> The fact is that Microsoft has continuously improved its process for the past fifteen years while being the most exposed company in IT. It's not just that th

> The fact is that Microsoft has continuously improved its process for the past fifteen years while being the most exposed company in IT. It's not just that they have continuously improved process, they have also made enormous contributions to the security space in terms of building and sharing repeatable processes, and providing a platform to socialize some of those practices (for example, bug bounty programs, threat modelling, SDL practices, tons of documentation and guidance around how to improve processes). I am not a Microsoft shill - my main use for Windows and Microsoft products are video games, and Microsoft Office, but they have made tremendous progress and shared several tools and learnings along the way.