After suffering a series of high-profile cyberattacks over the past decade, Microsoft says a new initiative to reinvigorate its security culture is bearing fruit.
The tech giant’s stumbles — and the expectation that a company of its size would have been able to prevent them — made it a punching bag in the cybersecurity community. In 2022, the teenage cybercrime gang LAPSUS$ broke into the company’s systems. In 2023, operatives from both Russia and China hacked Microsoft in separate incidents, stealing valuable information from the State Department and other customers. China’s hack prompted a federal review board to sharply criticize Microsoft’s lax security practices. Even Russia’s 2020 SolarWinds espionage campaign sparked outrage over Microsoft’s pricing practices. Experts and lawmakers soon revived decades-old warnings that the government’s dependence on Microsoft posed a major security risk.
To contain the damage, Microsoft in November 2023 launched the Secure Future Initiative, vowing to completely overhaul how it developed and secured its software. Since then, the company has published progress reports documenting changes to its culture and technology that it says will reduce the risk of another major failure.
Microsoft believes it has radically transformed how employees approach cybersecurity. In interviews last week at Microsoft’s headquarters in Redmond, Wash., company leaders told Cybersecurity Dive that the SFI had purged much of the internal friction around security that had led to Microsoft’s most embarrassing breaches.
“Our operations [and] products must be secure. That’s how we earn trust with our customers,” said Hammad Rajjoub, the initiative’s director. “You’ve got to go do what you’ve got to do for shipping your products, features, capabilities, but security almost becomes a non-negotiable from that perspective.”
Cybersecurity culture and accountability
Improving cybersecurity requires company-wide buy-in, and in an organization as large as Microsoft, there are bound to be some engineers and managers who don’t agree with how the new security-first mindset manifests itself.
“The core tension is speed versus assurance,” said Fernando Montenegro, vice president and practice lead for cybersecurity and resilience at The Futurum Group. “Ship dates, market pressure, and now the race to ship AI capabilities all push against slowing down for security.”
To combat those pressures, the team behind the SFI has focused on changing Microsoft’s culture.
“It’s an accountability conversation more than anything else,” Rajjoub said. “We still have humans working on these difficult problems, and then they have motivations and challenges that drive that work. So culture is a big, big, big part of that.”
Rajjoub and others at Microsoft are quick to point to CEO Satya Nadella’s edict that the company should always err on the side of security.
At one Microsoft leadership retreat, a corporate vice president complained to Nadella about the trade-offs between spending resources on better security and spending resources deploying features that customers were waiting for.
“Without hesitation,” according to Rajjoub, “Satya said, ‘Prioritize security above all else.’”
“When your CEO says that this is your number-one priority, and he consistently repeats it over and over again,” Rajjoub added, “that drives change in behavior.”
Outside industry analysts are seeing a difference. Montenegro said “the SFI effort does seem to be paying off.”
Microsoft President Brad Smith testifies before a Senate committee in February 2021 about the company’s role in the SolarWinds data breaches.
Drew Angerer via Getty Images
Inside Microsoft, a Cybersecurity Governance Council composed of deputy CISOs for each of the company’s major business lines — including Windows, Azure and Microsoft 365 — meet regularly to discuss the best ways to manage the trade-offs required to emphasize cybersecurity.
“There are active review conversations where there are discussions on, ‘What features are we going to ship? What does the prioritization look like?’” Rajjoub said.
Further down the org chart, employees are evaluated on how they achieve that balancing act.
“You’re held accountable for the decisions that you’re making, and security is the number one priority,” Rajjoub said. “Does that result in active discussions on, ‘Hey, I cannot ship X because I need to fix Y?’ Absolutely. All the time.”
To reduce the likelihood of recalcitrant employees resisting the security push, Microsoft made it part of their annual reviews, tying their adherence to Natella’s edict to outcomes such as promotions and raises. Every performance review conversation now includes a discussion of how the employee contributed to Microsoft’s and its customers’ security.
“It doesn’t matter [if] you sit in marketing, engineering, incident response, sales,” Rajjoub said. “The question is the same. … Everybody is incentivized to make sure that they’re prioritizing security, because, come the performance conversation, you’re going to be asked about, ‘How did you help move the needle on security?’”
Microsoft engineers are responding positively. According to the company’s July SFI progress report, the average employee sentiment score regarding the cybersecurity push is 88%.
“We’re seeing the uptick in the sentiment of those developers,” Rajjoub said. “They feel good about enabling and prioritizing security above anything else, because then they see this side effect of … better customer outcomes.”
“We’re shifting left in terms of critical areas where I must have a security engineer sign off at the design time.”
Dana Huang
Corporate Vice President, Windows Security, Microsoft
The changes documented in the SFI progress reports, from identity validation to device management, “are improving security across the Microsoft ecosystem,” said Merritt Maxim, vice president and research director of security and risk at Forrester. But he added that Microsoft would need to guard against the risk that “urgency, especially around AI, quietly erodes the [security] discipline once attention fades.”
Allie Mellen, a principal security and risk analyst at Forrester, offered a similar warning.
“The changes they’ve made so far are valuable and will help Microsoft products be more secure,” she said. “However, these changes need to remain embedded and improve over time to truly have a long-term impact.”
“Shifting left”
Windows is easily Microsoft’s flagship product, and the one that hackers target the most. To better protect the operating system, Microsoft has completely overhauled how security experts oversee its development.
“We’re shifting left in terms of critical areas where I must have a security engineer sign off at the design time” and “really getting the security engineers engaged at a very early stage,” said Dana Huang, corporate vice president for Windows Security.
The old software-development model made it easy for security to be an afterthought. A developer would run automated tools, such as fuzzers, to check the integrity of their code, and then call the security team the week before a product launch to say, in Huang’s words, “Give me a checkbox.” But over time, cybersecurity incidents and privacy scandals revealed problems that the automated tools hadn’t identified.
“Some of the learning in there was, we engaged too late,” Huang said. “There’s [a] narrow view [among developers] of, ‘I don’t think that’s a problem,’ and then my security engineer looks at it [and says], ‘No, there is a problem.’”
The scale of Windows development currently dwarfs Huang’s effort to shift left. The Windows division has 7,000 employees, including 5,000 engineers, according to Huang, while her security engineering team is “a dozen people.” She added, however, that she is “increasing investment” in Windows security oversight.
Huang’s team should contain its ambitions, argued Montenegro. “A dozen can’t inspect the work of 5,000, and shouldn’t try,” he said. “Their job is building the standards, tooling, and secure defaults [that developer] teams inherit. The hard, ongoing part is shaping incentives and org structure so teams leverage that work, not offload security onto it.”
Huang believes her security experts can reasonably oversee “three major areas” of Microsoft’s business, and one of their top priorities is the company’s agentic AI technology.
“I have a dedicated principal-level security engineer engage with the team who are building the foundation layer for agents,” she said. “You don’t need to look at every single agent. But those agents will [be] built on some sort of platform.”
From a cybersecurity standpoint, she said, agentic AI is “an area that we really care about.”
Forrester’s Maxim said Microsoft would find it particularly difficult to oversee AI security because of the current shortage of experts in that area.
“Retention becomes a real challenge here, as the pay and compensation for AI-specific roles can make it harder to retain existing staff and recruit new talent,” Maxim said. “This will improve over time as more people build up AI-specific qualifications but is a challenge that many enterprises are struggling with.”
Huang acknowledged Microsoft’s recent missteps, which included a poorly received “Recall” feature that tracks everything a user does on their computer.
“With a large company, [with] everyone trying to do something, we ended up either doing some things that [were] not aligned properly or not coordinated well,” she said. “From a security point of view, we did take some learnings from some of the [mistakes].”
Huang and her counterparts overseeing other Microsoft products still face major challenges scrutinizing an endless sea of code. However much of a difference the Secure Future Initiative is making, the complexity of Microsoft’s products means that researchers are constantly discovering new flaws in them. In the past five months alone, Microsoft has disclosed at least five serious vulnerabilities in its SharePoint collaboration platform.
The good news is that there are incentives that can be used to reinforce a security-first culture, such as mean-time-to-remediate (MTTR) to track how quickly bugs are fixed in production and tracking how many vulnerabilities are caught during testing/pre-release versus in production software.
Forrester’s Maxim said Microsoft needs to ensure that risk management was a core part of software development, not an afterthought.
The company can also make use of pro-security incentives, including tracking how quickly engineers fix vulnerabilities and how many of those vulnerabilities they catch before release, he said.
How Microsoft’s security culture has changed
Reports from the company’s Secure Future Initiative contain insightful statistics about its progress.
A boost from AI scanning
In addition to new consultations between developers and security experts, Microsoft is also rolling out new technology to help identify software vulnerabilities. In May, the company announced the deployment of a multi-LLM agentic code scanner called MDASH, saying it had already found critical remote-code-execution vulnerabilities in Windows components such as its TCP/IP network stack.
The TCP/IP vulnerabilities shocked developers inside Microsoft, according to Taesoo Kim, a vice president of security research who joined the company not long after his team won DARPA’s AI vulnerability-hunting competition.
“Everyone didn’t believe [the TCP/IP flaws were real], because, ‘Hey, this [code] is extremely stable, we’ve audited it many times,’” Kim said. “But we found and proactively addressed all these vulnerabilities by using MDASH.”
MDASH now constantly scans “not only what we’re shipping, but what we are actively building,” Rajjoub said, “and there are enforcements in place that will not allow you to ship your code unless and until you’re meeting the security bar.”
Microsoft is also using MDASH to scan open-source packages that its products use, including the Linux kernel and FFmpeg. Despite those being some of the most thoroughly scrutinized packages in the world, Kim said MDASH is still finding vulnerabilities in them.
Microsoft has also begun selling MDASH to customers so they can scan their own code repositories.
“You’re held accountable for the decisions that you’re making, and security is the number one priority.”
Hammad Rajjoub
Director, Secure Future Initiative, Microsoft
Enforcing secure defaults
As part of its cybersecurity push, Microsoft has started requiring customers to use protections that were previously optional. Most notably, in October 2024, the company began requiring multifactor authentication for its Azure cloud-computing platform.
Microsoft executives carefully weighed the MFA change and other transitions to security defaults, mindful that onerous requirements could hurt business.
“We have to find that middle,” Rajjoub said.
In the leadup to the Azure MFA mandate, he said, a “big conversation” about not wanting to “break customer workflows” yielded a decision to take a staggered approach. New accounts would need to use MFA immediately, while older accounts could follow a transition period.
Other security-focused changes involve switching potentially risky features off by default. Not every organization needs every capability; some capabilities would only pose a risk to a customer if left activated but unprotected. Over time, Huang said, Microsoft discovered that it could deactivate certain features by default “and still allow people to move to ‘on’ if they have a specific need and they have enough protections.”
When customers express interest in those features, she added, “We work with them to say, ‘Either move off [of] these dangerous things, or have a policy and guardrail configuration that [shows] you know what you’re doing.”
