Not the opinion of my employer but: no.

A state level attacker can likely acquire 0-day exploits that are not patched and bypass defenses.

Microsoft's offering does some really cool stuff like:

- Automatically detecting anomalous behavior in the network and isolating suspected devices/ips/machines/programs.

- Have real time security engineers constantly monitoring your network and hunting attackers and suspicious activity.

- Tools that automatically isolate possible attackers and help measure the impact of attacks.

> Can we trust Microsoft to be neutral and offer security patches in a timely manner

Yes, that for sure. Once an exploit is discovered it is typically very quickly identified. A lot of the times security patches don't come from Microsoft though - if you consider something like Log4Shell (the Log4J vulnerability) for example.

> defend the interests of their consumer customers above all?

I'm... not sure about "above all" since I am not sure what "all" is but if the implication is that Microsoft won't patch a security flaw for a state level APT then "yes". At least - if it ever happened it happened _way_ above my pay grade and if employees would learn of it there would be outrage.

> With the whole conflict in Europe, the issue of state level adversaries is raring its head again.

I think state level actors have consistently been a problem.

Note again as already mentioned none of this represents the opinion of my employer, just my thoughts.

> I'm... not sure about "above all" since I am not sure what "all" is but if the implication is that Microsoft won't patch a security flaw for a state level APT then "yes". At least - if it ever happened it happened _way_ above my pay grade and if employees would learn of it there would be outrage.

cough NSAKEY cough

Provided a backdoor for state security forces. Did it in NT, and then even after they were caught, did it again in Win2k.

You underestimate people's moral flexibility, especially that of "patriots."

My reply above to your NSAKEY stuff applies here too.

You have to assume that the state is collecting every scrap of data that MS gets from telemetry. I'm sure MS is collecting a ton of data for themselves as well. As much as the company line might say that PI is scrubbed we know anonymization is a joke, and PI isn't limited to names and credit card numbers. You can learn a lot about a person by the contents of their Prefetch folder, their Steam folder, their internet history, the amount of *.h *.c *.py files are on their drive and how often they are updated etc.

I'm sure on enterprise systems MS is pretty hands off. They've got a very stable cash cow there they don't want to scare away, but home users are probably screwed and you should expect that. MS has been making their opinion of their user's right to privacy and to control what their own computer very clear over the years. They've repeatedly demonstrated a willingness to leverage their OS against the users and their wishes for power and profit. Act accordingly.

LTSC. Long Term Support Channel. Anti-telemetry anyway.

Even with LTSC you can't disable all telemetry, It could have been a great (and very popular) option for companies (even though it wouldn't help home users), but MS didn't want that and discouraged its use in everything but the most extreme cases (https://www.computerworld.com/article/3326065/microsoft-tras...) even before they cut support to 5 years instead of 10.

Maybe things will be better with windows 11?