It’s always difficult to change the direction of a company this size (or even 10 times smaller), but it appears as if Satya has done a reasonable job aligning people’s incentives.
They may still fail, or not make enough progress in a reasonable timeframe, but that’ll happen because the problem is hard to solve and not because people ignored what their CEO and senior leadership told them to do.
the challenge is "how can you prove that this risk will materialize and will cause $3 damage - while the pill costs $5 - and what will the shareholders do". I've been in Audit/GRC/Security for enough years to have had enough 'fights' on risk management. With very few exceptions, the money defines the risk and not the other way around.
If history has taught us anything, it will be IT-Sec-trainwrecks-all-the-way-down.
> but that’ll happen because the problem is hard to solve and not because people ignored what their CEO and senior leadership told them to do
no disrespect to a/this CEO.. but he is 'just' an employee. And he can always tell different things to the Townhalls and the Press/Media, but pull a U-turn. All he has to do is reduce the budget of X-dept, reduce the headcount/org-chart of Y-dept, and while the intentions are great, the effort is not supports (I've made one more comment on this thread about staffing initiatives somewhere higher/lower in this article's comments)
1) there is precedent for Microsoft doing a strong 180 when it comes to security, driven by the original trustworthy computing memo of 2002. We’ll see if Satya means this level or not
2) it looks like they’re being hurt by the most important motivator of all: money. If they don’t tidy up their act fast, govt and industry will come down hard on them. The US is losing the cyber persistence game to China and it’s a national security risk
Edit: precedent/president
It was at that moment she understood why there can be only one top priority. She was a good boss, and learned a lot from working with a hard-headed engineer.