A Microsoft under attack from government and tech rivals after ‘preventable’ hack ties executive pay to cyberthreats

Published

2 years ago

May 22, 2024

admin

Microsoft has come under fire recently from both the U.S. government and rival companies for its failure to stop a Chinese hack of its systems last summer. One change the tech giant is making in response: linking executive compensation more closely to cybersecurity.

In April, a government review board described a hack of Microsoft last summer attributed to China as “preventable.” The U.S. Department of Homeland Security’s Cyber Safety Review Board pointed to “a cascade of errors” and a corporate culture at Microsoft “that deprioritized enterprise security investments and rigorous risk management.”

Competitors have taken advantage of the cyber lapse, with Google publishing a blog post this week highlighting the government findings and noting, “The CSRB report also highlights how many vendors, including Google, are already doing the right thing by engineering approaches that protect against tactics illustrated in the report.”

CrowdStrike prominently displays the government conclusions on its site.

Nation-state attacks from China and Russia are increasing, and targeting corporations across the economy, as well as the U.S. government and social infrastructure. Microsoft has been a very big target, including hacks by Russia and China. There is growing pressure from the U.S. government for the company to improve its cybersecurity protocols, with its top corporate lawyer, Brad Smith, being called to testify on Capitol Hill.

Microsoft is in damage control mode. After a hack of executive email accounts in January attributed to Russian hackers, the company disclosed the incident in compliance with new federal cybersecurity disclosure rules, even though technically it was not a “material” hack that it was required by law to share, leading to discussion at other firms about where to draw the line on the new disclosure. The decision by Microsoft to link executive compensation to successful cybersecurity performance is another is prompting discussions at other firms.

Microsoft launched its Secure Future Initiative in November, and earlier this month, the company outlined in a blog post from Charlie Bell, executive vice president of Microsoft Security, that as part of its SFI goals it will “instill accountability by basing part of the compensation of the company’s Senior Leadership Team on our progress in meeting our security plans and milestones.”

A Microsoft spokesperson declined to provide specifics on the compensation, but said as a company which plays a central role in the world’s digital ecosystem, it has a “critical responsibility” to make cybersecurity a top priority. It is part of the company’s “important governance changes [made] to further support a security-first culture,” the spokesperson said.

Companies often provide more details, though often only limited details, on executive compensation performance targets in annual meeting proxies, which in Microsoft’s case was last held in December 2023.

Cybersecurity as a core corporate risk and bonus metric

It has become more common for corporations to tie a percentage of annual executive bonus payouts to various goals that go beyond meeting sales and profit targets. In recent years, many Fortune 500 companies, including Apple, have added bonus pay tied to ESG metrics. Risk management and safety goals have long been a part of executive compensation, dating back to an era before the rise of ESG — for example, mining and energy companies, as well as manufacturers and industrials, tying bonuses to environmental and worker safety.

The conversations about cybersecurity-linked executive pay have started taking place at other companies since Microsoft made its move, according to Aalap Shah, managing director at executive compensation consultant Pearl Meyer. It’s not prevalent as a compensation practice today, he said, but he added, “post-Microsoft’s announcement, I’ve gotten phone calls asking, ‘Should we do it? Would it work?’ … These conversations are very similar to the ones we were having a few years ago with ESG metrics and a significant percentage of companies adopted them.”

Shah said there is a case to be made that cybersecurity is a core issue that can be equated to mining or industrial safety. But there’s a big difference between a business in cybersecurity and, for example, a retailer, in making this case. And even in industries beyond technology and cybersecurity where keeping data secure is a core issue, such as financial services and health care — which have been targets of high-profile hacks — it’s not a clear case yet to tie executive compensation of the most senior people, such as a chief financial officer or general counsel, to cybersecurity, versus the chief information security officer or chief technology officer, specifically.

Tying pay to hacks is a ‘good place to start’

Some firms will make the case that cybersecurity is already ingrained in their culture and such a move would be redundant, but with the escalation in hacking threats and increased importance of cybersecurity spending to the bottom line of companies like Microsoft, this new executive pay metric may be overdue.

Making executive compensation contingent, to some degree, on meeting cybersecurity aims is a good place to start instilling a security culture at the top of the corporate hierarchy that is fundamental to success, according to experts.

“The most important message being sent internally and externally is it’s very important to their culture and more and more companies will follow suit, regardless of whether the gain is significant,” Shah said. “What they want to do is make sure it is becoming ingrained culturally, and the path to do that is by linking it to compensation.”

“Cybersecurity has to be in the culture of the organization,” said Stuart Madnick, professor of information technology at MIT. But prioritizing security can be difficult within a corporation, Madnick said, because it often means putting money into places that aren’t clearly reflected on the bottom line. “Corporate culture prioritizes other things over security and risk management,” Madnick said. “How do you know how secure you are? Maybe no one is targeting you at the time. But if you increase sales by 20%, that’s money in the bank.”

Madnick’s research shows that gaps in corporate culture are often culprits in high-profile hacks, not just the Microsoft example. Prevention, he says, is as much about foresight as hindsight. In a recent article, he cited MIT studies on Equifax and Capital One security breaches of recent years as other prominent examples. “While some risks are true surprises unlikely to be recognized in advance, many are more like the burglar alarm known to be defective,” he said.

Equifax and Capital One did not respond to requests for comment.

Madnick described the corporate mentality as most often “systematic, semi-conscious decision making.” That means management decisions are made without analyzing the cyber risks that are being introduced by the decision. Tying executive compensation to security aims won’t necessarily mean that approach evaporates from a corporate culture, but he said it has symbolic resonance, and from that symbolic register, the practical may indeed follow.

‘An annoyance and a profit center’

For Microsoft, the stakes are higher than for most organizations. Its platforms and systems are so omnipresent — in business and government — that it’s essentially impossible to live without it. “There’s no alternative to Microsoft, from a productivity standpoint. You have to do insane things to try to work without it,” said Ryan Kalember, executive vice president of cybersecurity strategy at cybersecurity vendor Proofpoint.

Adding to the complexity of Microsoft’s unavoidability, he said, is the layered nature of its platforms, in which succeeding iterations are often buttressed by legacy applications stretching back to the 90s, before security threats remotely resembling what now exists.

The U.S. government has called on the largest, and oldest, tech companies to update systems that both businesses and consumers rely on. Last year, Cybersecurity and Infrastructure Security Agency director Jen Easterly said in a CNBC interview that cybersecurity is consumer safety, and compared it to automotive regulations. “Technology companies who for decades have been creating products and software that are fundamentally insecure need to start creating products that are secure by design and secure by default with safety features baked in,” she said.

Legacy platforms are far easier to plug into and build on rather than deploying a new system entirely, but “it’s a security nightmare,” Kalember said. “One MS365 for everybody from the State Department to Joe’s Crab Shack is a fine business model, it just doesn’t lend itself well to traditional security measures.”

The architectural principles built into some of these legacy systems were designed “when ransomware was really a thing that simply didn’t exist – except on floppy disks,” he said. This has led to the company accruing massive amounts of what is called “technical debt” — decades of it — that can be abused by nation-stated and allow foreign intelligence agencies “to steal anything they want,” he added.

Microsoft is caught between two competing impulses, with security “a combination of an annoyance and a profit center,” Kalember said. It’s a profit center because Microsoft is the world’s largest cybersecurity vendor, reaching $20 billion in annual revenue last year. That makes the compensation move “a good gesture,” he said, but he added, “without specifics behind it, it’s very difficult to assess.”

No details on how Microsoft pay will be influenced

The lack of details on the compensation formula makes it impossible to properly evaluate the incentive. Many companies that adopted ESG metrics did so only in the bonus portion of executive pay, not the long-term incentive plan, which is much more significant. “That’s putting your money where your mouth is,” Shah said.

A bonus may comprise, on average, 20% of executive pay, and within the bonus pool specifically, non-core financial metrics such as ESG only contribute 20% of a potential total bonus payout. “When you have 20% of overall [bonus] compensation and divvy it up into a few different metrics, how much are you really tying something like cyber to it?” Shah said.

Long-term incentive plans tied to equity grants, especially in tech, are where the real money is made, and that’s where these types of non-core financial metrics are low in prevalence. That would be the ideal place within a compensation plan to set pay against long-term cybersecurity and corporate goals, but it is difficult for firms to conceive of two-to-three year goals related to cybersecurity, consumer privacy and data breaches that can be measured like sales and profit. “It will be a challenge,” Shah said. “Is it the number of incidents? The caution I have is the same as with ESG: you want to make sure not only the relevance is there, but you also want to make sure there are quantifiable goals. In a rush to adopt, if it’s subjective, then it is less meaningful for shareholders.”

Boards of directors already have the discretion to hold executives accountable each year and decide to do downward adjustments on bonuses, based on performance, including data breaches. To date, this type of bonus incentive/punishment has been mostly limited to chief information security officers, according to Mike Doonan, managing director at SPMB, an executive search firm where he specializes in technology. In his view, it’s an imperfect comparison to look at the history of bonus pay tied to metrics such as worker safety, since many hacks occur due to third-party vulnerabilities, which are often beyond the company’s direct control. But Doonan said he could see this type of executive incentive being adopted more broadly, “because it’s good PR to say security is a top priority across the entire executive suite, and it might result in improvements.” But he thinks there is an even better way to shore up corporate defense: “saving the bonus pool and investing those dollars into security programs.”

Technology

Week in review: Stocks rise, Meta gets real on metaverse, and Salesforce bounces

Published

22 hours ago

December 6, 2025

admin

Week in review: Stocks rise, Meta gets real on metaverse, and Salesforce bounces

Technology

‘Terrifying’: Why U.S. senator in top intel post wants more spying on Chinese companies

Published

22 hours ago

December 6, 2025

admin

'Terrifying': Why U.S. senator in top intel post wants more spying on Chinese companies

Sen. Mark Warner on a Chinese tech threat that will be bigger than Huawei

Go back a decade and most Americans had never heard of Huawei. Today, the Chinese telecom giant is a symbol of how quickly China can dominate a strategic technology sector and in the process create new national security and market threats for U.S. government and industry.

Democratic Senator Mark Warner of Virginia, the top Democrat on the Senate Select Committee on Intelligence, is now worried about another Chinese company that he predicts will eclipse Huawei in both scale and consequence: BGI. It is not building cell towers or smartphones for the 5G era. It is collecting DNA.

“If Huawei was big, BGI will be even bigger,” Warner said at the CNBC CFO Council Summit in Washington, D.C. on Wednesday.

BGI is one of the largest genomics companies in the world. It operates DNA sequencing laboratories in China and abroad. It processes genetic data for hospitals, pharmaceutical firms and researchers across dozens of countries, according to a recent report by the National Security Commission on Emerging Biotechnology.

The company began as a Beijing-based research entity, the Beijing Genomics Institute, tied closely to China’s national genome projects. It later expanded into a global commercial powerhouse, selling DNA sequencing, prenatal testing, cancer screening, and large-scale population genetic analysis, according to an NBC News report.

Through subsidiaries, BGI says it operates in the U.S. Europe, and Japan. In several countries, it helped built national genetic databases and pandemic testing systems.

A man visits the booth of BGI at the Healthy Life Chain area of the third China International Supply Chain Expo CISCE in Beijing, capital of China, July 16, 2025.

Xinhua News Agency | Xinhua News Agency | Getty Images

U.S. intelligence officials believe that global footprint gives BGI access to one the largest collections of genetic data on Earth. Lawmakers have warned that genetic data is not just medical information. At scale, it becomes a strategic asset spurring a “DNA arms race,” according to a Washington Post report. DNA profiles can reveal ancestry, physical traits, disease risk, and family relationships, and when linked with artificial intelligence, the data can also be used for surveillance, tracking and long-term biological research tied to national security, according to the Washington Post’s reporting.

At the CNBC event this week, Warner continued to press for more focus on BGI. “They are hoovering up DNA data,” Warner said. “This level of experimentation on humans and intellectual property theft, we all should be concerned about it.”

Congressional investigators have previously warned that BGI maintains close ties to the Chinese Communist Party and Chinese military, according to a report from the House Select Committee on the CCP. They argue that China makes little distinction between commercial data and state security needs.

The ‘super soldier’ fear

One of the biggest fears tied to BGI and China’s broader biotech push is the possibility of a genetically enhanced soldier. U.S. officials have publicly claimed that China has explored human performance enhancement and military biotechnology. U.S. defense analysts say China’s research spans population DNA collection, military databases, and AI-driven human performance modeling, according to a Wall Street Journal op-ed written by U.S. Director of the Central Intelligence Agency John Ratcliffe in 2020, when he was Director of National Intelligence during President Trump’s first term.

Warner directly referenced those concerns this week.

“It’s terrifying,” Warner said.

Troops make preparations before a military parade in Beijing, capital of China, Sept. 3, 2025.

Xinhua News Agency | Xinhua News Agency | Getty Images

Warner described China as a great nation and great competitor, and as a former telecom executive (he was among the founders of Nextel), he said what Huawei was able to execute on — producing good products at inexpensive prices before the U.S. and Western competitors were prepared — is a cautionary tale.

The BGI story looks uncomfortably familiar to Warner.

“Go back in time eight or nine years, and most people had never heard of Huawei,” he said.

Huawei rose by combining massive state support, global market access and aggressive pricing, not only outcompeting Western firms on scale and cost, but positioning itself inside the world’s telecom infrastructure before governments understood the security implications. Huawei was first placed on a U.S. trade blacklist in 2019, which banned U.S. firms from selling some technology to the Chinese tech giant over national security concerns. Chip restrictions on Huawei have since become even stricter.

But Warner said by the time the U.S. moved to restrict Huawei, “[we started to] lose a little.”

Much of the 5G backbone had already been shaped by Chinese technology.

During a separate interview with Javers at the CNBC CFO Council Summit, the Republican Chairman of the House committee on the Chinese Communist Party, Michigan congressman John Moolenaar, said “We’ve seen how they run the play of excess capacity, price manipulation, driving people out of business in different areas; they’re going to continue to run that play,” he said. “We want to be friendly with China, but China is not our friend. They are our foremost adversary,” he added.

The Soviet Union was a military and ideological competitor, but China, in tech domain after domain, Warner says — from telecom and 5G to AI, quantum computing and biotech — is a different kind of competitor.

Warner now sees BGI following a similar model in biotechnology. Like Huawei, BGI scaled rapidly with state support. The Washington, D.C.-based think tank Foundation of Defense of Democracies called upon lawmakers of both parties earlier this year to restrict BGI’s access to U.S. institutions.

Congress has been trying to pass various versions of the BIOSECURE Act, which would limit the ability of Chinese biotechs to operate in the U.S. Some U.S. hospitals and research institutions with ties to Chinese genomics firms are under federal pressure, according to the Associated Press, though some medical professionals within the U.S. say they risk losing key research support for core medical goals. BGI told the AP that the bill is “a false flag targeting companies under the premise of national security. We strictly follow rules and laws, and we have no access to Americans’ personal data in any of our work,” it said.

U.S. intel has moved too slowly, and disrupted key spying alliances

Warner said the U.S. intelligence apparatus has moved too slowly to recognize the biotech threat. He says that intelligence agencies focus too much on foreign governments and militaries, with less attention placed on commercial technology sectors. But in a world where technology supremacy is national security, Warner says more of our intelligence efforts need to reflect this shift.

Only in the past two to three years, he says, has the U.S. seriously expanded spying into AI, semiconductors, and biotechnology. Warner says we need a more “advanced approach” in this area, and he gave as one recent example when China’s largest chipmaker SMIC stunned U.S. officials by producing a six-nanometer chip despite sweeping U.S. export controls. The breakthrough showed that Washington had underestimated both China’s technical qualities and ability to work around restrictions. “We got caught off guard with the SMIC six-nanometer chip,” Warner said.

Warner is also worried that tracking China’s tech rise requires a type of deep cooperation with U.S. allies that the Trump administration has squandered, such as the global intelligence-sharing network called the “Five Eyes” alliance.

Those relationships are now under strain, he said, and key partners including the United Kingdom, the Netherlands, and France have gone public in saying they are reluctant to share intel with the U.S. “They feel like we may be politicizing the intel product and that is not good news for America,” Warner said.

Underlying his concerns about the technology competition with China in areas including AI and biotech is the U.S. ceding the global lead in standards setting. For decades, the U.S. shaped the rules for wireless networks, satellites, and internet infrastructure. That dominance help Americans lead global markets, Warner said, but now China is aggressively positioning itself as the international standards setter.

Warner described the U.S. role in international bodies as one of the “secret sauces” in the era of America’s dominance of the global economy and technology, allowing the U.S. to leverage innovations occurring around the globe, “even if it didn’t arise in America.”

Across technology domains, influencing standards and protocols is critical to not only maintaining a competitive edge but also establishing ethical boundaries. “Will it be us or the Chinese?” Warner said. “The Chinese come in with clearly a less humanist approach. It’s been effective in lots of domains. We see it on standards-setting bodies. China floods the zone with lots of engineers, almost buying off the votes. We’ve got to reengage for American business and government,” he said.

Technology

Biggest mistakes crypto investors make with estate planning

Published

24 hours ago

December 6, 2025

admin

Biggest mistakes crypto investors make with estate planning

Roughly 1 in 7 people are leaving unclaimed property on the table, according to the National Association of Unclaimed Property Administrators. While the recent heavy selling in bitcoin and ether is rightly getting all the short-term attention, this estate planning issue is a longer-term one that’s likely to be exacerbated as crypto adoption and ownership increase.

Many people neglect to account for cryptocurrency in their estate plans, or they don’t let their heirs know how to access their crypto holdings. With surveys in recent years from Gallup and Pew Research estimating that 14% to 17% of U.S. adults have owned cryptocurrency, losing access to those funds is a growing concern.

“Leaving property or mutual funds behind in a will is pretty cut and dried, but with more and more assets placed in cryptocurrency, a large share of inherited assets are in danger of forfeiture,” said Azriel Baer, partner in the estate planning and administration group at law firm Farrell Fritz.

This issue could be mitigated, in part, by crypto ETFs, which are gaining popularity with investors since the first batch of spot bitcoin ETFs were approved by the SEC in 2024, such as the iShares Bitcoin Trust (IBIT), followed a few months later by ethereum spot price ETFs, such as the Fidelity Ethereum Fund ETF (FETH). These ETFs allow investors access to the crypto asset class without actually owning crypto outright, helping reduce the chances of actual crypto getting lost.

Nevertheless, estate planning mistakes among crypto owners are common and can be avoided. Here are some of the biggest issues cryptocurrency owners need to tackle sooner rather than later.

Wills, if they exist, often don’t include digital assets language

Only 24% of Americans have a will that describes how they want their money and estate managed after their death, according to a survey from Caring.com. Even people who have wills in place have not updated them for many years, with nearly one in four Americans saying they haven’t touched their wills since their original was drafted, according to the survey.

This can be problematic for many reasons. An old will may no longer reflect people’s current wishes. In a crypto-specific context, anyone who hasn’t updated their estate plan in the past several years may not have language to provide legal authority for the trustee or executor to gain access to digital assets.

“It’s very common for people not to update their estate planning documents for 10, 20 years or sometimes longer. If that’s the case, you’re behind,” said Patrick D. Owens, shareholder at Buchalter and a member of the law firm’s tax, benefits and estate planning practice group.

Absent language about digital assets, your heirs might have to go to court to get the authority for the executor or administrator of the estate to gain access to the crypto assets. Most likely they’ll get access, “but it’s a hassle,” Owens said. “Obviously, it means time and money going into court.”

Even with a will, crypto assets can get stuck in court

A standard will is appropriate for many people, but many attorneys recommend clients also utilize a revocable living trust as part of their estate plan. Drafting a will is less expensive, but a revocable living trust offers more privacy and can help limit the time and expense of the probate process after death.

Baer advises clients to transfer their crypto to a revocable living trust so the trustee has immediate access upon the owner’s death. It could be six to eight months, or more, before a will is settled in probate and in the meantime, heirs wouldn’t have access to the assets. If the price of the crypto was going down rapidly, for example, they would have to wait to sell it if the estate was caught up in probate. Putting crypto assets into a revocable trust to avoid probate can prevent a lot of headaches, he said.

Generally, a revocable trust is paired with a pour-over will so that assets not included in the trust at the time of a person’s death are transferred to the trust and distributed accordingly.

Not sharing basic crypto information can cost millions

You don’t have to tell heirs you’re worth a fortune in bitcoin before you pass away, but you should make sure they know how to access your crypto after you’re gone.

Baer worked on an estate where tens of millions of dollars in crypto were lost to the heirs because they didn’t know the decedent’s private keys, which function as digital passwords to grant access to cryptocurrency funds and prove ownership of blockchain assets.

Someone should know how to access the assets, whether through written instructions in a safe box, a safe at home, or directions kept with a lawyer or with one of the various crypto inheritance services that help ensure crypto assets are passed on to your family members, Baer said. Don’t put these private keys or other sensitive information in a will, because wills become public through the probate process, he added.

Many designated fiduciaries can’t handle crypto

The person you chose to handle your other assets may not be the right person to deal with the crypto portion of your estate.

Not everyone understands crypto, the associated volatility or how to transact with digital currency, meaning lots of money can inadvertently be lost. The recent volatility in the price of bitcoin is a reminder that if you name someone who needs weeks to get up to speed on how to transact with bitcoin, the financial losses could be meaningful, Baer said. “Uncle Bob may be a great person, but he may have more challenges transacting with an asset class he’s totally not familiar with,” he added.

Sometimes, even institutional trustees might not be able to take on the responsibility for crypto. Owens had a client pass away with half a million dollars in bitcoin and ether. The institutional trustee who oversaw the client’s account refused to take on the responsibility for the crypto and a special trustee was named. Luckily, the client had a nephew who took on the role, but finding a suitable replacement can often be costly from a time and money perspective, Owens said.

Failure to plan for crypto estate taxes

With the massive explosion in the values around cryptocurrency, many people have large crypto holdings, which could be subject to significant taxes, whether that’s income taxes or estate taxes, and failure to plan could be detrimental to their families, said Jonathan Forster, shareholder at law firm Weinstock Manion.

There could, for example, be estate taxes due, depending on the size of the estate. The federal estate tax exemption for 2025 is $13.99 million per individual. Some states also have a state-level estate tax.

Knowing the impact crypto ownership might have on your estate is an important consideration while you are alive. Forster has clients whose crypto holdings are worth more than $50 million. They wanted an efficient way to make gifts for the benefit of their children to get some money out of their estate. They created a limited liability corporation, transferred the crypto into the LLC and gifted an interest in the LLC to an irrevocable trust for the benefit of minor children with an independent trustee, Forster said.

Many crypto investors fail to keep track of cost basis, which can be problematic for many reasons, including if you’re considering gifting digital assets during your lifetime. If you want to gift the assets while you’re alive, you need to have the basis so the recipient can properly account for the crypto if it’s eventually sold, Baer said. “It can be onerous to keep track of basis, but it’s important,” he said.