A good analogy to the Microsoft paradox is the Pfizer/Moderna vaccines against Covid-19: these companies have distributed a vaccine that we can safely qualify a

A good analogy to the Microsoft paradox is the Pfizer/Moderna vaccines against Covid-19: these companies have distributed a vaccine that we can safely qualify as well vulnerable to time (effect wears off after a low number of months). People who took this vaccine were passively encouraged to believe they are safe to engage in risky behaviors and to ignore all safety rules. The consequence of this is two-fold: a significant number of vaccinated people will probably die soon because their vaccine just doesn't work anymore, and a much more significant number of people will become aware of this and seek to get a third dose in order to boost their immunity. We could argue that Pfizer and Moderna are doing this intentionally and thus contributing to being both the problem and the cure, simply because they did not work enough to release a more robust vaccine. To be honest, I felt the same thing after reading the article than after reading your comment: two extreme opinions that either treat Microsoft as the bad guy, or as the victim. I think what we are observing is much more complex than it seems, and it may be heavily influenced by three aspects: the size of Microsoft, its silo culture, and its low/limited level of security expertise. First, Microsoft is big. And by big, I mean, it is big enough to do business on both aspects of a same concern, namely, to write software used globally/worldwide and to produce products and services to make the cyber-work more secure. Microsoft can do that without ever questioning the relationship or logic between these two businesses, as long as it can deliver both markets satisfyingly. Second, Microsoft operates in a silo culture (like all similar companies, this is not a "Microsoft" thing). Even if one department "knows" something about cyberthreats and how to mitigate them, chances are that the other department will either not be informed, or not be willing to invest time to collaborate with people working in "the other building". Their respective top-level managers are probably incentivized to sell rather than to collaborate, too. We would be well inclined to criticize Microsoft for this, assuming the same gangrene is affecting both large companies and public institutions everywhere. Third, Microsoft is not that good at cybersecurity as many may think. One reason that could explain why so many see Microsoft as the elite in cybersecurity is because most people working in the field are mediocre at their job. Another point is that cybersecurity introduces a very broad spectrum of problems and capabilities/skills. Microsoft is good at incident detection/response, governance, threat intelligence and vulnerability management. These concerns are very appealing to senior executives, especially those who don't understand a thing about technology and those who would always prioritize paying for a good fire department rather than learning how to build, maintain or operate robust IT systems. On the other side of the spectrum is writing secure code: Microsoft is not good at it. I would never say that Microsoft is doing a worse job than others, they are just simply mediocre, like the largest part of the software industry worldwide. We may think they are good at writing secure code, but they are simply not. Some Microsoft's engineers produced pillar research work in the field of designing and writing secure systems (e.g., threat modelling, security development lifecycle, compiler optimization/hardening, etc.) between 2000 and 2010 but the company hasn't much evolved since. It is fully stagnating, whereas its pace of innovation and its production of "new code" is accelerating. This brings me to my conclusion: saying that Microsoft is selling the cure to insecure systems is wrong, in my opinion. I think they are just selling a symptomatic treatment for a globally broken enterprise management model that tends to reward whoever acquires insecure software much more than anyone who dares trying to vet software suppliers for assurance/guarantees of delivering robust code. You want a cure for broken code? This will never be resolved by some well-thought Azure service or AI-powered email filtering gateway. The reason why many believe Microsoft is selling a cure to bad software is simply what I wrote earlier: mediocre journalism, mediocre policy writers and mediocre senate committees who fail to understand that cybersecurity is much more than operating an efficient fire department.