Microsoft Secure Future Initiative: April 2025 Progress Report Summary – Moving the Needle
Microsoft’s Approach to Security Culture and Governance – Six Engineering Pillars in Microsoft’s SFI
Microsoft Secure Future Initiative: April 2025 Progress Report Summary – Moving the Needle
The Microsoft Secure Future Initiative (SFI) is a multiyear effort to revolutionize the way Microsoft designs, builds, tests, and operates its products and services to achieve the highest security standards. It represents the largest cybersecurity engineering project in Microsoft’s history.
Since launching SFI, Microsoft has invested the equivalent of 34,000 engineers working full-time for 11 months to mitigate risk and improve security for both Microsoft and its customers.
Key Progress Areas
Culture and Governance
Microsoft has fostered a security-first mindset throughout the organization:
- Every employee now has a Security Core Priority that’s discussed during performance reviews
- 50,000 employees have participated in the Microsoft Security Academy
- More than 99% of employees completed Security Foundations and Trust Code courses
The company has expanded its governance structure with a Deputy CISO for Business Applications and consolidated responsibility for Microsoft 365 and Experiences and Devices into one role. All 14 Deputy CISOs have completed risk inventories and prioritization for their products or functions.
Engineering Pillars Progress
Out of 28 objectives across six engineering pillars, 5 are nearing completion, 11 have made significant progress, and work continues on the remainder. Microsoft prioritized addressing the highest risks and most critical assets, using platform engineering practices to scale their security efforts.
1. Protecting Identities and Secrets
Key accomplishments include:
- New defense-in-depth protections for Microsoft Entra ID and Microsoft Account token signing keys
- 90% of identity tokens for Microsoft apps are validated by one consistent, hardened identity SDK
- 92% of employee productivity accounts now use phishing-resistant multifactor authentication
2. Protecting Tenants and Isolating Production Systems
Microsoft has removed legacy/unused resources and increased isolation to reduce lateral movement risks:
- More than 88% of resources transitioned to Azure Resource Manager
- 6.3 million unused tenants removed (550,000 since September)
- All new tenants automatically registered in their security emergency response system
3. Protecting Networks
Progress includes:
- More than 99% of network assets inventoried using enhanced security standards
- Additional layers of defense through network isolation and segmentation
- Four new security capabilities to help customers secure networks: Network Security Perimeter, DNS Security Extensions, Azure Bastion Premium, and a private subnet feature
4. Protecting Engineering Systems
Microsoft has improved the security of systems used to build, test, and deploy code:
- 99.2% of pipelines have complete inventory, enforced at creation and validated within 24 hours
- MFA protects 81% of production code branches through proof-of-presence checks
- Broad adoption of Central Feed Services providing developers with governed open-source feeds
5. Monitoring and Detecting Threats
Microsoft has enhanced its ability to detect and respond to threats:
- 97% of production infrastructure assets tracked centrally
- Engineering teams adopting security logging standards with two-year minimum retention
- More than 200 additional detections added against top tactics, techniques, and procedures
6. Accelerating Response and Remediation
The company has improved vulnerability response:
- 73% success rate addressing cloud vulnerabilities within reduced time to mitigate
- Through Zero Day Quest, researchers identified 180 new vulnerabilities in cloud and AI systems
- New processes and playbooks implemented to improve security incident communications
How CinchOps Can Help Secure Your Business
While Microsoft is making impressive strides with its Secure Future Initiative, small and medium-sized businesses often lack the resources to implement enterprise-level security measures. This is where CinchOps can help:
- Security Assessment and Planning: We can evaluate your current security posture against best practices highlighted in initiatives like Microsoft’s SFI and develop a tailored security roadmap.
- Identity Protection: We implement phishing-resistant MFA and proper credential management to protect your most vulnerable assets – your identities and access points.
- Network Security: We can help implement proper network segmentation, asset inventory, and protection measures scaled appropriately for your business.
- Vulnerability Management: Our proactive approach identifies and addresses vulnerabilities before they can be exploited.
- Continuous Monitoring: We provide 24/7 threat detection and response services to identify suspicious activities before they become major incidents.
- Security Training: Like Microsoft’s internal efforts, we can help train your staff to maintain a security-first mindset throughout your organization.
Don’t wait for a security incident to realize the importance of cybersecurity. Let CinchOps help you implement the same security principles that industry leaders like Microsoft are prioritizing, but at a scale that makes sense for your business.
Discover More
Discover more about our enterprise-grade and business protecting cybersecurity services: CinchOps Cybersecurity
Discover related topics: The 2025 Microsoft Vulnerabilities Report
For Additional Information on this topic: Microsoft Claims Steady Progress Revamping Security Culture
FREE CYBERSECURITY ASSESSMENT
