Investigation: the US Cyber Safety Review Board didn't investigate, for unclear reasons, the weaknesses in Microsoft tools that the SolarWinds hack exploited
Zero Trust: Inside Microsoft's Cybersecurity Failures — Investigating how the world's largest software provider handles the security of its own ubiquitous products.
Context & Ripple Effects
The board had reportedly planned to examine cloud-computing risks after Microsoft's government-email breach, yet this investigation identifies a gap around the Microsoft-tool weaknesses tied to SolarWinds. That gap matters because the review body's remit is central to converting major incidents into public accountability and remediation lessons.
The finding sits alongside the board's later criticism of Microsoft for a cascade of avoidable errors in a separate government-email compromise. Together, the coverage raises questions about whether reviews of a widely deployed supplier are consistently reaching the underlying product-security failures.
First-order effects
- The Cyber Safety Review Board faces scrutiny over why a consequential set of Microsoft weaknesses was outside its SolarWinds review, leaving that omission unexplained in the reported record.
- Microsoft's handling of security in products used across government and enterprise becomes a more direct focus, beyond the immediate SolarWinds supply-chain incident.
Second-order effects
- Government customers and security teams have less reason to treat a completed incident review as a comprehensive account of the Microsoft-related exposure; they may need to distinguish the review's scope from the risks they assess themselves.
- The reported omission sharpens pressure for future cloud and software-provider reviews to define what product vulnerabilities and vendor decisions are in scope, especially after the board's planned inquiry into cloud-computing risks.
Third-order effects
- If major incident reviews repeatedly exclude vulnerabilities in foundational vendors' tools, public postmortems may be less effective at driving ecosystem-wide remediation rather than incident-specific fixes.
- The broader direction is toward treating security assurance for ubiquitous platforms as a shared governance problem among vendors, customers, and oversight bodies—not solely a matter of breach disclosure.
The trend: This is one data point in the push to make oversight of dominant software and cloud platforms match the systemic reach of their security failures.