Yesterday, we shared some exciting news about the momentum we’re seeing in the security industry. Microsoft Chief Executive Officer Satya Nadella announced that Microsoft Security has surpassed USD20 billion in revenue. I’m grateful to all our customers and partners who have been on this journey with us, for trusting us to protect them, for partnering with us in defining great security, and for making this milestone possible. I am also incredibly proud of the Microsoft team for their continued dedication to excellence and to our mission to make the world a safer place for all.
Even as the digital landscape grows larger and more complex, we remain guided by our core belief that cybersecurity is about empowering people. Security is a team sport; I believe that with my whole heart. It takes us all working together to defend the world from bad actors, and I’m excited and honored to be in the trenches with all of you.
Since 2020 we’ve seen drastic changes in the ways people work and live. As a result, organizations continue to evolve the way they think about security. At Microsoft we’ve worked to be nimble, to listen attentively to honest feedback from our customers, and to implement these changes in products and solutions that are future-proof and secure from the start. In the last six months of 2022 alone, we launched more than 300 product innovations to help organizations stay ahead of evolving threats.
Microsoft has an unparalleled view of the evolving threat landscape. With industry-leading AI, we synthesize 65 trillion signals a day—across all types of devices, apps, platforms, and endpoints—a nearly eight times increase from the 8 trillion daily signals captured just two years ago. And we apply the learnings from that signal intelligence, as well as from our world-class threat intelligence, into all the products and services we offer. Furthermore, we now have more than 15,000 partners working with us across our security ecosystem helping to bring better solutions and more choices to market.
Despite economic uncertainties, security software projects and investments are top of chief information officer priority lists as they confront evolving threats and recognize the value of taking a proactive, comprehensive approach.1 In this blog, we’ll look at why a comprehensive approach to cybersecurity is so important, and how your organization can do more with less during uncertain times.
Navigating a changing threat landscape
We’ve seen rapid increases in the volume, severity, and sophistication of cyberattacks, along with a growing breadth of targets. In the past, threats were largely confined to specific sectors or were considered to be more manageable reactively. But in 2022, the average cost of a data breach reached an all-time high of USD4.35 million.2 The 2022 Microsoft Digital Defense Report (MDDR) revealed some daunting realities behind those costs. Our Digital Crimes Unit took down 531,000 unique phishing URLs and 5,400 phish kits between July 2021 and June 2022, leading to the identification and closure of more than 1,400 malicious email accounts used to collect stolen credentials. In addition, Microsoft blocked 2.75 million site registrations before they could be used to engage in global cybercrime.3
People are now the primary attack vector and represent the greatest vulnerability to an organization’s security.4 A recent industry study found that identity-driven attacks accounted for 61 percent of breaches.5 The risk-to-return ratio makes these human-centered attacks irresistible for cybercriminals. For example, password-spray attacks cost an attacker almost nothing and can yield invaluable access to business information. Phishing remains the most prevalent form of cyberattack, with business email compromise (BEC) potentially the most costly.6 From the time your business email is compromised, it takes only an average of one hour and 12 minutes for an attacker to access your private data.7
Our internal defender community continues to track the rise of ransomware as a service (RaaS). As examined in the August 2022 issue of Cyber Signals, RaaS enables cybercriminals to rent or sell ransomware tools in return for a portion of the profits. This retail approach to cybercrime lowers the barrier to entry because it requires virtually no technical skills. However, these attacks can often be prevented by following a few simple security best practices. As part of our comprehensive approach, Microsoft Sentinel, Microsoft 365 Defender, and Microsoft Defender for Cloud seamlessly integrate to provide security information and event management (SIEM) and extended detection and response (XDR) solutions that proactively protect your enterprise from ransomware attacks.
In the December 2022 issue of Cyber Signals, we shared new insights on the risks that converging IT, Internet of Things (IoT), and operational technology (OT) systems pose to critical infrastructure. As with IT security, a solid defense based on Zero Trust, effective policy enforcement, and continuous monitoring can help limit any potential blast radius.
Do more with less this year—increasing your security ROI
It’s clear the threat landscape we face today requires new approaches. Microsoft research finds that 72 percent of chief information security officers (CISOs) at organizations with more than 1,000 employees believe that having a comprehensive set of products that spans security, compliance, and identity is “extremely or very important.” Our research shows that large organizations have an average of 75 security solutions. Clearly, there’s a growing recognition among cybersecurity leaders that managing multiple vendors can be burdensome for an IT team. Worse, patchwork solutions can create dangerous blind spots by leaving valuable security insights siloed in separate dashboards. This kind of fragmented visibility provides an opportunity for threat actors.
Our survey found that 30 percent of CISOs are concerned about gaps and inconsistencies in securing their organization’s hybrid, multicloud, and multi-platform environment. Twenty-five percent are worried about being unable to replace their legacy systems, and an equal percentage are concerned about enabling user productivity without sacrificing security.
Security is woven into the digital fabric of our applications and services right from the start—from Microsoft Azure’s approach to vulnerabilities, to macro-blocking in Microsoft 365, to enhanced built-in security features in Windows 11—we are raising the bar on the security baseline. We recognize our most secure future requires an end-to-end approach with technology and people, empowered to defend with resilience—this is why security is built into everything we design, develop, and deliver.
Microsoft Security solutions are notably designed to help you eliminate inefficient silos and patchwork fixes, closing the gaps with simplified, comprehensive protection. We integrate more than 50 categories into six product lines which form one Microsoft Security Cloud. By eliminating redundant capabilities, you can avoid the hassles of managing multiple contracts and licenses. Even better, your organization can realize up to 60 percent cost savings when you use Microsoft security, compliance, and identity end-to-end solutions.8 Learn more on this topic from my recent blog: 3 ways Microsoft helps simplify security.
More than 860,000 customers have chosen Microsoft Security to protect their organizations. According to our customer data, the number of organizations with four or more workloads has increased more than 40 percent year over year. Yesterday, Satya gave examples of organizations that chose to consolidate with our security stack to reduce cost, risk, and complexity. In the United Kingdom, retailer Frasers Group consolidated from 86 security vendors down to just Microsoft and one other. Because of its integrated XDR and SIEM capabilities, Land O’Lakes was able to gain granular visibility across its multicloud, hybrid workspace by consolidating on Microsoft Sentinel (now with more than 20,000 customers) and Microsoft Defender for Cloud.
Bringing diverse perspectives to meet diverse challenges
Experts predict the global workforce will need to hire and train roughly 3.4 million cybersecurity professionals to defend the growing digital space.9 Unfortunately, many groups are still underrepresented in this crucial profession. Less than 25 percent of the cyber workforce are women and, in 2021, only 9 percent of cybersecurity workers were Black and only 4 percent Hispanic.10
Microsoft is working hard to make cybersecurity more inclusive by fostering a new generation of defenders that’s as diverse as the world we share. We’re honored to work with so many dedicated professionals who have helped move us closer to that goal. Together with WiCyS (Women in CyberSecurity), we’re empowering the recruitment, retention, and advancement of women in the cybersecurity field. And our partnership with Girl Security, a nonprofit driving change in the security sector through education, workforce training, and professional advancement into careers is helping to create pathways into cybersecurity for girls and gender minorities ages 14-26. We also created Microsoft DigiGirlz to offer female middle and high school students an early opportunity to learn about careers in technology, as well as connect with Microsoft employees and participate in hands-on technology workshops.
In 2021, Microsoft launched a national campaign with community colleges in the United States to help skill and recruit 250,000 cybersecurity professionals by 2025. Still going strong, the Microsoft Cybersecurity Scholarship Program—in partnership with the Last Mile Education Fund—has already benefited more than 1,000 low-income community college students across 47 states. This scholarship program has helped us access a talent pool that may have faced challenges in accessing higher education.
Taking stock and forging ahead
In January of 2021, I had only been with Microsoft for about six months when we announced our first major milestone of USD10 billion in revenue. That was an inspiring accomplishment, but we couldn’t have done it alone. Even as the digital world grows and threats continue to multiply, I’m constantly encouraged by the creativity, determination, and can-do spirit displayed by our partners and customers. 2022 pushed all of us to learn on our feet as the hybrid and remote workplace and the move to a multi-platform environment continued to bring new security challenges. I’m looking forward to learning from all of you and forging stronger relationships in the year ahead.
To learn more about how your organization can eliminate security gaps and cut costs with simplified, comprehensive protection, be sure to join me at Microsoft Secure on March 28, 2023. This new digital event will bring together customers, partners, and the defender community to share perspectives on navigating the security landscape and build on real-world experience. Security is the defining challenge for our world, and it should always be an instrument of hope. It’s going to take all of us to do great security; so, thank you for inspiring us here at Microsoft. Here’s to doing our part and building a safer world for all, together.
To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.
1Morgan Stanley US Tech 4Q22 CIO Survey.
2Cost of a Data Breach, IBM. 2022.
3Methodology: For snapshot data, Microsoft platforms, including Microsoft Defender and Microsoft Azure Active Directory, and our Digital Crimes Unit provided anonymized data on threat activity, such as malicious email accounts, phishing emails, and attacker movement within networks. Additional insights are from the 43 trillion daily security signals gained across Microsoft, including the cloud, endpoints, the intelligent edge, and our Compromise Security Recovery Practice and Detection and Response teams.
4SANS 2022 Security Awareness Report, the SANS Institute. June 28, 2022.
550 Identity And Access Security Stats You Should Know In 2022, Caitlin Jones. January 6, 2023.
6Phishing Scams are the Most Common Cyber Attack, Says FBI, Conor Cawley. May 10, 2022.
7Microsoft Digital Defense Report 2022, Microsoft. 2022.
8Savings based on publicly available estimated pricing for other vendor solutions and web direct/based price shown for Microsoft offerings. Price is not guaranteed and subject to change.
9Innovation Through Inclusion: The Multicultural Cybersecurity Workforce, Frost & Sullivan. 2018.
10Microsoft Joins Abbott, Raytheon to Prepare HBCU Students for Cybersecurity Roles, Mikayla Gruber. June 6, 2022.
