Security incidents lead to pay cuts for Microsoft executives

Last year, Chinese hacker group Storm-0558 breached Microsoft's Azure cloud service and obtained data from hundreds of organizations, including several US government agencies. After several months of investigation, Microsoft concluded that this was possible thanks to a series of bugs and misconfigurations that individually would not have been catastrophic, but when they all happened at the same time, they were.

In January this year, the major breach was followed by another, this time carried out by the Russian hacking group Midnight Blizzard. Criticism after these attacks was strong, not least from the American authorities. The US Cyber ​​Safety Review Board published a report accusing Microsoft of having a flawed security culture, misleading the public, and dealing with incidents that could have been prevented.

At the end of 2023, Microsoft launched an initiative to regain the trust of IT managers, and now the company foot A series of changes within the framework of this initiative.

– We make security our top priority at Microsoft, above everything else we do, wrote security director Charlie Bell.

One such change is to link company management bonuses to security. If a company suffers from serious security incidents, or if security developments do not follow set goals, C-level managers will not be paid as much.

If you have to choose between security and another priority, the right answer is clear: Choose security, Microsoft CEO Satya Nadella wrote in a memo to all employees who… the edge It has come.