Basically because bindiff (http://www.zynamics.com/bindiff.html http://www.zynamics.com/bindiff.html ). The moment an updated binary is available, the clock sta

Basically because bindiff (http://www.zynamics.com/bindiff.html http://www.zynamics.com/bindiff.html ). The moment an updated binary is available, the clock starts ticking towards a vulnerability being reverse engineered from the update. A few years back, there was a huge amount of research in the infosec community whose goal was to automate extraction of these vulnerabilities (yes really - a robot automatically producing 0-day given an updated binary). Symbolic execution trickery aside, this remains a straightforward task for a reverse engineer to manually perform given a set of debug symbols (which Microsoft supply for developers). Your options become either to release an update the moment it's tested, immediately making vulnerable customers who have a change management policy (usually also the biggest and juiciest targets - fortune 500s including ironically the likes of Google), or delay any release until some coordinated date, giving everyone an equal and predictable opportunity to cope with the exposure, which is how Microsoft do it.