The statistics in the report were gathered from the 600 million machines that are enrolled in Microsoft's various update services or use its Essentials and Defender security packages.
"Four days is typically not enough to complete the initial investigation of the vulnerability and thoroughly test a comprehensive update, " said Mike Reavey, director of Microsoft's security response center.