Rani Lofstrom, Author at Inside Track Blog

Microsoft CISO advice: Governing security at scale with Security Development Lifecycle

Rani Lofstrom — Thu, 18 Jun 2026 15:30:00 +0000

Microsoft first mandated use of Security Development Lifecycle (SDL) in 2004. Now, SDL underpins our Secure Future Initiative (SFI) and supports SFI’s goals of secure by design, secure by default, and secure operations. The SDL is a proven, adaptable approach we apply to building secure products and services.

In this video, Tony Rice, principal security program manager in the Office of the CISO, discusses the teams and organizational systems that help define and adapt security requirements that are applied across the enterprise. You’ll hear about how teams work together to embed security into engineering workflows and scale assurance through automation, secure defaults, and data driven KPIs. We seek to continuously monitor and improve security by applying both automated controls and use of human-driven security reviews.

“This isn’t just about ticking boxes. It’s about making sure that security is embedded in every stage of development and operation,” says Rice.

Learn from our experience

Explore the Microsoft Secure Future Initiative.

Watch this video to hear Tony Rice describe how Microsoft uses governance and automation to apply its Secure Development Lifecycle (SDL) at enterprise-level scale. (For a transcript, please view the video on YouTube: https://www.youtube.com/watch?v=oyciotF-qGA.)

Key takeaways

Here are some practices to socialize in your organization as you seek ways to embed “security first” thinking in your organization:

Inventory, deeply and regularly. Create and review regularly an accurate, complete and categorized inventory of development assets at your company. This practice provides the foundation for automation without knowing what we have.
Invest in scaling assurance functions. Having security policies is not enough. It takes time, attention, and effort to define processes and build technical control automation.
Shift left. “Shifting left” means not waiting until a service or feature is nearly done to consider security requirements. Consider ways to integrate meeting security requirements in the work developers do every day.
Have humans review. Prioritize human-driven security reviews on the businesses most critical scenarios and assets.
Measure your organizational progress. The best way to know if you are succeeding is to measure your progress against your organization’s security requirements. Incremental improvements in measurement and remediation drives real security outcomes.

Try it out

Microsoft CISO advice: Securing AI with full stack red teaming

Rani Lofstrom — Thu, 04 Jun 2026 15:30:00 +0000

At Microsoft, we approach security for AI systems holistically using a full stack red teaming that goes beyond just testing an AI model.

Corporate Vice President of red teaming at Microsoft Craig Nelson describes what he looks for with this method, “I’m interested in the model, but I’m also interested in how that model connects with underlying additional data. And then how that model also executes automation from the back end.”

In this video, Nelson explains why securing AI requires more than testing the model alone.

Watch this video to see Craig Nelson describe how Microsoft approaches full stack red teaming. (For a transcript, please view the video on YouTube: https://www.youtube.com/watch?v=68MmP084rXA.)

Key takeaways

When you apply full stack red teaming to AI, here are some key questions to answer:

How are AI models connecting to data sources?
What backend automation do we allow AI to execute?
What security credentials do we require?
Do we have logs you need to understand how the model works with our backend infrastructure?

Try it out

Learn more about comprehensive cloud security for multicloud and hybrid environments.

Microsoft CISO advice: Consider the risks of early integration with mergers and acquisitions

Rani Lofstrom — Thu, 14 May 2026 16:00:00 +0000

When considering mergers and acquisitions (M&A), security needs to be an important part of the financial and operational due diligence process. At Microsoft, the security organization does more than fulfill the traditional role of assessing risk. It seeks also to address questions about the speed and costs of integrating new resources and capabilities.

Geoff Belknap, CVP and operating CISO shares the questions he asks when considering when and how to integrate technologies with a merged or acquired company.

Watch this video to see Geoff Belknap share questions about integration with M&A. (For a transcript, please view the video on YouTube: https://www.youtube.com/watch?v=mrE2FSXZ-ss.)

Key takeaways

Think about moving slowly with early integration with M&A. Here are some key questions to consider:

What do we risk by combining tools or technical capabilities too quickly?
Is the deal still valuable if we do not integrate systems?
What operational safeguards and governance are needed?

The post Microsoft CISO advice: Consider the risks of early integration with mergers and acquisitions appeared first on Inside Track Blog.

Microsoft CISO advice: Apply engineering fundamentals to securing AI

Rani Lofstrom — Thu, 30 Apr 2026 16:00:00 +0000

Agentic AI, like any software, is just one part of a business solution. It is not the only element that needs to be secured. Engineers need to approach securing agentic AI in the corporate IT ecosystem the same way they would consider any security problem—from end to end.

Yonatan Zunger, CVP and deputy CISO for Microsoft, suggests focusing exclusively on hardening a piece of software to security threats may make it difficult to use and introduce a new risk when users get frustrated and try to bypass controls. This is why engineers need to consider not just individual components but how they work together to maintain productivity.

“Think of every system as a socio-technical system containing many parts, and all of them working together in unison have to be secured,” Zunger says.

Learn from our experience

Read our practical advice about applying security fundamentals to AI.

Watch this video to see Yonatan Zunger explain why engineering fundamentals are critical to building resilient AI systems. (For a transcript, please view the video on YouTube: https://www.youtube.com/watch?v=YU-8lpwPtm0 )

Try it out

Microsoft CISO advice: How to build trustworthy agentic AI

Rani Lofstrom — Thu, 16 Apr 2026 15:15:00 +0000

Building production-ready solutions with agentic AI comes with inherent risks. When agents make mistakes or hallucinate, the potential impacts can multiply rapidly.

“It turns out that it’s very easy to write AI-powered software, but it’s very hard to write AI-powered software that works right in real-world cases,” says Yonatan Zunger, CVP and deputy CISO for Microsoft.

Yunger explains how important it is to test if you want to build trustworthy agentic AI.

Learn from our experience

Read our practical advice about applying security fundamentals to AI.

Watch this video to see Yonatan Zunger explain how to build trustworthy agentic AI. (For a transcript, please view the video on YouTube: https://www.youtube.com/watch?v=eNU7c48541M)

Key takeaways

Here are best practices to apply while building trustworthy agentic AI:

Prototype. Test. Iterate. Think of and try prompts your real users might give your agentic AI. Use real data. From those trials, build a set of test cases and keep testing.
Use AI tools to amplify testing. Evaluating agents requires a “try it and repeat it” mindset. Using AI Foundry with such tools as Python Risk Identification Tool amplifies these assessment capabilities.
Record your tests. Applying this practice, as you would with unit testing, enables you to repeat evaluations as your data models and agents evolve.
Don’t skimp on testing. Test early, test often, test with real data. This is the best way to understand what your agent might do when it encounters the unexpected.

Try it out

Microsoft CISO advice: The importance of a written AI safety plan

Rani Lofstrom — Thu, 09 Apr 2026 16:00:00 +0000

Yonatan Zunger, CVP and Deputy CISO for Microsoft, has spent his career considering complex questions with security and privacy while building platform infrastructure and solutions. His experience underpins his advice on how to build a safety plan for working with AI. First and foremost, his advice is to have a written plan.

“Make it an expectation in your organization that people will create safety plans and have them for everything,” Zunger says. “People get so excited about having clarity in front of them that they end up making much more systematic, careful plans, and the rate of errors goes down dramatically.”

Learn from our experience

Read our practical advice about applying security fundamentals to AI.

Watch this video to see Yonatan Zunger discuss his advice for creating an AI safety plan. (For a transcript, please view the video on YouTube: https://www.youtube.com/watch?v=H5reZ0uw0EA

Key takeaways

Here are questions and ideas to consider as you create a safety plan for your AI systems:

Define the problem. What problem are you trying to solve? A simple and clear problem statement is always a great starting point before building anything, including an AI agent.
Outline the solution. What is the basis of your solution? Can you explain your solution to an end user? What does a developer or administrative user of your solution need to know about what it is and does?
List the things that can go wrong. What can go wrong with your solution? Creating this list is the first step to figuring out how to deal with those issues.
Document your plan. What is your plan to address identified concerns? Identify the process you will follow when something goes wrong.
Draft your plan early and update it as your solution matures. Your safety plan can be as simple as a list or outline and should evolve as you prepare to build your solution.
Get feedback and buy-in. When you review the plan with stakeholders and leaders in your team and organization, you may uncover risks or issues you had not thought of. You also build awareness and agreement on what to do when something goes wrong.
Make a template and build its use into your processes. This tip is for anyone who leads a team or influences process development. Encourage using a safety template in all your projects to bring clarity and structure to how you work with AI.

Try it out

Discover how to secure agentic AI.

Microsoft CISO advice: The most important thing to know about securing AI

Rani Lofstrom — Thu, 02 Apr 2026 16:00:00 +0000

Using AI comes with inherent risks. In a recent video, Yonatan Zunger, CVP and deputy CISO for Microsoft, suggests thinking about AI as a new intern will help you naturally take the right approach to AI security.

Zunger and his team focus on AI safety and security. They consider all the different ways anything involving working with AI can go wrong.

“An important thing to know about AI is that AI’s make mistakes,” Zunger says. “You already know how to work with systems that make mistakes, get tricked.”

Explore Zero Trust for AI

Check out our new Zero Trust for AI tools and guidance.

Watch this video to see Yonatan Zunger discuss his advice for working with AI. (For a transcript, please view the video on YouTube: https://youtu.be/b1x6gDbSWVY. )

Try it out

Explore how to extend Zero Trust principles to AI.

Microsoft CISO advice: Read our four tips for securing your network

Rani Lofstrom — Thu, 19 Mar 2026 16:00:00 +0000

Geoff Belknap, CVP and operating CISO for Core and Enterprise, shares four key practices your business can use to be prepared for managing network security incidents.

Learn from our experience

Network isolation (Secure Future Initiative)

“Knowing where devices are, who owns them, and what they’re supposed to be doing is pretty important in the middle of an incident,” Belknap says.

Watch this video to see Geoff Belknap discuss how we’re securing our network at Microsoft. (For a transcript, please view the video on YouTube: https://www.youtube.com/watch?v=nWPaaTHGE-M.)

Key takeaways

Here are best practices you can use to secure your network:

Build a complete inventory. Keep track of what your network devices are, who owns them, and what they do.
Capture robust telemetry. Make sure your operational teams have the tools they need to see and analyze access and authentication logs.
Use dynamic access control. Manage who can send packets on the corporate network by applying policies.
Deprecate old network assets. Cyberattackers know to look for older, unpatched network devices. You can reduce the attack surface by replacing older devices.

Try it out

Microsoft CISO advice: Explore our four tips for securing your customer support ecosystem

Rani Lofstrom — Thu, 12 Mar 2026 16:00:00 +0000

Microsoft business operations teams know all too well that cyberattackers seek to exploit customer support pathways. Tools that can unlock customer accounts or aid in troubleshooting issues in complex environments are a rich target.

“The path attackers really like to use is to compromise support tooling and laterally move to your core tooling,” says Raji Dani, Deputy Chief Information Security Officer (CISO) for Microsoft business operations.

Learn from our experience

The importance of hardening customer support tools against cyberattacks

Dani and her team focus on understanding and mitigating the risks within customer support operations. In this video, she shares principles and practices for every business that relies on online tools in their customer support ecosystem.

Watch this video to see Raji Dani discuss four customer support ecosystem security principles. (For a transcript, please view the video on YouTube: https://www.youtube.com/watch?v=rJ87jjz3vvo .)

Key takeaways

Here are best practices you can apply to your customer support ecosystem:

Create dedicated and isolated support identities. Use standardized support identities with phish-resistant multifactor authentication based in a separate identity ecosystem.
Implement least privilege and enforce device protection. Only grant the access needed for a given task and nothing more.
Ensure tooling does not have high privilege access to customer data. Architect secure tools and manage service-to-service trust and high privileged access.
Implement strong telemetry. Anomalous patterns in logs and telemetry data are often the first clue a cyberattack is underway.

Try it out

Discover how to start applying Zero Trust practices to protect your customer support ecosystem.

Rani Lofstrom, Author at Inside Track Blog

Microsoft CISO advice: Governing security at scale with Security Development Lifecycle

Key takeaways

Try it out

Related links

Microsoft CISO advice: Securing AI with full stack red teaming

Microsoft CISO advice: Consider the risks of early integration with mergers and acquisitions

Microsoft CISO advice: Apply engineering fundamentals to securing AI

Microsoft CISO advice: How to build trustworthy agentic AI

Microsoft CISO advice: The importance of a written AI safety plan

Microsoft CISO advice: The most important thing to know about securing AI

Microsoft CISO advice: Read our four tips for securing your network

Microsoft CISO advice: Explore our four tips for securing your customer support ecosystem