A Microsoft under attack from government and tech rivals after ‘preventable’ hack ties executive pay to cyberthreats

Published

1 year ago

May 22, 2024

admin

Microsoft has come under fire recently from both the U.S. government and rival companies for its failure to stop a Chinese hack of its systems last summer. One change the tech giant is making in response: linking executive compensation more closely to cybersecurity.

In April, a government review board described a hack of Microsoft last summer attributed to China as “preventable.” The U.S. Department of Homeland Security’s Cyber Safety Review Board pointed to “a cascade of errors” and a corporate culture at Microsoft “that deprioritized enterprise security investments and rigorous risk management.”

Competitors have taken advantage of the cyber lapse, with Google publishing a blog post this week highlighting the government findings and noting, “The CSRB report also highlights how many vendors, including Google, are already doing the right thing by engineering approaches that protect against tactics illustrated in the report.”

CrowdStrike prominently displays the government conclusions on its site.

Nation-state attacks from China and Russia are increasing, and targeting corporations across the economy, as well as the U.S. government and social infrastructure. Microsoft has been a very big target, including hacks by Russia and China. There is growing pressure from the U.S. government for the company to improve its cybersecurity protocols, with its top corporate lawyer, Brad Smith, being called to testify on Capitol Hill.

Microsoft is in damage control mode. After a hack of executive email accounts in January attributed to Russian hackers, the company disclosed the incident in compliance with new federal cybersecurity disclosure rules, even though technically it was not a “material” hack that it was required by law to share, leading to discussion at other firms about where to draw the line on the new disclosure. The decision by Microsoft to link executive compensation to successful cybersecurity performance is another is prompting discussions at other firms.

Microsoft launched its Secure Future Initiative in November, and earlier this month, the company outlined in a blog post from Charlie Bell, executive vice president of Microsoft Security, that as part of its SFI goals it will “instill accountability by basing part of the compensation of the company’s Senior Leadership Team on our progress in meeting our security plans and milestones.”

A Microsoft spokesperson declined to provide specifics on the compensation, but said as a company which plays a central role in the world’s digital ecosystem, it has a “critical responsibility” to make cybersecurity a top priority. It is part of the company’s “important governance changes [made] to further support a security-first culture,” the spokesperson said.

Companies often provide more details, though often only limited details, on executive compensation performance targets in annual meeting proxies, which in Microsoft’s case was last held in December 2023.

Cybersecurity as a core corporate risk and bonus metric

It has become more common for corporations to tie a percentage of annual executive bonus payouts to various goals that go beyond meeting sales and profit targets. In recent years, many Fortune 500 companies, including Apple, have added bonus pay tied to ESG metrics. Risk management and safety goals have long been a part of executive compensation, dating back to an era before the rise of ESG — for example, mining and energy companies, as well as manufacturers and industrials, tying bonuses to environmental and worker safety.

The conversations about cybersecurity-linked executive pay have started taking place at other companies since Microsoft made its move, according to Aalap Shah, managing director at executive compensation consultant Pearl Meyer. It’s not prevalent as a compensation practice today, he said, but he added, “post-Microsoft’s announcement, I’ve gotten phone calls asking, ‘Should we do it? Would it work?’ … These conversations are very similar to the ones we were having a few years ago with ESG metrics and a significant percentage of companies adopted them.”

Shah said there is a case to be made that cybersecurity is a core issue that can be equated to mining or industrial safety. But there’s a big difference between a business in cybersecurity and, for example, a retailer, in making this case. And even in industries beyond technology and cybersecurity where keeping data secure is a core issue, such as financial services and health care — which have been targets of high-profile hacks — it’s not a clear case yet to tie executive compensation of the most senior people, such as a chief financial officer or general counsel, to cybersecurity, versus the chief information security officer or chief technology officer, specifically.

Tying pay to hacks is a ‘good place to start’

Some firms will make the case that cybersecurity is already ingrained in their culture and such a move would be redundant, but with the escalation in hacking threats and increased importance of cybersecurity spending to the bottom line of companies like Microsoft, this new executive pay metric may be overdue.

Making executive compensation contingent, to some degree, on meeting cybersecurity aims is a good place to start instilling a security culture at the top of the corporate hierarchy that is fundamental to success, according to experts.

“The most important message being sent internally and externally is it’s very important to their culture and more and more companies will follow suit, regardless of whether the gain is significant,” Shah said. “What they want to do is make sure it is becoming ingrained culturally, and the path to do that is by linking it to compensation.”

“Cybersecurity has to be in the culture of the organization,” said Stuart Madnick, professor of information technology at MIT. But prioritizing security can be difficult within a corporation, Madnick said, because it often means putting money into places that aren’t clearly reflected on the bottom line. “Corporate culture prioritizes other things over security and risk management,” Madnick said. “How do you know how secure you are? Maybe no one is targeting you at the time. But if you increase sales by 20%, that’s money in the bank.”

Madnick’s research shows that gaps in corporate culture are often culprits in high-profile hacks, not just the Microsoft example. Prevention, he says, is as much about foresight as hindsight. In a recent article, he cited MIT studies on Equifax and Capital One security breaches of recent years as other prominent examples. “While some risks are true surprises unlikely to be recognized in advance, many are more like the burglar alarm known to be defective,” he said.

Equifax and Capital One did not respond to requests for comment.

Madnick described the corporate mentality as most often “systematic, semi-conscious decision making.” That means management decisions are made without analyzing the cyber risks that are being introduced by the decision. Tying executive compensation to security aims won’t necessarily mean that approach evaporates from a corporate culture, but he said it has symbolic resonance, and from that symbolic register, the practical may indeed follow.

‘An annoyance and a profit center’

For Microsoft, the stakes are higher than for most organizations. Its platforms and systems are so omnipresent — in business and government — that it’s essentially impossible to live without it. “There’s no alternative to Microsoft, from a productivity standpoint. You have to do insane things to try to work without it,” said Ryan Kalember, executive vice president of cybersecurity strategy at cybersecurity vendor Proofpoint.

Adding to the complexity of Microsoft’s unavoidability, he said, is the layered nature of its platforms, in which succeeding iterations are often buttressed by legacy applications stretching back to the 90s, before security threats remotely resembling what now exists.

The U.S. government has called on the largest, and oldest, tech companies to update systems that both businesses and consumers rely on. Last year, Cybersecurity and Infrastructure Security Agency director Jen Easterly said in a CNBC interview that cybersecurity is consumer safety, and compared it to automotive regulations. “Technology companies who for decades have been creating products and software that are fundamentally insecure need to start creating products that are secure by design and secure by default with safety features baked in,” she said.

Legacy platforms are far easier to plug into and build on rather than deploying a new system entirely, but “it’s a security nightmare,” Kalember said. “One MS365 for everybody from the State Department to Joe’s Crab Shack is a fine business model, it just doesn’t lend itself well to traditional security measures.”

The architectural principles built into some of these legacy systems were designed “when ransomware was really a thing that simply didn’t exist – except on floppy disks,” he said. This has led to the company accruing massive amounts of what is called “technical debt” — decades of it — that can be abused by nation-stated and allow foreign intelligence agencies “to steal anything they want,” he added.

Microsoft is caught between two competing impulses, with security “a combination of an annoyance and a profit center,” Kalember said. It’s a profit center because Microsoft is the world’s largest cybersecurity vendor, reaching $20 billion in annual revenue last year. That makes the compensation move “a good gesture,” he said, but he added, “without specifics behind it, it’s very difficult to assess.”

No details on how Microsoft pay will be influenced

The lack of details on the compensation formula makes it impossible to properly evaluate the incentive. Many companies that adopted ESG metrics did so only in the bonus portion of executive pay, not the long-term incentive plan, which is much more significant. “That’s putting your money where your mouth is,” Shah said.

A bonus may comprise, on average, 20% of executive pay, and within the bonus pool specifically, non-core financial metrics such as ESG only contribute 20% of a potential total bonus payout. “When you have 20% of overall [bonus] compensation and divvy it up into a few different metrics, how much are you really tying something like cyber to it?” Shah said.

Long-term incentive plans tied to equity grants, especially in tech, are where the real money is made, and that’s where these types of non-core financial metrics are low in prevalence. That would be the ideal place within a compensation plan to set pay against long-term cybersecurity and corporate goals, but it is difficult for firms to conceive of two-to-three year goals related to cybersecurity, consumer privacy and data breaches that can be measured like sales and profit. “It will be a challenge,” Shah said. “Is it the number of incidents? The caution I have is the same as with ESG: you want to make sure not only the relevance is there, but you also want to make sure there are quantifiable goals. In a rush to adopt, if it’s subjective, then it is less meaningful for shareholders.”

Boards of directors already have the discretion to hold executives accountable each year and decide to do downward adjustments on bonuses, based on performance, including data breaches. To date, this type of bonus incentive/punishment has been mostly limited to chief information security officers, according to Mike Doonan, managing director at SPMB, an executive search firm where he specializes in technology. In his view, it’s an imperfect comparison to look at the history of bonus pay tied to metrics such as worker safety, since many hacks occur due to third-party vulnerabilities, which are often beyond the company’s direct control. But Doonan said he could see this type of executive incentive being adopted more broadly, “because it’s good PR to say security is a top priority across the entire executive suite, and it might result in improvements.” But he thinks there is an even better way to shore up corporate defense: “saving the bonus pool and investing those dollars into security programs.”

Technology

X lawsuit vs. Apple and OpenAI stays in Fort Worth, Texas; judge suggests they move there

Published

4 hours ago

October 19, 2025

admin

X lawsuit vs. Apple and OpenAI stays in Fort Worth, Texas; judge suggests they move there

Thomas Fuller | SOPA Images | Lightrocket | Getty Images

A judge ordered that X and xAI’s lawsuit accusing Apple and OpenAI of trying to maintain monopolies in artificial intelligence markets must remain in federal court in Fort Worth, Texas, despite “at best minimal connections” to that geographic area by any of the companies.

Judge Mark Pittman, in a sharply ironic four-page order on Thursday, encouraged the companies to relocate their headquarters to Fort Worth, given their preference for the antitrust lawsuit to be heard there.

In a footnote, he even flagged the companies to the website of the Business Services unit of the City of Fort Worth “to get the process started” of relocating there.

Pittman’s order implicitly aims at the tendency of some plaintiffs of a conservative bent to file lawsuits in the Fort Worth division of the U.S. Northern District of Texas courts to increase their chances of winning favorable rulings from the two active judges there, both of whom were appointed by Republicans.

Those plaintiffs have included X and Tesla, both controlled by mega-billionaire Elon Musk, who, until earlier this year, was a top advisor to President Donald Trump.

Pittman was appointed by Trump, but has been critical of the practice of targeting lawsuits to specific judicial districts, known as forum-shopping.

In his order on Thursday, Pittman said that the Fort Worth division’s docket is two to three times busier than the docket of the Dallas division, which has more judges.

Pittman’s order noted that neither Apple nor OpenAI has a strong connection to Fort Worth, other than several Apple stores.

“And, of course, under that logic, there is not a district and division in the entire United States that would not be an appropriate venue for this lawsuit,” Pittman wrote.

X Corp. is headquartered in Bastrop, Texas — roughly 200 miles south of Fort Worth — while both Apple and OpenAI are headquartered in California. Musk’s xAI acquired his social media company X in March in an all-stock transaction.

“Given the present desire to have venue in Fort Worth, the numerous high-stakes lawsuits previously adjudicated in the Fort Worth Division, and the vitality of Fort Worth, the Court highly encourages the Parties to consider moving their headquarters to Fort Worth,” the judge wrote.

“Fort Worth has much more going for it than just the unique artwork on the fourth floor of its historic federal courthouse,” Pittman said.

The judge had asked the three companies to explain why the case belonged in the Fort Worth court.

But neither Apple nor OpenAI requested that the case be moved before the judge’s Oct. 9 deadline, Pittman noted in the order.

Companies are blaming AI for job cuts. Critics say it’s a ‘good excuse’

Published

21 hours ago

October 19, 2025

admin

Companies are blaming AI for job cuts. Critics say it’s a 'good excuse'

More companies are announcing AI-driven layoffs from Salesforce to Accenture.

Twenty20

From tech to airlines, large global companies have been slashing staff as the real-world impact of artificial intelligence plays out, spooking employees. But critics say AI has become an easy excuse for firms looking to downsize.

Last month, tech consultancy firm Accenture announced a restructuring plan that includes quick exits for workers that aren’t first able to reskill on AI. Days later, Lufthansa said it was going to eliminate 4,000 jobs by 2030 as it leans on AI to increase efficiency.

Salesforce also laid off 4,000 customer support roles in September, saying that AI can do 50% of the work at the company. Meanwhile, fintech firm Klarna has reduced staff by 40% as it aggressively adopts AI tools.

Language-learning platform Duolingo has stated that it will gradually stop relying on contractors and use AI to fill the gaps.

The headlines are grim, but Fabian Stephany, assistant professor of AI and work at the Oxford Internet Institute, said there might be more to job cuts than meets the eye.

Previously there may have been some stigma attached to using AI, but now companies are “scapegoating” the technology to take the fall for challenging business moves such as layoffs.

“I’m really skeptical whether the layoffs that we see currently are really due to true efficiency gains. It’s rather really a projection into AI in the sense of ‘We can use AI to make good excuses,'” Stephany said in an interview with CNBC.

Companies can essentially position themselves at the frontier of AI technology to appear innovative and competitive, and simultaneously conceal the real reasons for layoffs, according to Stephany.

“There might be various other reasons why companies are having to get rid of part of their workforce … Duolingo or Klarna are really prime candidates for this because there has been overhiring during Corona [Covid-19 pandemic] as well,” the professor said.

Some companies that flourished during the pandemic “significantly overhired” and the recent layoffs might just be a “market clearance.”

“It’s to some extent firing people that for whom there had not been a sustainable long term perspective and instead of saying “we miscalculated this two, three years ago, they can now come to the scapegoating, and that is saying ‘it’s because of AI though,'” he added.

This pattern has sparked conversation online. One founder, Jean-Christophe Bouglé even said in a popular LinkedIn post that AI adoption is at a “much slower pace” than is being claimed and in large corporations “there’s not much happening” with AI projects even being rolled back due to cost or security concerns.

“At the same time there are announcements of big layoff plans ‘because of AI.’ It looks like a big excuse, in a context where the economy in many countries is slowing down, despite what the incredible performance of stock exchanges suggest,” said Bouglé, who co-founded Authentic.ly.

Feeding the fear of AI

Jasmine Escalera, a careers expert, said this concealment is “feeding the fear of AI” with employees globally concerned about their jobs being replaced as a result of AI.

“So we already know that employees are scared because companies are not being honest, open and communicative about how they’re implementing AI,” Escalera told CNBC Make It. “Now companies are openly stating ‘We’re doing this [layoffs] because of AI’ so it’s feeding the frenzy.”

Escalera said big companies need to be more responsible as they set the tone for what’s the norm in business decision making and avoid greenlighting “bad behavior.”

A Salesforce spokesperson clarified to CNBC that the company deployed its own AI agent, Agentforce, which reduced the number of customer support cases and eliminated the need to “backfill support engineer roles,” they said.

View taken inside a Lufthansa Airbus A350 airplane on March 19, 2025.

Lufthansa to cut 4,000 jobs as airline turns to AI to boost efficiency

“We’ve successfully redeployed hundreds of employees into other areas like professional services, sales, and customer success,” the Salesforce spokesperson added.

Klarna directed CNBC to its co-founder and CEO Sebastian Siemiatkowski’s comments on X where he explained that the company shrank its workforce from 5,500 to 3,000 people in two years but “AI is only part of that story.”

Siemiatkowski linked the workforce reduction to slimming down its analytics team to one “success team,” with many then leaving by natural attrition as well as the reduction of the company’s customer success team.

Lufthansa and Accenture declined to comment on the matter and did not share any further details on their AI restructuring strategy. Duolingo did not respond to CNBC’s request for comment.

Mass AI layoffs are not here

The Budget Lab, a non-partisan policy research center at Yale University, released a report on Wednesday which showed that U.S. labor has actually been little disrupted by AI automation since the release of ChatGPT in 2022.

The lab examined U.S. labor market data from November 2022 to July 2025 using a “dissimilarity index” which measured how much the occupational mix—the share of workers in different jobs—has shifted since AI’s debut and compared it to other technological shifts such as the introduction of computers and the internet. It found that AI hasn’t yet caused widespread job losses.

Additionally, New York Fed economists released research in early September which showed that AI use amongst firms “do not point to significant reductions in employment” across the services and manufacturing industry in the New York–Northern New Jersey region.

It found that 40% of service firms said they were using AI this year, up from 25% last year, while manufacturing firms saw a similar jump from 16% last year to 26% this year, but very few were using AI to layoff workers.

Only 1% of the services firm reported AI as the reason for laying off workers in the past six months, down from 10% that had laid off workers using AI in 2024. Meanwhile, 12% of services firms said AI made them hire less workers in 2025.

By contrast, 35% of services firms have used AI to retrain employees and 11% have hired more as a result.

Stephany said there isn’t much evidence from his research that shows large levels of technological unemployment due to AI.

“Economists call this structural unemployment, so the pie of work is not big enough for everybody anymore and so people will lose jobs definitely because of of AI, I don’t think that this is happening on a mass scale,” he said.

He added that concerns about technology putting an end to human work can be seen throughout history.

“It reoccurred this century alone a dozen times, you can go back to ancient times where Roman emperors put hold to certain machines because they were worried about this and always the contrary happened. The machine made companies, industries more productive.

“It allowed for the emergence of entirely new jobs. If you think about the internet 20 years ago, nobody would have known what a social media influencer is, what an app developer is because it didn’t exist.”

Read more about companies conducting AI layoffs below:

Accenture plans on ‘exiting’ staff who can’t be reskilled on AI amid restructuring strategy

Technology

Close to half of Kalshi user base experienced glitches, delays during Saturday college football games

Published

1 day ago

October 18, 2025

admin

Close to half of Kalshi user base experienced glitches, delays during Saturday college football games

The Kalshi logo arranged on a laptop in New York, US, on Monday, Feb. 10, 2025.

Gabby Jones | Bloomberg | Getty Images

Close to half of Kalshi’s user base experienced glitches and delays on Saturday during college football games, a major source of trades, as some said they were temporarily unable to process orders.

In a message sent to a user obtained by CNBC, the predictions market service’s website apologized for any inconvenience and said it was “looking into” the issues traders were experiencing.

“The Exchange is experiencing temporary delays,” the message read. “Balances and positions may not be accurately reflected at this time.”

One user shared a screen recording and screenshots with CNBC that showed they were unable to see their balance or bets while the issues persisted.

A number of users on X reported the website was down when they were trying to place bets on college football games, with some saying they had open orders that wouldn’t process. When CNBC visited the website, it wouldn’t load, showing only a green K with a spinning circle around it for more than 20 minutes. The platform later loaded.

“Earlier today, Kalshi experienced minor glitches that temporarily affected some user experiences. No exchange outage occurred, no funds were affected, and the issues are now resolved,” the company said in a statement.

Earlier, a spokesperson denied there was an outage and said the exchange “never stopped functioning properly.” He added that there has been no impact on clearing, advanced trading, or institutional trading.

“There were some glitches and delays on our web and app product, which affected less than half of our user base,” the spokesperson said.

A little over a week ago, Kalshi announced a $300 million Series D funding round that valued the company at $5 billion, more than double its $2 billion valuation in June after its Series C round.

The round was co-led by Andreessen Horowitz (a16z) and Sequoia Capital, with participation from Paradigm. Additional backers included Coinbase Ventures, General Catalyst, Spark Capital and CapitalG.

The company, founded in 2018, rose to prominence by offering bettors the ability to trade on a wide range of real-world events, from football games to who President Donald Trump could pardon this year.

WATCH: Kalshi CEO on $2B valuation: We’re one of the fastest growing companies in America