Running Unprotected: Measuring the Benefits of Real-Time Security Software

From http://www.microsoft.com/security/sir/story/default.aspx#!antivirus_protection :

Direct pdf link hxxp://download.microsoft.com/download/E/0/F/E0F59BE7-E553-4888-9220-1C79CBD14B4F/Microsoft_Security_Intelligence_Report_Volume_14_Running_Unprotected_English.pdf (previously referenced in thread Microsoft Security Intelligence Report Volume 14 released today)

I'm not sure if that pdf reports on malware exposure rate vs. malware infection rate by operating system; that aspect is covered at Infection rates and end of support for Windows XP.

 

From New infection rate data for unprotected computers:

 

Have to compliment Microsoft on self criticism: only using Microsoft OS mechanisms myself and MS considers this as insufficient protection

 

My friend is not very computer savvy nor (cough) very smart person either and he has an unprotected computer just like me and he did get infected for years.
On the other hand, computer cleaning forums are flooded with people, who use various security software and they keep asking for help how to get rid of malware.

So I honestly wonder, how is this even possible? Usage of a security software is obviously not the reason, so maybe a bit of luck, maybe users unknowingly taking risks.
I would definitely welcome a study, that would not judge a computer security just on the amount of security software installed, but based on a real world experience.