This paper examines the effect of competition intensity on software vendors' security investments when the software is provided free of charge to users. We study the case of software at the center of Internet security, namely the web browser, in which vendors derive their revenue from advertising, and compete in quality. Specifically, using a pooled cross-sectional data set on security patch release on web browsers from 2009 to 2018, we examine how competition intensity affects web browser publishers' promptness to release a security patch. Contrary to many empirical works examining the link between competition and quality, we find that market concentration is not necessarily harmful to quality provision: a higher market concentration positively impacts the vendor's responsiveness in patching vulnerabilities, although this effect is reduced when the vendor is too dominant.