Just a few years ago, cybersecurity was mainly associated with antivirus software and a firewall. Today, that is clearly not enough. Increasingly sophisticated attacks, the growth of artificial intelligence and cloud-based work mean that protecting company data requires an entirely new approach.
This is confirmed by the latest Secure Future Initiative (SFI) report – the largest cybersecurity programme in Microsoft’s history. The document not only shows how the company secures its own global infrastructure, but above all identifies measures that organisations of any size can implement – from small businesses to large enterprises.
If your company uses Microsoft 365, Azure services or other Microsoft solutions, the report’s findings can provide valuable inspiration for strengthening security.
What is the Secure Future Initiative?
Secure Future Initiative (SFI) is a strategic programme by Microsoft aimed at improving the security of all the company’s products, services and processes.
It is the largest initiative of its kind in Microsoft’s history. Thousands of specialists responsible for developing cloud services, operating systems and business platforms are involved.
The programme is based on one simple principle:
Security takes priority over everything else.
However, this does not only mean investing in new technologies. Secure Future Initiative focuses above all on eliminating potential threats before they become real problems.
- Microsoft divides its efforts into three main areas:
- building secure infrastructure foundations,
- actively detecting and eliminating threats,
- preparing the organisation for future challenges related to AI and the development of new technologies.
This approach is increasingly becoming the standard in modern enterprises as well.
The figures that demonstrate the scale of Microsoft’s efforts
The Secure Future Initiative report contains a range of specific data illustrating what security looks like in practice.
Microsoft reported, among other things:
- the implementation of phishing-resistant MFA for 99,97% of user-device pairs,
- the removal of public access to more than 732 thousand resources,
- the retirement of more than 1,4 million unused applications,
- the expanded use of Zero Trust,
- architecture the implementation of further Secure by Defaultmechanisms, i.e. secure default settings.
At first glance, these are merely numbers. In reality, however, they show something much more important: effective cybersecurity is not built around a single solution, but around hundreds of small actions carried out every day.
AI helps organisations not only work faster, but also protect themselves more effectively
Artificial intelligence is now most commonly associated with content creation, data analysis and workflow automation. However, it is also playing an increasingly important role in cybersecurity.
Microsoft uses AI, among other things, to:
- detect suspicious activity,
- analyse millions of security events,
- identify configuration errors,
- highlight the most critical vulnerabilities,
- support incident response teams.
This is particularly important because cybercriminals are also increasingly using artificial intelligence to conduct attacks. AI can now create more convincing phishing messages, automatically search for vulnerabilities and accelerate the development of malware.
That is why modern cybersecurity is increasingly based on the principle of AI versus AI – intelligent systems help detect and block threats before they can cause damage.
User identity has become the new line of defence
Until recently, companies focused primarily on protecting their networks. Today, users and their accounts are the most common targets of attacks.
Compromising a single login can give cybercriminals access to email, documents, business systems and even an organisation’s entire infrastructure.
That is why Microsoft placed such strong emphasis on implementing phishing-resistant authentication (phishing-resistant MFA).
For businesses, this means implementing modern identity protection methods, such as:
- multi-factor authentication,
- passwordless sign-in,
- Conditional Access policies,
- regular reviews of user accounts and permissions.
Identity protection is now one of the most effective ways to reduce the risk of cyberattacks.
Digital clutter can be just as dangerous as a cyberattack
One of the most interesting findings from the report is the number of items removed by Microsoft.
The company removed public access to more than 732 thousand resources and retired more than 1,4 million inactive applications.
This shows that even the largest organisations accumulate vast numbers of unnecessary infrastructure components over time.
These may include:
- legacy applications,
- unused virtual machines,
- forgotten test environments,
- accounts belonging to former employees,
- outdated integrations with other systems.
Each of these components expands the attack surface and can be exploited by cybercriminals.
Therefore, one of the simplest ways to improve security is to regularly tidy up the IT environment.
Secure by Default – security from day one
One of the pillars of the Secure Future Initiative is the Secure by Default.
principle. Its premise is simple: new services and solutions should be configured by default to provide the highest possible level of protection.
This means businesses do not need to remember to manually enable every security feature immediately after deployment.
This approach reduces the risk of configuration errors, which remain among the most common causes of security incidents.
Zero Trust – why are more and more companies choosing this model?
Zero Trust has been one of the most important cybersecurity trends for several years. Nevertheless, many organisations still view it as just another technology solution.
In practice, it is a way of designing the entire IT environment.
Its core principle is:
Never trust. Always verify.
In practice, this means that every attempt to access company data is checked for:
- user identity,
- device,
- location,
- risk level,
- assigned permissions.
This approach makes it significantly more difficult for an attack to progress, even if cybercriminals compromise an employee account.
5 practical actions worth implementing in your organisation
Microsoft’s experience shows that improving security does not always require costly investments. Well-planned organisational measures often deliver the greatest impact.
- Protect identities
- Enable MFA for all users.
- Consider implementing passwordless sign-in.
- Remove inactive accounts regularly.
- Reduce the attack surface
- Remove unused applications.
- Close unnecessary public-facing resources.
- Review your environment configuration regularly.
- Control applications
- Review assigned permissions.
- Remove unused integrations.
- Monitor third-party applications.
- Use secure settings
- Keep systems up to date.
- Implement recommended configurations.
- Automate security policies.
- Build a Zero Trust environment
- Verify every access request.
- Segment the network.
- Monitor user and device activity.
Is your organisation ready?
To conclude, it is worth asking yourself a few simple questions:
- Do all employees use MFA?
- Do we know how many unused applications are running in our organisation?
- Are all public-facing resources still required?
- Do we regularly review user permissions?
- Does our environment operate in line with Zero Trust principles?
If the answer to any of these questions is “I don’t know”, it is worth treating this as a signal to carry out a security audit.
The key lesson from the Microsoft report
Secure Future Initiative shows that effective cybersecurity does not rely on a single product or one-off implementation.
It is a process of continuous improvement that includes:
- identity protection,
- reducing the attack surface,
- regularly streamlining the IT environment,
- implementing secure configurations,
- using artificial intelligence to detect threats.
This approach is what enables organisations to build resilience against today’s cyber threats.
Summary
The Secure Future Initiative report shows that cybersecurity is now one of the key elements of business strategy. Companies seeking to protect their data effectively should invest not only in new technologies, but also in proven processes, regular environment reviews and modern identity protection methods.
Solutions such as Microsoft 365 Business Premium, Microsoft Defender, Microsoft Entra and Microsoft Intune enable SMEs to implement the security best practices used by Microsoft.
In a world where threats evolve as rapidly as technology, security is no longer an add-on to IT infrastructure. It is the foundation of a modern, resilient business.
Would you like to learn more about Microsoft’s cybersecurity offering? Our team of experts will be happy to answer your questions and help you select the most suitable solution:
We also invite you to visit our website, where you can find more information about the products. Explore it to find out more: MICROSOFT
