It's hard to say. Microsoft paid directly for these "studies" in the past, and eventually people started ignoring them. So, now NSS simply doesn't disclose who pays for them.

Must be. Because anything Microsoft does better especially in the areas of security must be flawed or propaganda </sarcasm>