Microsoft will put the hurt on some players in the security software game as it rolls out its own defensive products and its Windows Vista operating system, an analyst said Tuesday.

"The McAfees, Symantecs, and Trends won't be put to bed by Microsoft, not in the enterprise," said Natalie Lambert, an analyst with Forrester Research. "Microsoft's security efforts will lack the functionality that [those companies' products] have" for at least 18 to 24 months, she added. "McAfee, Symantec, and Trend have more than just anti-virus and anti-spyware. That's a huge advantage."

But Microsoft's entry into the security space -- which started with a series of acquisitions beginning in 2003 -- clearly has some security vendors worried. Monday, John Thompson, Symantec's chief executive, said that the Cupertino, Calif.-based security giant was concerned about Microsoft playing "fair" in the marketplace.

Lambert said that Thompson has a right to be worried, up to a point. "Knowing Microsoft, it will be able to undercut rivals [on pricing]." Yet there's a silver lining in Thompson's cloud. "I truly believe that Microsoft will always be a step behind the true security vendors." She listed problems Microsoft faces, ranging from the lack of sophisticated management tools like McAfee's ePolicy Orchestrator, to its inability to offer security for platforms other than Windows.

"Management of security is a nightmare," Lambert said. "And McAfee and Trend own the central management solutions."

Step outside the corporation, however, and Microsoft will have a bigger impact on security. Separately-sold consumer-oriented security software is a dead end, revenue-wise, Lambert said, in part because Microsoft will either offer for-free or priced-to-sell software, in part because the security burden's shifting to Internet service providers.

"Security vendors are going against more than just Microsoft, they're faced with the ISPs," said Lambert. "When security is offered by a consumer's ISP, they won't go out and pay for security, even if it's pitched as a premium product. If, as a security company, you're not in the ISP door, you'll be at a dead end."

On the Windows Vista front, the crunch will be different. That operating system, now scheduled to ship to businesses in November, to consumers in January 2007, won't include anti-virus software, but will feature free, integrated anti-spyware: Windows Defender.

"Vista will have high impact on one-trick pony [spyware] companies," said a second analyst, Andrew Jaquith of the Yankee Group. "It's hard to compete with free. Free and 'good enough' beats costly and technically elegant any day."

Vendors such as Webroot and Lavasoft, which offer products only in the anti-spyware space, are in trouble, Jaquith said. But firms such as McAfee and Symantec have protected themselves against Vista's anti-spyware siren song.

"These companies have been dealing with Windows security problems for years, and they've been pretty successful in adding anti-spyware [capabilities] to their software," he said. McAfee, for instance, has been able to migrate half of its enterprise user base to its anti-spyware solution, while Symantec has managed to convince about a third of its customers.

And for all Microsoft's promises that Windows Vista will be the most secure operating system it's ever created, security needs -- and thus security software makers -- aren't about to disappear, added Forrester's Lambert.

"It's always going to be an arms race between hackers and developers," she said. "In the end it's all about where the people are, and if people move to Vista, [hackers] will figure out a way to attack it."