Nearly all Windows computers are running at least one unpatched application and about 40 percent contain 11 or more programs that are vulnerable to attack, a vulnerability-tracking company said yesterday.

According to Secunia, more than 95 percent of the PCs that have downloaded and installed its Personal Software Inspector (PSI) utility in the last week have one or more applications for which security fixes are available.

Secunia tracked the first PSI scan after its installation to get an idea of patch status before users start to update their machines, which can also be done through the utility.

In the past seven days, users have installed PSI on 20,009 machines; 95.46 percent of them have an unpatched application on their hard drive.

"There is a newer version available from the vendor that corrects one or more vulnerabilities," said Jakob Balle, Secunia's development manager, in a post to the company's blog yesterday. "But the users have yet to install the secure version."

Some of the other statistics cited by Balle were just as damning: 41.94% of the machines scanned by PSI in the past week have 11 or more vulnerable applications; and 67.63% of the PCs have 6 or more unpatched programs.

"Close to all computers are running with several insecure applications installed," Balle pointed out.

Get the latest security news, How To workshops and product reviews at Security Advisor.

And the picture is probably even darker than the one he painted. "These results should be considered 'best case' scenarios. The real numbers are likely to be worse," he said. This is because the sample users chose to participate in the scan, meaning they are probably more vigilant and security-conscious than the average user.

Secunia released the free patch detection utility a year ago, but shifted it to Release Candidate 1 (RC1) stage earlier this month. The Copenhagen-based company claims nearly 191,000 users have downloaded and run the program.

PSI runs on Windows 2000, XP, Vista, and Server 2003, and can be downloaded from the Secunia site.