{"id":138308,"date":"2025-04-17T09:00:00","date_gmt":"2025-04-17T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=138308"},"modified":"2025-04-17T08:14:50","modified_gmt":"2025-04-17T15:14:50","slug":"microsofts-secure-by-design-journey-one-year-of-success","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/04\/17\/microsofts-secure-by-design-journey-one-year-of-success\/","title":{"rendered":"Microsoft’s Secure by Design journey: One year of success"},"content":{"rendered":"\n

Cybersecurity is one of the top risks facing businesses. Organizations are struggling to navigate the ever-evolving cyberthreat landscape in which 600 million identity attacks are carried out daily.1<\/sup> The median time for a cyberattacker to access private data from phishing is 1 hour and 12 minutes, and nation-state cyberattacks are on the rise.2<\/sup> Organizations also face unprecedented complexity, making security jobs harder\u201457% of organizations are using more than 40 security tools, which requires significant resourcing and effort to integrate workflows and data.3<\/sup> These challenges are magnified by the global security talent shortage organizations are facing and there are more than 4 million security jobs unfilled worldwide, rising insider risks, and the rapidly evolving regulatory landscape today.4<\/sup> These cybersecurity challenges can not only increase significant business disruptions, they can also create devastating economic damages\u2014the cost of cybercrime is expected to grow at 15% year over year, reaching $15.6 trillion by 2029.5<\/sup>\u00a0<\/p>\n\n\n\n

\n
Get the latest Secure Future Initiative updates<\/a><\/div>\n<\/div>\n\n\n\n

In November 2023, to address the evolution of the digital and regulatory landscape, and the unprecedented changes in the cyberthreat landscape, we announced the Microsoft Secure Future Initiative<\/a>. The Secure Future Initiative (SFI)\u00a0is\u00a0a\u00a0multiyear\u00a0effort\u00a0to\u00a0revolutionize the way we design, build, test, and operate our products and services, to achieve the highest security standards. SFI is our commitment to improve Microsoft\u2019s security posture, thereby improving the security posture of all our customers, and to work with governments and industry to improve the security posture of the entire ecosystem.<\/p>\n\n\n

\"A<\/figure>\n\n\n\n

Last year, the Cybersecurity and Infrastructure Security Agency (CISA), through its “Secure by Design” pledge<\/a>, called on the technology industry to prioritize security at every stage of product development and deployment. This approach of embedding cybersecurity in digital delivery from the outset is also reflected in the United Kingdom\u2019s Government’s Cyber Security Strategy as well as in the Australian Cyber Security Centre (ACSC)\u2019s \u201cEssential Eight\u201d mitigation strategies to protect against cyberthreats. Throughout this blog post, the term \u201cSecure by Design\u201d encompasses both \u201csecure by design\u201d and \u201csecure by default.\u201d<\/p>\n\n\n\n

\n
Read CISA’s Secure by Design pledge<\/a><\/div>\n<\/div>\n\n\n\n

Microsoft committed to work towards key goals across a spectrum of Secure by Design principles<\/a> advocated by numerous government agencies around the world. These goals aim to enhance security outcomes for customers by embedding robust cybersecurity practices throughout the product lifecycle. We continue to take our learnings, feed them back into our security standards, and operationalize these learnings as paved paths that can enable secure design and operations at scale. Our SFI updates provide examples of Microsoft\u2019s progress in implementing secure by design, secure by default, and secure in operations principles, and provide best practices based on Microsoft\u2019s own experience, demonstrating our dedication to improving security for customers.<\/p>\n\n\n\n

Keep reading to learn about the initiatives Microsoft has undertaken over the past 18 months to support secure by design objectives as part of our SFI initiative. It is organized around our SFI principles to provide our customers and partners with an understanding of the robust security measures we are implementing to safeguard their digital environments.<\/p>\n\n\n\n

Enhancing security with multifactor authentication and default password management<\/h2>\n\n\n\n

Phishing-resistant multifactor authentication provides the most robust defense against password-based cyberattacks, including credential stuffing and password theft. This includes promoting multifactor authentication among customers, implementing it as a default requirement for access, and participating in efforts to establish long-term standards in authentication.<\/p>\n\n\n\n

In October 2024, Microsoft implemented mandatory multifactor authentication<\/a> for the Microsoft Azure portal, Microsoft Entra admin center, and Microsoft Intune admin center. Since then, Microsoft has worked with our customers to reduce extensions and rapidly advance multifactor authentication adoption. A key achievement is our progress in eliminating passwords across products. Microsoft has introduced enhancements to streamline authentication<\/a> and improve sign-in experiences, emphasizing usability and security. Users can now remove passwords from their accounts and use passkeys instead, addressing vulnerabilities and preventing unauthorized access. <\/p>\n\n\n\n

On March 26, 2025, Microsoft launched a new sign-in experience for more than 1 billion users. By the end of April 2025, most Microsoft account users will see updated sign-in and sign-up user experience flows for web and mobile apps. This new user experience is optimized for a passwordless and passkey-first experience. Microsoft is also updating the account sign-in logic to make passkey the default sign-in choice whenever possible.<\/p>\n\n\n\n

Additional examples of Microsoft improving authentication and how customers can learn from Microsoft\u2019s approach and solutions include:<\/p>\n\n\n\n