Summary

  • The Cyber Safety Review Board asked for "a plan with specific timelines". Microsoft's published engineering targets are 100% goals with no individual calendar dates and no named owner per target.
  • Microsoft states in its own progress report that it does not disclose the full body of work behind each objective, and no independent attestation of the published percentages appears in the eleven documents reviewed for this piece.

A completion percentage is a strange object. It looks like a measurement, reads like a verdict, and behaves like a promise. When the party being measured writes it, revises the population it describes, and publishes it on a cadence of its own choosing, the number stops functioning as evidence. It becomes a management claim in a numeric costume.

Microsoft is the clearest live case of that problem in enterprise computing, and the record is unusually explicit about it. The Cyber Safety Review Board's report, Review of the Summer 2023 Microsoft Exchange Online Intrusion, carries a cover date of 20 March 2024 and does not soften its first recommendation: "The CEO and Board should develop, and share publicly, a plan with specific timelines to make fundamental, security-focused reforms" (CSRB report, printed page 19).

That sentence contains four testable demands. A plan. Specific timelines. Public sharing. Accountability at the level of the CEO and the Board. Microsoft met three of them with unusual speed. The fourth — the timeline — is where the instrument thins out, and the fourth is the one a customer, an insurer or a director would actually use.

What was promised, precisely

On 3 May 2024, Microsoft's security leadership published the engineering commitments that became the spine of the Secure Future Initiative. The language is categorical: "100% of access to source code and engineering systems infrastructure is secured through Zero Trust and least-privilege access policies" (Microsoft Security Blog, 3 May 2024). Adherence, the post says, would be measured through objectives and key results.

Those targets, as published, carry no individual calendar dates and no named owner per target. That is not a small omission in a document whose stated purpose was to answer a demand for timelines. A 100% goal with no date is a direction of travel. A 100% goal with no owner is a direction of travel nobody has agreed to be blamed for.

What the same day did produce, and produce memorably, was an incentive. Satya Nadella, Chairman and CEO, wrote that the company would begin "basing part of the compensation of the senior leadership team on our progress towards meeting our security plans and milestones" (The Official Microsoft Blog, 3 May 2024). Four months later the company restated it flatly: "Microsoft's senior leadership team now has security performance directly linked to compensation" (progress update, 23 September 2024).

The same announcement named the machinery: CISO Igor Tsyganskiy leading a Deputy CISOs' Cybersecurity Governance Council responsible for overall cyber risk, defence and compliance, with weekly senior-leadership reviews, quarterly Board updates and security performance folded into employee reviews.

This is a real control surface. It is also entirely internal. A compensation link tells you where the pressure sits inside the company; it tells an outside buyer nothing about what was verified, by whom, or against which baseline. No weight, threshold or automatic reduction was disclosed in the material read.

The number that moved, and the sentence that explains it

Start with the cleanest published series. In September 2024, Microsoft reported that "85% of our production build pipelines for the commercial cloud are now using centrally governed pipeline templates" (September 2024 progress report, printed page 19). By April 2025, coverage stood at 92% of commercial-cloud build pipelines, 54% of release pipelines and 56% of code-signing access restricted to production-tenant identities (April 2025 progress report). November 2025 reported 94% of release pipelines on governed templates and 89% network isolation (November 2025 progress report). July 2026 reported 93% of critical and high-value build pipelines and 90% of release pipelines (July 2026 Trust Center summary).

Read that sequence and one number declines: release-pipeline coverage, from 94% in November 2025 to 90% in July 2026. Microsoft addresses the movement in the July 2026 report itself: "Recent metric variation reflects expanded measurement scope, with final attribution under review" (July 2026 progress report, printed page 23).

That sentence is honest, and it is also the whole problem compressed into fourteen words. A coverage figure can fall for two reasons that mean opposite things. Either the company secured less, or it counted more. Microsoft tells the reader both are possible and that it has not finished deciding which. The reader is left holding a percentage whose meaning is formally unresolved by its own publisher, with no fixed cohort published against which to reconcile it.

The methodology paragraph makes the same point structurally rather than episodically. In the April 2025 report: "We calculated progress by recording the completed percentage of standards and key results, those defined initially and any additions" (April 2025 progress report, printed page 4). The denominator grows when the company decides the work is bigger. That is defensible engineering management. It is not a measurement of a fixed thing over time, and it should never be charted as one.

Microsoft does not hide this. In November 2025 it wrote plainly: "We do not disclose the full body of work we are undertaking to advance an objective (such as standards and key results)" (November 2025 progress report, printed page 4). Approximately 80,000 pipelines are monitored; five of seven major security-log categories met the retention standard as of April 2025. Those are countable facts. They are not the denominators behind the headline percentages, and the company says so.

Bands, flags and a word that does a lot of work

Progress is published mostly in bands. April 2025 placed objectives 1–3 in the 95–99% band and objectives 4–5 in the 66–94% band. November 2025 kept objectives 2–3 at 95–99% and moved objectives 1, 4 and 5 to 66–94%, attributing the shift to expanded inventory scope. July 2026 records objective 1 as closed, objectives 2–3 at 95–99% and objectives 4–5 at 66–94%.

A band is not a count, and "closed" is not a ratio. Closure means the intended outcome was reached, not that a disclosed share of a disclosed population passed a stated test. Meanwhile the mitigation measure — success against reduced vulnerability-mitigation time targets — moved from 90% to 73% after the programme expanded scope, then to 72% in November 2025. Microsoft attributes the drop to that expansion, which is precisely why the change cannot be read as deterioration. It also cannot be read as improvement.

And then there is the number everyone quotes. November 2025 announced "achieving 99.5% detection and remediation of live secrets in code" (November 2025 progress report announcement). The statement offers no numerator, no denominator, no sampling method, and no indication whether it measures coverage, detection performance or remediation completion. It should not be repeated as an accuracy rate. It is a company's summary of its own work, and on its own page it stays that.

None of this makes the programme theatre. Microsoft does publish calendar-dated commitments: the July 2026 announcement sets a goal of transitioning to post-quantum cryptography in critical products and services by 2029 (July 2026 announcement). It publishes aggregate volume claims — more than 550,000 instances of critical and high-risk open-source vulnerabilities remediated, and automated container patching addressing roughly three million vulnerability instances a month. It publishes a cadence commitment: "We plan to keep ourselves accountable and provide the latest SFI news to customers, partners, and the security community through regular updates" (SFI hub).

What it does not publish, on the evidence of the hub, is a fixed schedule. The most recent report listed is July 2026, announced on 10 July 2026; the hub page itself carries no displayed publication date.

The line that separates a report from an audit

Here is where the board's first recommendation and Microsoft's response diverge most consequentially. The board wanted accountability. Microsoft built accountability that terminates inside the building.

Its own appendix to the April 2025 report labels CSRB recommendations 1–4 complete. That labelling is the company's assessment of its own compliance, which is a normal thing for a company to state and an insufficient thing for anyone else to rely on. The board's report does not independently validate later completion claims, and no attestation by an outside party of the published percentages was identified in the eleven documents reviewed for this piece at their stated retrieval dates: the board's report, four detailed progress reports, four dated company announcements, the July 2026 summary page and the SFI hub.

Internal testing, standards mappings and the board's earlier incident review are not independent assurance over subsequent progress figures. Absence from this reviewed set is not proof that no external attestation exists — but a buyer searching for one will not find it in the most obvious place.

That is the finding, and it has a price. Every enterprise that treats a vendor's published security completion percentage as assurance is relying on a claim whose definition, population and period the vendor controls, whose movement the vendor explains after the fact, and whose underlying work inventory the vendor states it withholds. The percentage is not worthless. It is a management signal, and management signals are useful the way a company's own forecast is useful: as evidence about how the company thinks, not as evidence about what is true.

The reform plan the board demanded exists. What does not exist is the marking scheme an outsider could apply to it.

Microsoft Corporation is tracked in the BTW directory as an ARIN-linked operator; that listing records number-resource footprint, not security posture, and nothing in it corroborates or contradicts the percentages above.

Earlier BTW reporting treated this company as a product and market participant: Copilot consolidation, reported Microsoft–Amazon–OpenAI manoeuvring and a CISA advisory on Intune administrator controls after the Stryker intrusion, all on 19 March 2026; a Microsoft 365 outage on 23 January 2026; the G42 200 MW UAE data-centre expansion on 7 November 2025; and the UK Competition and Markets Authority's cloud-market recommendations on 1 August 2025. None of those tested what replaced an enforceable remedy after an external review. This is that test, and the answer is a management system doing the work an audit would have to do.