Building a lasting security culture at Microsoft

Building a lasting security culture at Microsoft is framed as a company-wide movement, not just a technical endeavour, with security being a top priority for every employee. According to Microsoft Security Blog, security begins and ends with people, and the Secure Future Initiative has helped embed security into every layer of engineering while transforming how employees are educated, including a revamped training programme and the Microsoft Security Academy.

The organisation now emphasises a risk-based, threat-informed approach in its Security Foundations content, and claims that around 80% of security incidents start with a phishing incident or identity compromise; training is designed to go beyond 101-level content with real-world scenarios and AI-enabled threat awareness.

Chief Executive Officer Satya Nadella and Chief People Officer Kathleen Hogan have stressed security as a core priority, with Hogan stating that “Everyone at Microsoft will have security as a Core Priority.

When faced with a tradeoff, the answer is clear and simple: security above all else.” Initiatives such as two new guides on identity protection and defending against AI-enabled attacks, a global Security Ambassador programme launching in autumn 2025 aimed at 5% employee participation, and embedded DevSecOps governance reflect ongoing efforts to sustain a security-first mindset across people, processes, and culture.