Microsoft Asks All of Its Employees to Prioritize Security

After announcing in May that it was making security its “top priority,” Microsoft is ready to transform its company culture and push all of its employees to focus on security. In an internal memo obtained by The Verge, Kathleen Hogan, Chief People Officer at Microsoft explained that all of the company’s workforce must participate to the company’s efforts to protect its customers from cyber threats.

“Everyone at Microsoft will have security as a Core Priority,” the exec wrote in the memo. “When faced with a tradeoff, the answer is clear and simple: security above all else.”

In practice, security work is now an integral part of how Microsoft evaluates its employees. A new “Security Core Priority” is now available in the company’s internal Connect tool for employees.

“The Security Core Priority is not a check-the-box compliance exercise; it is a way for every employee and manager to commit to—and be accountable for—prioritizing security, and a way for us to codify your contributions and to recognize you for your impact,” Hogan explained. “We all must act with a security-first mindset, speak up, and proactively look for opportunities to ensure security in everything we do.”

You can read the full memo from Microsoft’s Chief People Officer below:

At Microsoft, we deliver mission-critical infrastructure that the world depends on to achieve more. With that trust in us comes a great responsibility: to protect our customers, our company, and our world from cyber threats. As Microsoft employees, we all have a role in that responsibility.

As Satya referenced in his May 3 email and again during his FY25 kick off on July 9, security is our number-one priority, and everyone at Microsoft will have security as a Core Priority. When faced with a tradeoff, the answer is clear and simple: security above all else. Our commitment to security is enduring. New and novel attacks will require us to continue to learn, innovate, and defend. Yet working together, we will make nonlinear improvements, stay alert, and meet the expectations of our customers. They are counting on us, and our future depends on their trust.

Our new Security Core Priority reinforces our commitment to security and holds us accountable for building secure products and services. It is now available in the Connect tool for most employees, and we are partnering with geo HR teams to expand access to all employees globally. The Security Core Priority is not a check-the-box compliance exercise; it is a way for every employee and manager to commit to—and be accountable for—prioritizing security, and a way for us to codify your contributions and to recognize you for your impact. We all must act with a security-first mindset, speak up, and proactively look for opportunities to ensure security in everything we do.

The core priority will have two parts:

Core and common elements that apply to all employees

An optional section for employees to further specify how they will activate the Security Core Priority based on their role, team, org, etc.

All employees will set their Security Core Priority as part their first FY25 Connect, with the intent that during regular Connect conversations, you and your manager will discuss your Security Core Priority progress and impact. This process will follow the same approach as our other company-wide core priorities for Diversity & Inclusion and Managers. You can learn more about the Security Core Priority here, including FAQs and Security Core Priority activation examples for three main types of roles: technical, customer and partner-facing, and all other roles.

As we kick off our 50th year as a company, I know we all feel honored and humbled that we are still here—as a relevant and consequential company—pursuing our mission together. When we empower every person and organization on the planet to achieve more, we take on society’s biggest challenges and empower the world. What a big, bold, and meaningful mission we have, and yet none of us can take this for granted. We are here because our customers trust us, and we must continue to earn their trust every day.

Thank you for your commitment to our Security Core Priority that will help protect Microsoft, our customers, and our partners.

Kathleen

If it will likely take some time for this new security-first mindset to infuse throughout the company, a separate internal FAQ seen by The Verge makes it clear that security work now plays an important role in career progression and pay raises. “Delivering impact for the Security Core Priority will be a key input for managers in determining impact and recommending rewards,” the FAQ says.

As one of the biggest tech companies in the world, Microsoft and its customers are regular targets of increasingly sophisticated cyberattacks. Unfortunately for Microsoft, its dominant position also made it an easy punching ball. Following the massive CrowdStrike outage that affected millions of PCs worldwide, Delta CEO described Microsoft as “probably the most fragile platform within that space” in an interview with CNBC, even though Microsoft wasn’t directly responsible for the situation.