws that were not patched at all simply because they've yet to be discovered.) They report that there was only one, brief period when there were no known, unpatched flaws. Again, this is being charitable. They are assuming that since the IT community at large did not know about the flaws, no hackers did either.

We need to find that 2% and see what they did right... but I have a sinking feeling that it was the cumulative 7.3 days (365 x 2%) after all the security updates and before the hackers found the next hole in IE!

[Redcloak]

IIRC, the 2% happened during the spring break period; e.i. the geeks were off getting hammered rather than hunting for bugs.