I would actually argue that Linux primarily being a server OS is a big reason why there seem to be so few attacks against the OS itself. It's about the attack v

I would actually argue that Linux primarily being a server OS is a big reason why there seem to be so few attacks against the OS itself. It's about the attack vectors. On Windows, there's typically a human interacting with it. That's a big part of your attack vector; you're trying to get them to download and run a file. Once they do that, it's able to interact directly with the OS. And you've got a lot more incentive to stick around once you get in, because typical users aren't going to notice if the computer's chugging a bit harder due to running a botnet or encrypting the whole hard drive. On a server, though, everything's probably pretty closed down. And there's generally no human to let you in. So instead of attacking the OS itself, you attack the services running on it. And if you do get into one, there's likely no need to go after the OS from there, because you're already in the memory space of the app, which is where all the goodies lie. And you're also not likely to stick around and waste CPU resources on running a botnet or encrypting the drive, because any halfway competent ops team is going to have monitoring in place, and will notice and investigate the anomalous spike in activity. Which takes us back to my point: correlation is not causation. Relative compromise rates for the two OSes may well have nothing at all to do with the actual OS. The real thing that's being attacked is the class of computer: viruses want to go after user workstations, not servers.