Beyond the Hype: The Real Stakes in AI, IPOs, and Cyber Attacks | July 21, 2025

21 Jul 2025 · 35 min

Ask about this episode

Ask anything about it. ChatGPT or Claude reads this page and answers with the times it was said.

Connect VO and ask about every podcast you hear, including the moments you saved. Add to ChatGPT · Add to Claude

In short

Podcast Notes: The Information's TITV Episode Title: Beyond the Hype: The Real Stakes in AI, IPOs, and Cyber Attacks Air Date: July 21, 2025 Host: Akash Pasricha Guests: Aaron Levie (Box CEO), Anita Ramaswamy (Financial Columnist), Aaron Holmes (Cybersecurity Reporter)

---

Episode Overview The episode discusses the implications of AI on enterprise software, the valuation of Figma's IPO, and the recent Microsoft SharePoint hack. The conversations highlight the evolving landscape of technology and cybersecurity.

Key Topics Covered

  1. AI and Enterprise Software
  2. Guest: Aaron Levie, CEO of Box
  3. Discussion on how AI is reshaping enterprise software.
  4. The role of unstructured data in AI applications.
  1. Figma's IPO Valuation
  2. Guest: Anita Ramaswamy, Financial Columnist
  3. Analysis of Figma’s anticipated IPO and revenue growth.
  4. Comparison with similar companies to assess valuation.
  1. Microsoft SharePoint Hack
  2. Guest: Aaron Holmes, Cybersecurity Reporter
  3. Overview of the recent security breach affecting Microsoft SharePoint.
  4. Implications for government agencies and businesses.

---

Detailed Notes

  1. AI and Enterprise Software
  2. Aaron Levie's Perspective:
  3. Discussed Box's innovations in managing unstructured data.
  4. Noted AI thrives on unstructured data to automate workflows and answer complex queries.
  5. Emphasized that Box acts as a steward for customer data, focusing on security and governance.
  6. Differentiated between 'deterministic' software logic (consistent outcomes) and 'non-deterministic' AI (variability in outcomes).
  • Systems of Record Debate:
  • Levie described the concept of systems of record (e.g., Salesforce, Oracle, Box) as repositories of authoritative data.
  • Discussed the strategic issues of whether AI should index data or interact directly with systems of record through agents.
  • Concerns About AI's Impact:
  • Analyses the potential for AI to disrupt traditional enterprise software models.
  • Speculated on the future role of agents in software ecosystems, where AI could directly interact with multiple data sources.

---

  1. Figma's IPO Valuation
  2. Anita Ramaswamy's Analysis:
  3. Figma launched its IPO roadshow, targeting a price range of $25-$28 per share, estimating a market cap of $15-$16 billion.
  4. Valuation methods:
  5. Adobe's Offer: Referenced Adobe’s $20 billion acquisition proposal from 2022.
  6. Comparative Analysis: Compared Figma with Datadog and Monday.com, both showing strong free cash flow and growth.
  7. Sustainability of Growth: Cautioned that while Figma's growth is impressive (46% YoY), future sustainability amidst AI competition is uncertain.
  • Investor Sentiment:
  • The current market is excited about Figma's IPO, with potential for valuation to exceed estimates upon trading.

---

  1. Microsoft SharePoint Hack
  2. Aaron Holmes' Breakdown:
  3. Described a significant vulnerability in locally-run SharePoint servers, allowing hackers to access and delete customer files, including government data.
  4. Microsoft issued a patch but warned that simple patching may not be sufficient for compromised systems.
  • Severity and Implications:
  • This breach reflects ongoing cybersecurity challenges for Microsoft.
  • Historical context of Microsoft’s cybersecurity issues, including previous attacks linked to government actors.
  • CEO Satya Nadella's pay linked to security improvements, illustrating accountability measures for cybersecurity lapses.
  • Long-term Outlook:
  • Industries and customers may reconsider reliance on Microsoft software due to repeated vulnerabilities.
  • Raises questions about whether Microsoft will face increased oversight or customers seeking alternatives.

---

Articles Discussed

  • [Figma’s IPO May Be Hot, but Its Outlook Is Murky](https://www.theinformation.com/articles/figmas-ipo-may-hot-outlook-murky)
  • [Figma Sets Tentative IPO Pricing Range](https://www.theinformation.com/briefings/figma-sets-tentative-ipo-pricing-range)
  • [Hackers Exploit Microsoft Flaw in File-Sharing Software](https://www.theinformation.com/briefings/hackers-exploit-microsoft-flaw-file-sharing-software)

---

Key Takeaways

  • The integration of AI in enterprise software poses both opportunities and threats, highlighting the need for companies to adopt robust data governance.
  • Figma’s IPO may signal a broader shift in software valuations amidst the rise of AI, but sustainability of growth remains a critical question.
  • Ongoing cybersecurity challenges faced by major corporations like Microsoft underscore the importance of vigilance and accountability in technology adoption.

---

Thank you for tuning in to this episode of The Information's TITV. For more insights and discussions, join us live every weekday at 10 am PT / 1 pm ET.

Written by AI. May contain mistakes. Listen to the episode to check what was said.

Hear the part that matters, and keep it.Open this episode in VO. Double tap your headphones to save a moment as you listen.
Get VO free

Transcript

Automatic transcript. May contain errors.

0:15Welcome everyone to the information's TI TV. My name is Akash Pasritch. It is Monday July 21st and we are going deep into the battle between AI and enterprise software today. We've got a very special conversation with Box CEO Aaron Levy coming up in just a few minutes. We are also talking about Figma's valuation. The company just launched its IPO roadshow today, and we're going to try to figure out what is this company really worth? And we're going to close out the show before we finish with a conversation with our Microsoft reporter about the latest on the Microsoft hack that has been ongoing over the weekend.

0:50Now, before we get started, I want to start by mentioning a big story that our chips reporter, Channer Liu, published on Saturday. We talked last week about how NVIDIA has gotten a green light from the Trump administration to sell its H20 chip in China. But according to Channer's reporting, NVIDIA only has so much of the H20 chip to go around. And the other thing is the company doesn't plan to start, or restart, I should say, any net new production of the chip. And so the point of all this is just because Trump gave the green light overnight, it doesn't mean NVIDIA can restart its China business overnight.

1:26The supply chain is a slow-moving machine, but we will keep you posted on what else Channer finds out. Okay, our first guest on the show today is someone who has been in enterprise software for more than two decades. Aaron Levy is the CEO of Box, the company sells content management and collaboration software. It has a market cap of roughly$4.75 billion. And last week, our founder and editor-in-chief, Jessica Lesson, sat down with him for a very special conversation. Let's take a listen. Thank you, Akash. And I'm so excited to be here with maybe AI and the enterprise's biggest cheerleader. Could we say that, Aaron?

2:09Aaron Levy, the CEO of Box. Welcome to the show, Aaron. Thanks for having me. I am a very, very big fan of AI. So, and yeah, lots happening right now. Yeah. So I want to talk about that and what you're doing at Box. And also this somewhat existential question I want to hear you out on about whether enterprise software is going to be killed by AI. But let's start with Box. You've been, so I'm sure that our viewers know, but Box is an ultimate collaboration, editing, productivity storage suite for the enterprise. It seems like you've had a lot of announcements lately as it relates to AI. Walk us through them.

2:55Yeah, so maybe the updated kind of way to think about our platform is we've been building up a system for helping companies manage their unstructured data. So their financial documents and marketing assets and invoices and movie scripts and everything they work on that they create and share and collaborate on. And when you think about what does AI thrive on, it thrives on unstructured data. This is its sort of core source of context for being able to answer questions and make better decisions and be able to kind of help automate workflows. So for our enterprise customers, they have all of this information that they've been sitting on and it's in the cloud.

3:35And now all of a sudden we have this ability to bring AI agents to this data to let them automate workflows, let them begin to ask questions of all this data that they've never been able to ask questions of before. And so we're building an AI platform that is really this connection between the content and tools and workflows in box to all of the breakthrough leading AI models. And then you can bring AI to your data as opposed to having to move your data between all of these different AI systems that you want to interact with. So I think you already brought up what seems to be the key issue at the moment, which is data.

4:10You know, the information reported a few weeks ago that there's been some kerfuffles around Slack and what Slack will let out of its system into, you know, companies who are trying to build on top of data platforms. Where do you stand in terms of the data walls? Do you want Box to be one of those walls? How do you think about it with your customers? Yeah, so the general principle is it's our customers' data and we are the stewards for helping manage it, secure it, govern it, and turn it into real business value. There are some scenarios where you have extremely expensive kind of high-cost API usage in these systems, and I think that was what Slack was partly sort of acknowledging.

4:54Now, there might be strategic dilemma reasons as well that led to that change in the terms, But, you know, these APIs do get quite expensive once you're indexing all of the data in a platform. But our view is that it's not a competitive issue as much as it's just a cost issue in the infrastructure that we have to kind of continue to work through. Fundamentally, it's our customers' data, and we are the platform for helping them manage it and get more value out of it. As a little bit of a more technical asterisk, there's an open conversation in the industry, which is, should these platforms be indexing all of the data from these data systems or systems of record?

5:32Or should the systems of record have really powerful agents that you just talk to, and then it pulls out the data that you want at the point of sort of needing that information? And a system of record is like a Salesforce, right? Or some legacy enterprise. Is that what a system of record is or whatever account software you're using or what? I'd sort of strike the word legacy, but it's... Oh, sorry. I'd be lying my views, but yeah. You're playing into their hand. Legacy need to accompany the information now, so I actually say that with... Oh, with great respect. But basically, system of record is...

6:13It could be box for your documents. It could be Salesforce for your CRM data. It could be Oracle for your ERP data. But the idea is that it's a place where it has your authoritative data for a particular topic or workflow. It's got your customer information. It's got your contracts. It's got your revenue figures. And so you have this open question in the AI industry, which is, do you want an AI system to suck all that data out and then put it in its own index? And there's benefits and value to that because... An AI system being an open AI or something a business builds themselves. Or Glean or a vector database.

6:51There's a variety of ways that this can work. And there's benefits to that because then when you ask a question of a large heterogeneous data set, you will then have a re-ranking algorithm that knows all of its data sources. So you can actually improve on the quality or have lower latency interactions. At the same time, there's just a fundamental cost in math problem, which is if every system had to be indexed by every other system on the planet, we would be replicating data by 20 or 50 times over, which is just not the best computer science way to solve the problem. So what the industry... Oh, sorry.

7:27I keep interrupting you because I have so many questions. Well, the open question is basically, instead maybe the future is we have agents that talk to each other. So Salesforce has an agent, Box has an agent, Oracle has an agent, Workday has an agent. And when you're in ChatGBT and you say, hey, I want to get a sales plan for this customer, the agent within OpenAI goes out and asks questions of all these systems and then stitches together a response. Now, again, everything's got pros and cons. There's tradeoffs for any architecture you design. But that's one plausible future that we might end up with.

8:00I hadn't thought so much about just some of the cost and structural reasons behind some of the tensions that are starting to emerge. But also, I mean, what becomes the ultimate moat around the systems of record if it's all data, if some engineer at some new startup can vibe code their way, you know, to some software that is, I mean, we just, you know, I feel like I'm surrounded by vibe coding, even though I've never done it. But like, how do you think about that? Is it that systems of record just are really optimized for one use case and can can do it really well? But won't won't this super intelligence eventually do that, too?

8:45Well, there's a couple of different kind of questions in there, right? So there's the, you know, what happens in software economics if you can have superintelligence build these apps faster and cheaper? And so that's an interesting question. Maybe we'll get to that one. There's another question, which is what's the value of a system of record in the first place in a world of AI? And there's two different components there, because on one hand, there's an open question, which is, well, in a world of agents, should, you know, basically these things just become kind of databases. And then the agent is really providing most of the logic and the business logic that the user needs.

9:20So I'll just take these in two different parts. On the one I just brought up, the reason why you probably won't see a complete compression of software where it's just an agent and a database is because there's a lot of logic in the workflow and in the company's specific sort of business process that needs to be built into that and around that database. And so as an example, within Box, if you share, you know, documents with people, you want to make sure only the right document goes to the right people. And you can't ever have a situation where the wrong salary information goes to the wrong person.

9:55And so that means that access controls and permissions and data governance really matters a lot. And so it's very hard to abstract that away and just have the agent do all the work because the agent will make a mistake 1 % of the time and it will share the wrong thing with somebody or open up an access privilege to the wrong person. And so you want there to be a separation between the parts of your software that are deterministic, where you know 100 % of the time it's going to do the exact same thing every single time from the parts of the software that are non-deterministic, where it's going to be 1 % or 2 % different every time you ask the question, every time you share the data, every time it generates a report.

10:32And so anybody who sort of thinks that the deterministic part goes away and it gets shoved into the non-deterministic part, probably doesn't really understand what the purpose of enterprise software is or what systems of record are. Our CTO, I think, came up with this line. I don't know the exact origin, but he said, AI agents can't keep a secret. And the way to then think about that is you can't pack in all of your security or all of your access controls or all of your business logic into the agent because the agent will share that with the wrong person. It'll make a mistake. And so you have to have this sort of separation of duties between your systems.

11:07So that's the first part. On the second part of this idea of super intelligence, we'll just code the ERP system or it'll code the CRM system. I think we will see a pressure in the overall sort of maybe price per seat of software over time. It's like, it's plausible that that could happen. But at the end of the day, when you're paying for Salesforce, or you're paying for Workday, or you're paying for Oracle, or you're paying for Box, To some extent, you're paying for the thousands of years of engineering time that went into building the software, but you're also paying for our - I don't know that CFOs are thinking about it that way, though.

11:40They're just trying to pay less. Yes, but what matters is the only way they can pay less is if there's an alternative proposition that is plausible that they could go with. And the reason that you choose a Workday or a Salesforce is because they have proven that in the Fortune 500, they're going to keep your HR data secure. They're going to keep your CRM data tied to all of the right workflows. They're going to have ecosystems of developers that exist around their platform. They are going to promise five nines of reliability and uptime. They're going to understand the workflows in your industry way deeper than some startup that just emerges out of nowhere.

12:24So there's decades and decades of sort of built-in trust and reliability and ecosystem support that that's what you're actually paying for. You're not just paying for that number of hours that the engineers sort of spent on the code. And so I think you could see some pricing pressure if some low-cost options enter the field. But this idea that the superintelligence sort of instantly builds all these apps and all of a sudden that kind of commoditizes software, I think also sort of misunderstands why does Ford spend$100 million on Oracle or SAP or whatever the number is, is because they don't want to have to think about ERP.

12:58They want to just pay a vendor to be like, you do ERP for me and I don't want to have to worry about it. And so the extra, you know, saving a few million dollars is sort of not the core of their proposition. And then maybe I know that I'm sort of running the clock on this, but the only other final point is that sometimes gets missed is I think the systems of record are also the natural point for a number of agent opportunities. So even though you might see a compression of software spend on the price per seat, and I still don't even know if that will actually happen, these also become the launch points for the agents that you'd want on that software.

13:32So that actually creates a TAM expansion for the SaaS industry or for these software platforms. And that will more than compensate for any price per seat dynamics that you see happening. Got two more questions for you. And that made a lot of sense. So I think getting to this TAM expansion that that just, you know, just around the corner. Right. I mean, there's a obviously a debate on the ways that I can be deflationary as well and many other things. But I'm curious what you're seeing. Like right now, we're hearing about agents every day. Open AI has has a suite of new agents out like from your customers using agents today.

14:10Are there examples? There's a lot of like cutting costs and efficiency examples. Are you starting to see the growing top line examples, too? Well, yeah, I mean, it's interesting that when I talk to customers and so I spend most of my time from a customer standpoint with CIOs. So this is the information kind of officers of a company. I would say if we took an average sort of a 10 or 15 person roundtable of CIOs, I would expect more than two thirds of them with their primary use cases will be use cases for AI where they're automating something that the company didn't do before. that the company didn't get around to actually delivering kind of headcount against.

14:57And it's actually the first time where they can now afford to do that particular type of work or do more of that work that they previously did because it's now affordable with AI. And so I think that we are all kind of collectively having to figure out our narrative on this, but as an industry and as an economy, But I would sort of posit that most use cases of AI agents right now are actually augmenting what the company does. And it's just a new form of work that they would not have been able to afford before. So in our business, you know, we've got an agent that goes and reads your documents and it pulls out data from your documents and then turns your unstructured data into structured data.

15:36Most of the customers we go to when we present that solution, it's the first time ever that then they go and structure their data. They're not replacing anybody else that was doing that work. They're just doing it for the first time. And then that's adding some productivity boost to some workflow or some business process or getting insights about their business in a way that was impossible. And so that's just pure net new. It's net new spend to them in software, but it's a net new value proposition for them where they can get more value out of their data. And even things like AI coding, which is obviously the fastest growing space, the way that we use it is just to accelerate our backlog of features.

16:10We don't really think about it as we will hire fewer engineers. We think about it as we will build more functionality for customers. And so I think that there'll be some companies that take a myopic approach to this and they say, OK, well, now we can spend 20 percent less in that area. But for the most part, I think the best practice tends to be how do you find the areas where you'll just do more? And by doing more, there's actually value to the organization by being able to deliver agents against that. Yeah, that resonates. I got to say, I'm not sure the information would have taken a huge plunge into video without AI, to be honest.

16:40So that supports your thesis. So lastly, I mean, when you think about the big foundational companies and OpenAI, Anthropic, I guess Microsoft, which is a competitor in many other areas, but they're kind of trying to get more and more into enterprise, right? And obviously it's not at the systems of record level. Maybe they'll go buy an ERP. But for just pure business use case, given the burning piles and piles of money, it seems like a lot of them are targeting the enterprises where they're going to grow their businesses. How do you think of that as competition? And how do you guard against it just given how massive they are?

17:24We mostly see it as complementary. And for two reasons. One, we use their models. And so Box AI is built on, it's an open platform that connects to most of the leading AI models. So we want them to be super successful and bring down the cost of intelligence and build better and better features. So as a supplier, we're very happy about those partnerships. And then as an integration partner, we're also very happy. So if you go to ChatGPT right now, you can select Box as a data source. So if you have an agent running inside of ChatGPT doing a bunch of work for you, it can pull in the right data from Box to answer a question or make a better decision or generate new content.

18:02And that is something that actually makes the data inside of Box more valuable to our customers. So we see this as all just more use cases for content. I think there are certainly some categories of software that might perceive it to be more competitive than not. But for our use cases, it usually just represents way more things that you can now do with your enterprise content. And by anything that makes enterprise content more valuable to our company, we generally will rise with that tide. And you don't worry that they're, I mean, some of them are starting to hire consultants to go into companies and help them figure out.

18:37I mean, when you see those headlines, what's your reaction? Like, good luck, it's hard. I think it's actually a good thing. I think that enterprises, right now, enterprises generally need a bridge between the breakthrough technology that they're seeing every single day and the use cases that they have and the change management that it takes to get those. The thing that we have to all collectively prepare for is we are going to be talking about AI for, I mean, literally decades, but at a minimum. You're going to be talking about it for decades. I will be talking about it. I hope you're talking about it.

19:07Oh, well, we will be too. So on the no matter what we'll be talking about for decades, but but over the next couple of years, it will be as as as much of this feverish pace as we've already seen. And part of the reason that we have to sort of be prepared for that is is the technology will often far exceed any company's ability to go and bring these these technologies into their organizations. And so we have years and years of change management that has to go into all these organizations to get the technology actually adopted. So I think it's totally necessary that the frontier labs have consulting.

19:44The major consulting firms will obviously be major, you know, ways of delivering this. At software companies like Boxwell, you know, we're building out our AI, you know, consulting and delivery expert arm. And so all of this is going to grow as the demand grows within the enterprise. Awesome. Well, Aaron, thanks for unpacking all of that. I actually feel like I understand the landscape a little bit more. Agents, APIs, lots to watch, and we'll be watching. So thank you, and back to you, Akash. That was Jessica Lesson with Box CEO Aaron Levy. Now, the enterprise software versus AI discussion has been very top of mind for our newsroom.

20:27And so next up, I want to bring on our financial analysis columnist, Anita Ramaswamy, who looked at that exact question in the context of another software company, Figma, which launched its roadshow today. Anita, thanks so much for being here. Let's talk valuation. So you released this really interesting column this morning about Figma's valuation. Figma, of course, they announced a targeted price range this morning between$25 and$28 a share. My math gets you a market cap of roughly$15 to$16 billion, depending on where it sits in that range. But, I mean, you argue that the company is worth around$15 billion.

21:05And so I want to ask you, how did you get to your$15 billion number? Yeah, so when I was looking at this IPO, the first thing that I think anchored in my mind and a lot of investors' minds was the$20 billion offer that Adobe actually made for Figma back in 2022. We saw this all over the news. And typically when something like that happens, investors tend to kind of fixate on that particular price. And I wanted to sort of assess, was that$20 billion too much, too little? How does it actually square up with Figma's business today? And I looked at three different valuation methods. I looked at sort of the synergies that were possible in the Adobe deal, meaning like how much overlap there was between Adobe and Figma.

21:42I looked at some different comps, which we can talk about. And I looked at how much Figma actually sold shares at in the tender offer that they did, which was after the deal fell apart. And that was around$12.5 billion valuation. So, you know, I think of all those three methods, you know, let's talk about the comps, because the comps was interesting. You picked two companies, Datadog and Monday.com. Tell us about why you picked those companies and then, again, how you got to$15 billion based on those comps? Yeah. So I guess starting with the high level, I mean, software as an industry is sort of in flux because of this trend of AI.

22:15You know, a lot of these software companies haven't built their entire stack around AI and AI is coming in as both a disruptor and also a potential opportunity. So I knew I wanted to look at other software companies that sold largely to businesses and Datadog and Monday.com are both in that space. They do have different products, but there's some overlap in the sector. And mostly I picked them because they were generating around similar free cash flow margins, and they were growing really, really fast compared to other software companies. Figma's growth in the last year was around 46 % year over year.

22:44That's extremely fast for a software company. So I wanted to make sure that I was giving Figma credit for that sort of growth. And Datadog and Monday.com were two of the ones that were closer to that range. And so what multiples are Datadog and Monday.com trading at? So Datadog has the higher multiple. It's trading a little bit over 13.5 times, So between 13 and 14 times. And if you use that multiple, you get right around 15 billion dollars in valuation. If you take data dogs multiple and put it on the Figma business. So you talked about Figma's growth. You know, we had Corey Weinberg on the show last week and he made the point.

23:21He said, you know, Figma's growth and its free cash flow multiples or free cash flow margin, I should say, it's it's it actually is better than a lot of software companies. I mean, I want to focus on the growth in particular. It's 46 % in Q1 was the growth rate. Help me understand whether or not you think that's sustainable, because that's this past Q1. I think next Q1 could look different. Look, it's really, really an impressive growth rate, and customers love the product, and it is a standout among software companies. So I want to give Figma the credit for that. But that being said, with software companies, I mean, we've seen just based on past multiples and based on some of my conversations with investors and analysts around this company, a lot of them are only expecting that growth to last for the next year or two years.

24:07Beyond that, the picture is a lot more uncertain because on one hand, you have this tension from AI and new AI tools that could be disrupting Figma. At the same time, they've also made a lot of defensive moves to sort of launch their own AI products. So it's really hard to tell how the customers are going to receive that. Ultimately, a lot of these products were launched at their annual customer conference, which happens every May. So it was only a couple of months ago that we really saw what Figma is doing in a big way in AI. And it's yet to be seen whether or not that can sustain 40 percent plus growth indefinitely, which I think will have to meet.

24:39Let's talk about, you know, the threat of AI. You mentioned AI coding assistance as your story. You know, companies like Lovable and Replit that have been growing increasingly popular. You talked about it in the story. We just heard about this existential question from Aaron Levy about whether or not AI can disrupt enterprise software. As it relates to Wall Street, how much of a concern is that for Wall Street and analysts that you talk to? I think when it comes to things like IPOs, especially in today's market, we haven't seen that many tech IPOs. We certainly haven't seen any software IPOs that feel a really regular way.

Read the full transcript

25:13You know, we've seen a little bit of these quirky companies like CoreWeave and Circle that are operating in sectors that are not traditional software per se. So there's a lot of excitement around the Figma IPO. And all that is to say that I don't think that investors are necessarily looking at this in terms of the, you know, two year, three year time horizon that I was talking about earlier. I think they're really excited to see this business come out. And I think there is a chance that, you know, once it starts trading, it actually does soar about that$15 or$15 billion valuation just because of that sentiment.

25:41Do you think it breaks 20? Yeah, I think it very well could. Well, we'll have to see. We know that there have been some big IPOs this year, so we are all anxiously waiting to see where it turns out. Thank you, Anita, for being with us. It was a very fascinating column. I want to go to our next guest. Microsoft suffered a breach over the weekend as hackers went after SharePoint, which is the company's file-sharing tool. The company said it has released an update that should mitigate against the attacks. The Washington Post reported government agencies had been among those institutions that have been affected.

26:15To break it all down, I want to bring on our Microsoft reporter, Aaron Holmes, who previously was a cybersecurity reporter, which makes him exactly the perfect person that I want to talk to about the hacks this past weekend. Aaron, thank you so much for being here. Hi, Akash. Happy to be here. So just explain to us what happened. Yeah, so, I mean, what we saw this weekend, researchers originally came out on Friday and said that there was a vulnerability in Microsoft's SharePoint that runs locally on customer servers. So this is not the version that runs in Microsoft's cloud. And specifically, this vulnerability made it possible for hackers to get into customer systems.

26:53They could access files from those customers. And, you know, in some cases, according to the Washington Post, there were instances of hackers taking files and deleting them, including files that belonged to government agencies that were supposed to be available online for their constituents to understand the government. Those files were deleted and taken offline for reasons we don't really understand. And the customers that were affected, these government agencies, no longer have access to those files. So really, we're seeing evidence of hackers getting into customer systems through this Microsoft vulnerability and starting to remove files.

27:32In some cases, they've also been able to execute code on customer systems, all of which is very concerning if you're a Microsoft customer. And since then, Microsoft has rolled out a patch that they will address most of these vulnerabilities and they're urging all customers to implement that patch as soon as possible. But if you are running SharePoint locally, it's safe to assume that you could have been exposed to this vulnerability and simply patching it is likely not going to be good enough to protect your systems. If you're a customer, you probably want to be absolutely going through and changing all of your security protocols as it relates to Microsoft software and probably doing a professional risk assessment to see whether you've been affected and how to prevent a further cash.

28:22You've covered a number of cyber attacks before throughout your career. I mean, how bad is this one compared to some of the other ones that you've covered? You know, we'll have to wait and see exactly how many customers were affected. Microsoft and the federal government have both issued warnings, but they haven't clarified how many people were actually affected by this. But we have seen third party independent researchers saying that, you know, they've seen thousands of customers being attacked through this vulnerability. And is it something we'll get clarity on like in days or weeks or months?

28:57I mean, how long will it take, do you think? It usually takes at least a couple of months for a company like Microsoft to put out its full assessment of what happened. But we do know that there are at least several dozen customers who have been actively impacted by this, according to Palo Alto Networks. And yeah, I mean, based on what we've seen so far, it doesn't look great. The fact that hackers have already gotten into customer systems and taken files, you know, basically shows that this is a really serious vulnerability that's actively being exploited. When you think about cybercrime, you know, there's obviously the hackers being good at hacking and then there's Microsoft, you know, in some cases falling short, you know, in terms of their own defenses.

29:39So, you know, how are you thinking about who's at fault here? Is this just really good hackers or is Microsoft to blame here? You know, it's a good question. I mean, part of what makes Microsoft such a target for hackers is that they are one of the biggest software companies in the world, and their software is used by almost every organization across the world. At the same time, this is another black eye for Microsoft after a series of really high-profile embarrassing hacks that have targeted their customers in recent years. And we actually saw, you know, last year in the wake of several attacks by hackers that were linked to the Chinese government, those used Microsoft vulnerabilities and the company actually had to come out and apologize.

30:22a federal probe found that Microsoft's cybersecurity practices were not up to par. And we actually saw CEO Satya Nadella ask to take a pay cut last year as a way of taking accountability for the breaches. So there definitely is a pattern of Microsoft having these really embarrassing hacks. And the question is whether it's going to be enough for there to be more government oversight or possibly action taken by customers to try to move off of these products if they feel that they're vulnerable. So Satya Nadella's comp is now directly tied to cybersecurity? Is that what I'm understanding? That's right.

30:58So after the government, you know, essentially said that Microsoft needed to step up its cybersecurity practices last year, the company's board of directors decided to make Nadella's pay and several other top executives pay directly tied to improving cybersecurity. And, you know, last year he took a cut from his paycheck of about$5 million as a way of essentially saying, you know, the company still needs to do more to fix its cybersecurity practices. So it'll be interesting to see whether, you know, he takes a similar cut this year following this breach. I want to ask you very quickly about that story that you wrote a little over a year ago now.

31:33I'll link it in the show notes. It's about the headline here, Microsoft security breaches rile U.S. government customers. The one part about the story that really stuck out to me is, you know, you spoke to consultants, and there's a line here, security consultants, I should say, consultants say agencies and other customers can't easily walk away from Microsoft because the company makes it hard to use rival security products with its apps and its low prices for bundles are hard to beat the other part that was really interesting here is you talked to the former CISO of CVS and you were talking to him about about bundling with Microsoft and one of the quotes he gave you was sometimes it can be like a drug that creates addiction and the net effect is more exposure when Microsoft becomes the target of cyber attacks.

32:19This was a little over a year ago. You know, this issue with bundling and the idea that people are scared, in some cases, to go elsewhere or, you know, they may not be able to. Has that gotten better at all in the last year? I don't think there's been any real changes over the past year, but it's definitely still a big issue for Microsoft customers. I mean, in general, pretty much every company and government agency in the world uses Windows. And for a long time, the only way to manage your login to your Windows are through Microsoft's Entra ID, which is their login software. And, you know, SharePoint is somewhat similar where the way that it's built and sold by Microsoft, it also integrates with Office, it integrates with Teams.

33:00And so, you know, if your SharePoint environment is reached through this most recent hack, you have reason to believe that your Office and Teams and, you know, Azure environments in general could also be impacted if you're using the same, you know, login software that Microsoft sells. And so I think, you know, on the flip side, Microsoft will say that, you know, it's not really their fault that customers love their Office and Windows software and use it around the world and that that makes them a target for hackers. But we have seen a growing chorus, especially from Microsoft's competitors and from third-party software companies who say that, The fact that customers are kind of steered into buying all of this software at once does open them up to a wider range of vulnerabilities when there's hacks like this into one of Microsoft's products.

33:48Well, that's the pretty significant downside of bundling, which I guess I didn't really appreciate. Thank you very much, Aaron, for coming on and explaining to us when that report is released or when more findings come out a couple months from now. We'll have you back on to sort of debrief some of this. That is Aaron Holmes, our Microsoft reporter. That is it for today's episode of TITV. We want to thank you all for joining us. Again, we are live every day at 1 p.m. Eastern Time, 10 a.m. Pacific, I should say. I want to thank Amazon Web Services, who was our presenting sponsor for this production.

34:22We will see you back here tomorrow. Thanks so much for watching.

34:36Thank you.

From the publisher

Today’s episode features Box CEO Aaron Levie, who discusses how AI is transforming enterprise software and whether it's a threat or an opportunity. We also analyze Figma's highly anticipated IPO valuation with our financial columnist Anita Ramaswamy, discussing its impressive growth and the impact of AI. Finally, cybersecurity and enterprise tech reporter Aaron Holmes unpacks the recent Microsoft SharePoint hack, its implications for government and businesses, and the ongoing cybersecurity challenges for Microsoft, including how CEO Satya Nadella's pay is now linked to security improvements.

Articles discussed on this episode: 

More from The Information's TITV

All 304 episodes
Beyond the Hype: The Real Stakes in AI, IPOs, and Cyber AttacksThe Information's TITV · 35 min
Listen in VO