SECURE FUTURE INITIATIVE
Security above all else
Security is never finished. Every advance in technology creates new opportunities, new risks, and new responsibilities.
Principles
Microsoft Secure Future Initiative
Three principles anchor our approach to the SFI. We’re continuously applying what we’ve learned from incidents to improve our methods and practices, ensuring that security is paramount in everything we create and provide.
Secure by design
Security comes first when designing any product or service.
Secure by default
Security protections are enabled and enforced by default, require no extra effort, and aren’t optional.
Secure operations
Security controls and monitoring will be continuously improved to meet current and future cyberthreats.
Foundations
Foundations of the Secure Future Initiative
Successful business operations and change management are predicated on people, process, and technology working in harmony. These are the foundations of the SFI.
PILLARS
Secure Future Initiative pillars
The six SFI pillars include goals and actions that define our approach to security.
- Reduce the risk of unauthorized access by implementing and enforcing best-in-class standards across all identity and secrets infrastructure, plus user and application authentication and authorization.
Get practical guidance on how to help protect identities and secrets. - Protect all Microsoft tenants and production environments using consistent, best-in-class security practices and strict isolation to minimize breadth of impact.
Get practical guidance on how to help protect tenants and isolate systems. - Protect Microsoft production networks and implement network isolation of Microsoft and customer resources.
Get practical guidance on how to help protect networks. - Protect software assets and continuously improve code security through governance of the software supply chain and engineering systems infrastructure.
Get practical guidance on how to help protect engineering systems. - Provide comprehensive coverage and automatic detection of cyberthreats for Microsoft production infrastructure and services.
Get practical guidance on how to help monitor and detect cyberthreats. - Prevent exploitation of vulnerabilities discovered by external and internal entities through comprehensive and timely remediation.
Get practical guidance on how to help accelerate response and remediation.
Practical Guidance
Actionable guidance grounded in real-world security
Scale securely following SFI patterns and practices based on Microsoft’s tested security insights—what worked, what changed, and what we learned.
Constrain failure with threat modeling for AI systems
Approach threat modeling for AI systems as an ongoing engineering mindset rather than a one-time checklist.
Take a layered approach to defense in depth for agents
This case study shares the top risks of agents and what the layers of the "layered approach" actually are.
Secure your agentic systems
Reduce risk without stalling innovation.
SFI Progress Report
July 2026 SFI progress report
The Microsoft Secure Future Initiative (SFI) is how we embed security across culture, governance, and engineering, and strengthen our ability to adapt as quickly as adversaries do. See the latest on our progress.
RESOURCES
Explore Secure Future Initiative resources
Keep up with the latest SFI information.
SFI progress report
Hear from our Engineering leaders
Read Salim Chawro's thoughts on the July 2026 SFI Progress Report.
SFI patterns and practices
Scale securely following SFI patterns and practices
Each pattern offers practical, repeatable guidance to address real-world risks.
SFI Progress Report
November 2025 SFI Progress Report
See the snapshot of where we were in November.
FAQ
Frequently asked questions
Frequently asked questions
- The Microsoft Secure Future Initiative, launched in November of 2023, is a multiyear commitment that advances the way we design, build, test, and operate our Microsoft technology to ensure that our solutions meet the highest possible standards for security.
- Microsoft launched the SFI to prepare for the increasing scale and high stakes of cyberattacks. SFI brings together every part of Microsoft to advance cybersecurity protection across our company and products. We carefully considered what we saw across Microsoft and what we heard from customers, governments, and partners to identify our greatest opportunities to impact the future of security. For more information on our initial announcement about SFI, see our blog post.
- We plan to keep ourselves accountable and provide the latest SFI news to customers, partners, and the security community through regular updates.
Follow Microsoft