The Secure Future Initiative (SFI) is Microsoft’s long-term program to reimagine how security is built into every stage of its products and services. Instead of treating security as an add-on, SFI embeds it into culture, engineering, and operations.

SFI is organized around three core security principles:

• Secure by Design – Security comes first when designing any product or service.
• Secure by Default – Protections are enabled and enforced out of the box, with minimal customer effort.
• Secure Operations – Controls, monitoring, and response are continuously improved to keep pace with evolving threats.

To make this real, Microsoft has defined 6 engineering pillars and 28 objectives that guide concrete work across identity, networks, tenants, engineering systems, threat detection, and response. As of the November 2025 report:

• 5 of 28 objectives are nearing completion, and 12 have made significant progress.
• The equivalent of 35,000 engineers are focused full time on improving security.

SFI also maps progress to the NIST Cybersecurity Framework and shares customer guidance and patterns (for example, phishing-resistant MFA and eliminating identity lateral movement) so organizations can apply the same approaches in their own environments.

Under SFI, Microsoft is using identity and access control as a primary lever to reduce risk, and backing that up with secure defaults across platforms and services.

Key identity and access improvements include:

• Phishing-resistant MFA adoption: Microsoft has enforced phishing-resistant MFA for 99.6% of employees and devices, using methods like FIDO2, passkeys, and certificate-based authentication.
• Stronger Entra ID foundations: 95% of Microsoft Entra ID signing VMs now run on Azure Confidential Compute, and 94.3% of security token validation uses a standard identity SDK.
• Retiring legacy patterns: Active Directory Federation Services (ADFS) has been discontinued in Microsoft’s productivity environment to reduce attack surface and complexity.

Secure-by-default changes for customers include:

• Mandatory MFA for Azure users, significantly reducing password-related attack risk.
• Azure Bastion Developer providing secure-by-default VM connectivity in 35 regions, helping protect credentials and remote access.
• Azure Local increasing security default settings by 25% (400 additional settings), simplifying compliance and hardening nodes against threats like fileless malware.
• Windows 11 expanding passwordless sign-in (Windows Hello, passkeys, Enhanced Sign-in Security fingerprint peripherals) and adding Quick Machine Recovery for automatic, secure remediation of boot failures.

For customers, Microsoft’s guidance is to adopt similar patterns: roll out phishing-resistant MFA broadly, enforce least-privilege access, secure all tenants with baseline policies, and use the updated Microsoft Cloud Security Benchmark (MCSB v2) via Defender for Cloud as a practical baseline.

SFI is reshaping how Microsoft and its customers detect, investigate, and remediate threats, with a strong focus on AI-enabled capabilities and better visibility.

Improved detection and response at Microsoft:

• Monitoring and inventory: 98% of production infrastructure is centrally tracked, with logs retained for 2 years, and software asset inventory is near complete.
• Threat detections: 50 new detections have been deployed across Microsoft infrastructure, targeting high-priority attacker tactics and techniques; applicable detections are being integrated into Microsoft Defender.
• AI in detection and triage: AI is used across the detection lifecycle, and AI-based vulnerability triage has helped achieve a 72% success rate in addressing vulnerabilities within reduced time-to-mitigate windows, even as volume and scope grow.
• Transparency and external input: Microsoft published 1,096 CVEs, including 53 no-action cloud CVEs, and paid out USD 17 million in bounties to encourage responsible vulnerability disclosure.

AI, data, and SIEM capabilities for customers:

• Microsoft Purview DSPM for AI: Enables organizations to centrally manage and monitor AI data security across Copilots, agents, and other AI apps, including those using third-party LLMs. It also supports prompt-level auditing of Copilot web search to investigate external data sourcing risks.
• Microsoft Sentinel as an AI-first platform: Sentinel now combines SIEM with data lake, graph, and Model Context Protocol (MCP) capabilities, allowing customers to ingest and correlate signals across domains and power AI agents in tools like Security Copilot and GitHub Copilot.
• Security Copilot agents: Autonomous agents help handle high-volume security and IT tasks and are integrated across Microsoft Security and partner solutions, accessible via the Microsoft Security Store.

Alongside these capabilities, Microsoft publishes SFI patterns and practices—repeatable approaches such as phishing-resistant MFA, eliminating identity lateral movement, and securing all tenants—so customers can apply the same operational lessons to strengthen their own detection and response programs.