---
id: video/IIdtxatSw7A
type: video
title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
summary: "Business Central Under the Hood episode 10 with Jonathan Davis, a security program manager on the BIC security team, about current cyber threats. Topics include secure by default, cloud threat intelligence sharing, the security development lifecycle and code scanning, secure admin workstations, Purview audit logs, the Dynamics 365 bounty program and red team exercises. It ends with guidance for partners: phishing-resistant MFA (not SMS), threat modeling, SDL, CISO workshops and the basics of SMB security."
tier: official
language: en
tags:
  - security
  - cyber threats
  - ransomware
  - password management
  - secure by default
  - cloud security
  - credential stuffing
  - threat intelligence
  - small business vulnerability
  - threat intelligence sharing
  - security development lifecycle
  - code scanning
system: administration
review:
  state: reviewed
  by: opus
  at: "2026-10-07T22:55:47.261Z"
  flags: []
generated:
  at: "2026-10-07T22:55:47.322Z"
  pipeline: 0.2.0
  prompts:
    extract-video: 1
    summarize-video: 2
  input_hash: 804d127a83869df991c38d944802750fbeae98a546e834ac8b1b972fd0b914c9
evidence:
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=1209s
    title: "Auditing and Security Logs to Purview: generally available"
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 1209
    quote: we ship an awful lot of auditing and security logs to purview so that customers can can see can also make their own alerts
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=92s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 92
    quote: I think we should be concerned. Uh, I think the hackers kind of are at the gates a little bit.
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=149s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 149
    quote: a a very special responsibility because we hold the keys of the kingdoms for so many businesses
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=252s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 252
    quote: right now we in Microsoft are experienced sometimes billions, if not trillions of attempts of people that are taking these rainbow tables
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=581s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 581
    quote: those businesses are probably the most vulnerable. They're in the perfect sweet spot for ransomware attackers.
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=657s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 657
    quote: secure by default you know we've often you know since the 70s we've had all these security principles like
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=713s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 713
    quote: it's secure by default when you switch it on it's secure and you have to read the documents and to really strive to screw
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=825s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 825
    quote: we can cascade that to all of our customers immediately
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=836s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 836
    quote: a single customer is attacked or even compromised and then we can plug that into our systems to defend everybody else.
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=892s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 892
    quote: secure by default watched by network operations centers staffed by the best in the world using
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=1048s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 1048
    quote: all of these AI features need to go through the professional security teams like my own it was very hard work for us we
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=1264s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 1264
    quote: we essentially pay people to to report security bugs to us vulnerabilities
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=1315s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 1315
    quote: a zero day just means uh a vulnerability that is that the bad that the that the sort of attackers know about before the
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=1384s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 1384
    quote: most successful breaches have nothing to do with zero days
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=1514s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 1514
    quote: do not use SMS as a as a multiffactor thing because uh it's it's compromised
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=1599s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 1599
    quote: the I think that most people would be quite shocked and terrified to realize how many close calls every business has
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=1613s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 1613
    quote: a few months ago we started reporting all of our cloud bugs
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=1768s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 1768
    quote: In 2019 we we got the what was then the Azure uh red team
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=1965s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 1965
    quote: I think the simplest thing would be for them to to follow the security development life cycle that is a very mature, very complete
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=2065s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 2065
    quote: threat modeling is deceptively simple I mean we made a 5minute video for engineering resources here within Microsoft it really just involves this you
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=2141s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 2141
    quote: good security people are not security absolutists. Remember that they're part of a business that has to ship value to customers
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=2212s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 2212
    quote: Definitely not SMS. Uh you know, we we actually use so-called fishing resistant MFA
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=2282s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 2282
    quote: if you get a call from somebody saying they're from Microsoft and there's some security issue on your computer this is not us. this
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=2385s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 2385
    quote: cyber security as a discipline is extremely broad. It's not just a narrow technical thing. A lot of it's psychology.
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=2457s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 2457
    quote: it's hard for me to remember the 300 or so controls that are
  - kind: video
    url: https://www.youtube.com/watch?v=IIdtxatSw7A&t=2876s
    title: "Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security."
    date: "2025-08-27T14:00:23.000Z"
    commit: null
    t: 2876
    quote: The basics are the basics and the basics are basic get you an awful long way
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
video_id: IIdtxatSw7A
channel: yt-microsoft
source_name: Microsoft Dynamics 365 Business Central (YouTube)
url: https://www.youtube.com/watch?v=IIdtxatSw7A
published_at: "2025-08-27T14:00:23.000Z"
duration_s: 2911
captions: full
audience:
  - administrator
  - developer
  - decision maker
  - partner
chapters:
  - t: 0
    title: Introduction and Security Landscape
  - t: 80
    title: The Real State of Cyber Threats
  - t: 207
    title: Password Management and Attack Methods
  - t: 324
    title: Unreported Incidents and Ransomware Reality
  - t: 421
    title: Small Business Vulnerability and False Security
  - t: 561
    title: Secure by Default Philosophy
  - t: 732
    title: Cloud Security Benefits and Threat Intelligence Sharing
  - t: 909
    title: Cloud Security vs. On-Premises Risks
  - t: 1030
    title: Security Development Lifecycle and Code Review Practices
  - t: 1169
    title: Secure Admin Workstations, Auditing, and Bounty Program
  - t: 1384
    title: Real-World Attack Vectors, Social Engineering, and Disclosure
  - t: 1665
    title: Red Team Testing, Bug Bounty Program, and Security Development Guidance
  - t: 2045
    title: Threat Modeling, CISO Workshops, and Identity Management
  - t: 2261
    title: Phishing, AI in Security, Incident Response, and Recommendations
features:
  - name: Secure by Default Initiative
    status: unclear
    t: 657
    verified: false
    status_source: video
  - name: Threat Intelligence Sharing Network
    status: unclear
    t: 795
    verified: false
    status_source: video
  - name: Security Development Lifecycle
    status: unclear
    t: 1009
    verified: false
    status_source: video
  - name: Static Code Analysis and Scanning
    status: unclear
    t: 1066
    verified: false
    status_source: video
  - name: Secure Admin Workstation (SAW)
    status: unclear
    t: 1082
    verified: false
    status_source: video
  - name: Auditing and Security Logs to Purview
    status: ga
    t: 1194
    verified: true
    status_source: video
  - name: Dynamics 365 Bounty Program
    status: unclear
    t: 1241
    verified: false
    status_source: video
  - name: Cloud Bugs Transparency Reporting
    status: unclear
    t: 1613
    verified: false
    status_source: video
  - name: Business Central red team exercise
    status: unclear
    t: 1754
    verified: false
    status_source: video
  - name: Security development lifecycle guidance
    status: unclear
    t: 1945
    verified: false
    status_source: video
  - name: CISO workshops
    status: unclear
    t: 1981
    verified: false
    status_source: video
  - name: Component governance tooling
    status: unclear
    t: 2018
    verified: false
    status_source: video
  - name: Threat modeling methodology
    status: unclear
    t: 2045
    verified: false
    status_source: video
  - name: Fishing resistant multifactor authentication
    status: unclear
    t: 2197
    verified: false
    status_source: video
  - name: Copilot threat modeler
    status: unclear
    t: 2446
    verified: false
    status_source: video
  - name: AI for attack detection and log analysis
    status: unclear
    t: 2504
    verified: false
    status_source: video
  - name: Dynamics 365 and Power Platform security heat mapping
    status: unclear
    t: 2593
    verified: false
    status_source: video
  - name: AI-assisted incident response
    status: unclear
    t: 2674
    verified: false
    status_source: video
objects_mentioned:
  - other Cosmos database
quotes:
  - t: 92
    text: I think we should be concerned. Uh, I think the hackers kind of are at the gates a little bit.
    check: exact
  - t: 149
    text: a a very special responsibility because we hold the keys of the kingdoms for so many businesses
    check: fuzzy
  - t: 252
    text: right now we in Microsoft are experienced sometimes billions, if not trillions of attempts of people that are taking these rainbow tables
    check: exact
  - t: 581
    text: those businesses are probably the most vulnerable. They're in the perfect sweet spot for ransomware attackers.
    check: exact
  - t: 657
    text: secure by default you know we've often you know since the 70s we've had all these security principles like
    check: fuzzy
  - t: 713
    text: it's secure by default when you switch it on it's secure and you have to read the documents and to really strive to screw
    check: exact
  - t: 825
    text: we can cascade that to all of our customers immediately
    check: exact
  - t: 836
    text: a single customer is attacked or even compromised and then we can plug that into our systems to defend everybody else.
    check: exact
  - t: 892
    text: secure by default watched by network operations centers staffed by the best in the world using
    check: fuzzy
  - t: 1048
    text: all of these AI features need to go through the professional security teams like my own it was very hard work for us we
    check: exact
  - t: 1264
    text: we essentially pay people to to report security bugs to us vulnerabilities
    check: exact
  - t: 1315
    text: a zero day just means uh a vulnerability that is that the bad that the that the sort of attackers know about before the
    check: exact
  - t: 1384
    text: most successful breaches have nothing to do with zero days
    check: exact
  - t: 1514
    text: do not use SMS as a as a multiffactor thing because uh it's it's compromised
    check: exact
  - t: 1599
    text: the I think that most people would be quite shocked and terrified to realize how many close calls every business has
    check: exact
  - t: 1613
    text: a few months ago we started reporting all of our cloud bugs
    check: exact
  - t: 1768
    text: In 2019 we we got the what was then the Azure uh red team
    check: exact
  - t: 1965
    text: I think the simplest thing would be for them to to follow the security development life cycle that is a very mature, very complete
    check: exact
  - t: 2065
    text: threat modeling is deceptively simple I mean we made a 5minute video for engineering resources here within Microsoft it really just involves this you
    check: snapped
  - t: 2141
    text: good security people are not security absolutists. Remember that they're part of a business that has to ship value to customers
    check: exact
  - t: 2212
    text: Definitely not SMS. Uh you know, we we actually use so-called fishing resistant MFA
    check: exact
  - t: 2282
    text: if you get a call from somebody saying they're from Microsoft and there's some security issue on your computer this is not us. this
    check: snapped
  - t: 2385
    text: cyber security as a discipline is extremely broad. It's not just a narrow technical thing. A lot of it's psychology.
    check: exact
  - t: 2457
    text: it's hard for me to remember the 300 or so controls that are
    check: fuzzy
  - t: 2876
    text: The basics are the basics and the basics are basic get you an awful long way
    check: exact
---

# Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security.

> Business Central Under the Hood episode 10 with Jonathan Davis, a security program manager on the BIC security team, about current cyber threats. Topics include secure by default, cloud threat intelligence sharing, the security development lifecycle and code scanning, secure admin workstations, Purview audit logs, the Dynamics 365 bounty program and red team exercises. It ends with guidance for partners: phishing-resistant MFA (not SMS), threat modeling, SDL, CISO workshops and the basics of SMB security.

[Watch on YouTube](https://www.youtube.com/watch?v=IIdtxatSw7A) · Microsoft Dynamics 365 Business Central (YouTube) · 2025-08-27 · 48:31 · tier official · reviewed (checked by Opus)

## Overview

The episode covers the current threat landscape, including credential stuffing, ransomware and the exposure of small businesses, and how Microsoft secures Business Central. Topics include the secure by default approach, threat intelligence that is cascaded across cloud customers, and code review through the security development lifecycle with static analysis and code scanning.

It also describes secure admin workstations, auditing and security logs sent to Microsoft Purview, the Dynamics 365 bounty program, and a 2019 red team exercise. The closing sections cover threat modeling, CISO workshops, fishing resistant MFA, phishing and social engineering, AI in security and incident response, and recommendations for partners and customers.

## Key points

- Business Central ships auditing and security logs to Microsoft Purview, so customers can build their own alerts and detect anomalies. This is part of a joint responsibility model.
- Cloud customers benefit from threat intelligence sharing: when an attack is detected on one customer, such as malicious IP addresses, it can be cascaded to all customers immediately.
- All Business Central code goes through professional security team review, including threat modeling, risk assessment and mitigation tracking, plus static analysis and code scanning before release.
- Production access uses secure admin workstations that are separate from corporate systems and need a physical security dongle, a second factor and a specialist VPN.
- Do not use SMS as multifactor authentication. Microsoft uses fishing resistant MFA such as passkeys.
- Partners and developers are pointed to the security development lifecycle guidance, a threat modeling video, and CISO workshop videos with decks.
- Microsoft pays researchers through the Dynamics 365 bounty program to report vulnerabilities responsibly, and now reports cloud bugs even without a CVE.

## Chapters

- [0:00](https://www.youtube.com/watch?v=IIdtxatSw7A&t=0s) Introduction and Security Landscape
- [1:20](https://www.youtube.com/watch?v=IIdtxatSw7A&t=80s) The Real State of Cyber Threats
- [3:27](https://www.youtube.com/watch?v=IIdtxatSw7A&t=207s) Password Management and Attack Methods
- [5:24](https://www.youtube.com/watch?v=IIdtxatSw7A&t=324s) Unreported Incidents and Ransomware Reality
- [7:01](https://www.youtube.com/watch?v=IIdtxatSw7A&t=421s) Small Business Vulnerability and False Security
- [9:21](https://www.youtube.com/watch?v=IIdtxatSw7A&t=561s) Secure by Default Philosophy
- [12:12](https://www.youtube.com/watch?v=IIdtxatSw7A&t=732s) Cloud Security Benefits and Threat Intelligence Sharing
- [15:09](https://www.youtube.com/watch?v=IIdtxatSw7A&t=909s) Cloud Security vs. On-Premises Risks
- [17:10](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1030s) Security Development Lifecycle and Code Review Practices
- [19:29](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1169s) Secure Admin Workstations, Auditing, and Bounty Program
- [23:04](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1384s) Real-World Attack Vectors, Social Engineering, and Disclosure
- [27:45](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1665s) Red Team Testing, Bug Bounty Program, and Security Development Guidance
- [34:05](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2045s) Threat Modeling, CISO Workshops, and Identity Management
- [37:41](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2261s) Phishing, AI in Security, Incident Response, and Recommendations

## Features

| Feature | Status | At | Evidence |
|---|---|---|---|
| Secure by Default Initiative | status not stated | [10:57](https://www.youtube.com/watch?v=IIdtxatSw7A&t=657s) |  |
| Threat Intelligence Sharing Network | status not stated | [13:15](https://www.youtube.com/watch?v=IIdtxatSw7A&t=795s) |  |
| Security Development Lifecycle | status not stated | [16:49](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1009s) |  |
| Static Code Analysis and Scanning | status not stated | [17:46](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1066s) |  |
| Secure Admin Workstation (SAW) | status not stated | [18:02](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1082s) |  |
| Auditing and Security Logs to Purview | generally available | [19:54](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1194s) | "we ship an awful lot of auditing and security logs to purview so that customers can can see can also make their own alerts" ([20:09](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1209s)) |
| Dynamics 365 Bounty Program | status not stated | [20:41](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1241s) |  |
| Cloud Bugs Transparency Reporting | status not stated | [26:53](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1613s) |  |
| Business Central red team exercise | status not stated | [29:14](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1754s) |  |
| Security development lifecycle guidance | status not stated | [32:25](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1945s) |  |
| CISO workshops | status not stated | [33:01](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1981s) |  |
| Component governance tooling | status not stated | [33:38](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2018s) |  |
| Threat modeling methodology | status not stated | [34:05](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2045s) |  |
| Fishing resistant multifactor authentication | status not stated | [36:37](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2197s) |  |
| Copilot threat modeler | status not stated | [40:46](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2446s) |  |
| AI for attack detection and log analysis | status not stated | [41:44](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2504s) |  |
| Dynamics 365 and Power Platform security heat mapping | status not stated | [43:13](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2593s) |  |
| AI-assisted incident response | status not stated | [44:34](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2674s) |  |

## AL objects mentioned

As heard in the captions. A name that matches one object page by exact type and name links to it; the others stay as named.

- other "Cosmos database" at [41:13](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2473s)

## Quotes

- [1:32](https://www.youtube.com/watch?v=IIdtxatSw7A&t=92s) "I think we should be concerned. Uh, I think the hackers kind of are at the gates a little bit."
- [2:29](https://www.youtube.com/watch?v=IIdtxatSw7A&t=149s) "a a very special responsibility because we hold the keys of the kingdoms for so many businesses"
- [4:12](https://www.youtube.com/watch?v=IIdtxatSw7A&t=252s) "right now we in Microsoft are experienced sometimes billions, if not trillions of attempts of people that are taking these rainbow tables"
- [9:41](https://www.youtube.com/watch?v=IIdtxatSw7A&t=581s) "those businesses are probably the most vulnerable. They're in the perfect sweet spot for ransomware attackers."
- [10:57](https://www.youtube.com/watch?v=IIdtxatSw7A&t=657s) "secure by default you know we've often you know since the 70s we've had all these security principles like"
- [11:53](https://www.youtube.com/watch?v=IIdtxatSw7A&t=713s) "it's secure by default when you switch it on it's secure and you have to read the documents and to really strive to screw"
- [13:45](https://www.youtube.com/watch?v=IIdtxatSw7A&t=825s) "we can cascade that to all of our customers immediately"
- [13:56](https://www.youtube.com/watch?v=IIdtxatSw7A&t=836s) "a single customer is attacked or even compromised and then we can plug that into our systems to defend everybody else."
- [14:52](https://www.youtube.com/watch?v=IIdtxatSw7A&t=892s) "secure by default watched by network operations centers staffed by the best in the world using"
- [17:28](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1048s) "all of these AI features need to go through the professional security teams like my own it was very hard work for us we"
- [21:04](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1264s) "we essentially pay people to to report security bugs to us vulnerabilities"
- [21:55](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1315s) "a zero day just means uh a vulnerability that is that the bad that the that the sort of attackers know about before the"
- [23:04](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1384s) "most successful breaches have nothing to do with zero days"
- [25:14](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1514s) "do not use SMS as a as a multiffactor thing because uh it's it's compromised"
- [26:39](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1599s) "the I think that most people would be quite shocked and terrified to realize how many close calls every business has"
- [26:53](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1613s) "a few months ago we started reporting all of our cloud bugs"
- [29:28](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1768s) "In 2019 we we got the what was then the Azure uh red team"
- [32:45](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1965s) "I think the simplest thing would be for them to to follow the security development life cycle that is a very mature, very complete"
- [34:25](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2065s) "threat modeling is deceptively simple I mean we made a 5minute video for engineering resources here within Microsoft it really just involves this you"
- [35:41](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2141s) "good security people are not security absolutists. Remember that they're part of a business that has to ship value to customers"
- [36:52](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2212s) "Definitely not SMS. Uh you know, we we actually use so-called fishing resistant MFA"
- [38:02](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2282s) "if you get a call from somebody saying they're from Microsoft and there's some security issue on your computer this is not us. this"
- [39:45](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2385s) "cyber security as a discipline is extremely broad. It's not just a narrow technical thing. A lot of it's psychology."
- [40:57](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2457s) "it's hard for me to remember the 300 or so controls that are"
- [47:56](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2876s) "The basics are the basics and the basics are basic get you an awful long way"

## Disclaimers in the video

- [17:10](https://www.youtube.com/watch?v=IIdtxatSw7A&t=1030s) subject-to-change: we maintained that even in the age of AI where there's enormous pressure to push out AI features
- [40:46](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2446s) preview: I've now got a a co-pilot threat modeler with me that's watching the transcript
- [43:57](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2637s) other: MCP servers are all the rage and this is a new thing and everyone's rushing into an area to ship it and we need to give centralized guidance
- [46:22](https://www.youtube.com/watch?v=IIdtxatSw7A&t=2782s) other: attackers have not really found a good use for AI yet but they're trying to figure out how to weaponize these techniques

Presenters (as heard): Jonathan Davis, Vincent, Craig Nelson, Jonathan.