That should have been a wake-up call to the user community, and it wasn't. The No. 1 issue would be establishing a culture in which security matters. Microsoft can make a good commitment to the IT community and deliver some real value-add to the product line. Yes, but nobody can look at Microsoft's code. Tens of millions.
Nobody has the tools to do code-walking effectively.
However, I do think it would be nice if there were a kind of an Underwriters Laboratories concept within the industry. I think it would be very useful to have the major vendors be able to submit their code to some kind of a bonded entity that existed just to take a look at code. In many organizations, security is still perceived as an IT problem. It's a start, but we are not asking the right questions yet. A survivor's guide.