Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Yes. Microsoft made cybersecurity a formal Security Core Priority for employees across the company and incorporated it into performance discussions. The change was announced in 2024 and later reported as implemented for every employee. Microsoft has said security is considered in annual bonus and compensation decisions, but it has not disclosed a universal security score or a fixed percentage of pay tied to it.
What Microsoft changed
Microsoft moved security beyond a general leadership message and into its employee performance process. In a June 13, 2024 announcement, the company said cybersecurity would be a required subject in employees’ twice-yearly “Connect” reviews. Each employee would have a security-related core priority to discuss with a manager, and cybersecurity would be considered in annual bonus and compensation decisions.
Microsoft later used the formal name Security Core Priority. In September 2024, it said security was a core priority for all employees and would be included in performance reviews. In April 2025, it reported that every employee had a Security Core Priority tied directly to performance reviews. Microsoft’s October 2025 account said that, by December 2024, every employee had a defined priority and discussed their individual impact during performance check-ins.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Those statements establish a company-wide review expectation. They do not establish that every employee receives the same security objectives, a standardized numerical security grade, or a fixed share of compensation determined by a security score.
#1 Best Overall
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
Timeline: from initiative to employee reviews
| Date | What Microsoft said |
|---|---|
| November 2023 | Microsoft launched the multiyear Secure Future Initiative (SFI). |
| May 3, 2024 | CEO Satya Nadella said security was “everyone’s top priority,” connecting the change to the company’s response to security criticism and the Cyber Safety Review Board’s findings. Read Nadella’s announcement. |
| June 13, 2024 | Microsoft described the Connect-review requirement and said cybersecurity would be considered in annual bonus and compensation decisions. |
| September 23, 2024 | Microsoft publicly described security as a core priority for all employees and said it would appear in performance reviews. |
| By December 2024 | In an October 2025 account, Microsoft said every employee had a defined Security Core Priority and discussed individual impact in check-ins. |
| April 21, 2025 | Microsoft reported that every employee had a Security Core Priority tied directly to performance reviews. |
| November 10, 2025 | Microsoft’s latest SFI progress report located for this article described continuing cultural and technical progress. A February 2026 corporate update also continued to call security a core priority, without restating the detailed employee-review mechanics. |
What “security” can mean in a performance discussion
The point is not to turn every employee into a security engineer. It is to ask how a person’s own work affects the company’s ability to protect systems, information and customers. Microsoft has not published a universal employee rubric, so the following are practical examples—not disclosed Microsoft scoring requirements:
- Software engineer: address vulnerabilities, use secure coding and dependency practices, test security assumptions, and avoid weakening secure defaults.
- Product manager: include security requirements and abuse cases in planning, use appropriate release gates, and make risk acceptance visible.
- Sales employee: handle customer data carefully, protect account access, and avoid overstating security capabilities.
- Customer-support employee: verify identities, protect customer information, and escalate suspicious activity.
- Finance or operations employee: follow privileged-access controls, report suspicious messages, and apply vendor-risk procedures relevant to the role.
- Manager: plan and staff security work, make escalation safe, and avoid routinely displacing essential fixes for feature deadlines.
These examples also show why one identical metric would be a poor fit across roles. A useful review asks what the employee could influence, what risks they surfaced or reduced, and whether they had the authority and resources to act.
Why Microsoft did it
The change followed scrutiny of Microsoft’s security culture after serious incidents, including the 2023 Storm-0558 compromise involving Microsoft cloud email accounts. Nadella’s May 2024 message explicitly connected the renewed emphasis on security to findings by the U.S. Department of Homeland Security’s Cyber Safety Review Board. Microsoft’s June statement said the focus on security culture prompted changes intended to make employees and senior leaders more accountable for security commitments.
Recommended Free Tools
Rank #2
- With 16 GB of memory, runs as many programs as you want without losing the execution
- The 13.5" 2256 x 1504 screen provides a great movie watching experience
- 512 GB SSD is enough to store your essential documents and files, favorite songs, movies and pictures
- 8 Hours battery run time helps you stay unwired and work longer non-stop
That context matters: the policy was not presented only as a training initiative. Microsoft described it as part of a broader response involving governance, engineering work, identity controls, monitoring, response and remediation. Performance reviews can influence priorities, but they cannot by themselves prevent compromised credentials, insecure design or misconfiguration.
How the reviews fit into the Secure Future Initiative
SFI is Microsoft’s multiyear, cross-company program for changing how products and services are designed, built, tested and operated. Microsoft frames it around three principles:
- Secure by design: account for security while designing a product or service.
- Secure by default: make protective settings the standard rather than leaving them optional.
- Secure operations: improve monitoring, controls, incident response and remediation over time.
Microsoft’s six engineering pillars add operational detail: protect identities and secrets; protect tenants and isolate production systems; protect networks; protect engineering systems; monitor and detect threats; and accelerate response and remediation. The employee priority is the people-and-accountability layer of this larger program, not a substitute for those technical controls. Microsoft’s September 2024 SFI update described both the employee priority and the engineering pillars.
Rank #3
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 13.8" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 20 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 20 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
Employee accountability is not the same as executive compensation accountability
For employees generally, Microsoft described a core priority, a manager discussion in Connect reviews, and consideration of cybersecurity in annual bonus and compensation decisions. It has not publicly specified a common weighting or formula for those decisions.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchFor senior leaders, the company described a more explicit board-level process. Its June 2024 statement said the board’s Compensation Committee considered cybersecurity performance using quantitative and qualitative measures tied to Cyber Safety Review Board recommendations, SFI objectives and other cybersecurity work. The board retained the ability to reduce compensation based on security performance. Microsoft later said senior-leadership security performance was directly linked to compensation.
It would therefore be inaccurate to say that every employee’s pay is mechanically tied to an identical cybersecurity score. The public description supports review and compensation consideration for employees, alongside a distinct and more explicit executive accountability mechanism.
Rank #4
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 15" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 19 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 19 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- Two USB-C / USB4[4] ports and a microSD card reader for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
What Microsoft says has changed
In its November 10, 2025 progress report, Microsoft reported several indicators of SFI activity and progress:
- 95% completion of the latest assigned security training, focused on guarding against AI-powered attacks.
- A nine-point improvement in engineering sentiment around security since February 2024.
- Phishing-resistant multifactor authentication enforced for 99.6% of Microsoft employees and devices.
- 99.5% detection and remediation of live secrets in code.
- More than 50 new detections deployed across Microsoft infrastructure; Microsoft Learn reported more than 250 active detections.
These are Microsoft-reported figures. They help show that the employee priority sits alongside training and technical controls, but they do not prove that the review policy caused the reported improvements. Nor do they establish that Microsoft’s security risks have been eliminated. Public reporting documents the company’s commitments and its own progress measures; it does not disclose a universal review rubric or independently validate the operation of every employee review.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can performance reviews improve security?
They can help if they make preventive work visible and give managers a reason to plan and resource it. Vulnerability remediation, secure design, testing, documentation and early risk escalation can be easy to defer when teams are measured mainly on shipping features. A formal review priority can signal that this work counts.
Best Value
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
But incentives can misfire. A vague requirement may become a checkbox. A metric such as “issues closed” can reward easy fixes over important architectural work, while training completion measures attendance more readily than competence. Employees can also be held responsible for problems they lack the authority, time or budget to fix. If people fear that reporting a risk will hurt their review, they may stay quiet—undermining the purpose of the policy.
For that reason, performance expectations should complement—not replace—secure development gates, access controls, logging, monitoring, incident response and independent testing. Reviews are retrospective; security controls must operate continuously.
Lessons for organizations considering a similar policy
- Set role-specific objectives. Connect expectations to the work and risks each person can influence.
- Measure outcomes thoughtfully. Use meaningful evidence where possible, and check that metrics do not reward easy but low-value activity.
- Reward early escalation. Make reporting a risk or mistake a responsible action, not an automatic career penalty.
- Separate individual conduct from systemic causes. Reviews should account for inherited architecture, staffing, dependencies and management decisions.
- Equip managers to assess the work. They need enough security knowledge, time and authority to distinguish a substantive contribution from a checkbox.
- Fund the expectation. Pair accountability with tools, staffing and time to fix problems.
- Hold executives accountable for trade-offs. Employees should not carry responsibility for risks created by decisions beyond their control.
- Audit the incentives. Look for gaming, under-reporting or unintended pressure to prioritize review-friendly metrics over real risk reduction.
Microsoft’s policy is notable because it placed security in company-wide performance conversations, not just in a security department’s remit. How effective that model is depends on whether role-specific expectations lead to better decisions and stronger controls—not simply more documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
