The Security Business Nobody AnnouncedWide moat

The most successful business Microsoft built this decade is one it barely markets as a business. Its security products generated roughly $37 billion in fiscal 2025 — larger than CrowdStrike, Palo Alto Networks and Zscaler combined¹ — which makes Microsoft, quietly, the largest cybersecurity company in the world.

It was assembled almost entirely through bundling. Identity sits in Entra, endpoint protection in Defender, monitoring in Sentinel, and all of them arrive inside enterprise agreements customers already sign for Office and Azure. For a company paying for the top Microsoft 365 tier, adding Microsoft's security tools costs little or nothing incremental — which is a pricing structure no independent vendor can answer, because they have no bundle to hide the cost in.

The vulnerability is reputational and regulatory rather than competitive. Microsoft is simultaneously the largest supplier of the software being attacked and the largest supplier of the protection against those attacks, and serious breaches of its own systems have drawn government criticism that a pure-play vendor would never face. Bundling security is also precisely the behaviour antitrust regulators examined in the Teams case. Watch for security being unbundled under regulatory pressure, and watch whether the specialists keep winning the largest, most security-conscious enterprises — which is where good-enough-and-included stops being the winning argument.