Microsoft Security Now $20 Billion Business with ‘Tremendous Momentum’

Microsoft Security has now surpassed $20 billion in annual revenue, making the business what one analyst calls a “serious contender” in various parts of the cyber market.

Microsoft’s Satya Nadella

Satya Nadella, Microsoft’s CEO, highlighted the milestone during this week’s third-quarter fiscal year 2023 earnings call. Revenue from Microsoft Security totaled $10 billion in 2021 and $15 billion in 2022.

“We are the only company with integrated, end-to-end tools spanning identity, security, compliance, device management and privacy, informed and trained on over 65 trillion signals each day,” Nadella said. “We are taking share across all the major categories we serve.”

Microsoft Has ‘Unparalleled’ View of Threat Landscape

Microsoft’s Vasu Jakkal

Vasu Jakkal is Microsoft‘s corporate vice president of security. She said Microsoft has an “unparalleled” view of the evolving threat landscape.

“With industry-leading artificial intelligence (AI), we synthesize 65 trillion signals a day — across all types of devices, apps, platforms and endpoints — a nearly eight times increase from the 8 trillion daily signals captured just two years ago,” she said. “And we apply the learnings from that signal intelligence, as well as from our world-class threat intelligence, into all the products and services we offer. Furthermore, we now have more than 15,000 partners working with us across our security ecosystem helping to bring better solutions and more choices to market.”

More than 860,000 customers have chosen Microsoft Security to protect their organizations, Jakkal said.

Few Obstacles to Even More Growth

Omdia’s Eric Parizo

Eric Parizo is managing principal analyst at Omdia, which shares a parent company with Channel Futures (Informa). He said the numbers highlight Microsoft’s “tremendous momentum” in cybersecurity. And there are few legitimate obstacles in its path to even more growth.

“The company has come a long way in the past few years,” he said. “As recently as three years ago, it could not broadly match key competitors on features. Today, it has highly competitive enterprise cybersecurity solutions in a number of market segments, led by its endpoint, identity, and next-generation security information and event management (NG-SIEM) solutions. In fact, I would go so far to say that in endpoint security, Microsoft’s very successful long-term push to become the leader in that segment was a significant driver in the fracturing of the traditional endpoint protection market, which led to the subsequent acquisition of once-dominant endpoint players such as Symantec, McAfee and Cylance. Today, endpoint security has become as much about detection and response as protection.”

Bundled Sales Packages Microsoft’s ‘Secret Sauce’

While Microsoft products themselves have evolved to the point where they are highly competitive on capabilities, the “secret sauce” in its growth strategy has been its bundled sales packages, Parizo said.

Not only does its popular, full-featured E5 software package include cybersecurity, such as Azure AD security and various flavors of Microsoft Defender, but its mid-tier E3 license now has a cybersecurity add-on, he said. That has helped bolster cybersecurity revenue among buyers who don’t need the full E5 licenses, but still see cost savings by acquiring key security capabilities at what is often a significant discount off standalone pricing.

“Microsoft’s success has changed the competitive landscape in cybersecurity,” Parizo said. “Because Microsoft’s bundling strategy has been so successful, in the market segments in which Microsoft competes, pure-play rivals now must have go-to-market (GTM) messaging that incorporates why their solutions are superior to the default Microsoft solutions.”

Serious Contender In Endpoint, Email, Cloud Security

Omdia’s Rik Turner

Rik Turner is principal analyst at Omdia. He said there’s no question Microsoft is now a serious contender in various parts of the cyber market, most notably in endpoint, email and cloud security.

“You could make an argument that it goes even further, given the huge presence of AD and Azure AD in the identity space (which we also classify as part of cybersecurity),” he said. “And indeed, now that it owns GitHub, app security for the developer pipeline is also within its purview.”

In endpoint security/extended detection and response (XDR), Microsoft’s competitors include CrowdStrike, SentinelOne and all the others who started from endpoint detection and response (EDR) and are expanding out into XDR, Turner said.

“In email security, the obvious ones are Proofpoint and Mimecast, both taken private in part because Microsoft was the elephant in the room that ate their profitability, if not their revenue, but also just about anyone who sells secure email gateway (SEG) technology,” he said. “Less so the API-based ‘next-gen’ email security vendors, who can still claim to complement Microsoft’s own email security capabilities, at least for the time being, until Microsoft decides to up its game and take them out, too, though they’re all fairly small so maybe it won’t bother.”

In cloud security, there’s a bevy of contenders, from Palo Alto Networks and Check Point Software Technologies, to Orca Security, Wiz, Aqua Security and many more, Turner said.