August – September 2013 — Redmond, Washington / Ann Arbor, Michigan
The Microsoft campus is nothing like Google's.
Where Google has a cultivated casualness — the bikes, the outdoor tables, the general impression of a company pretending to be a college — Microsoft has the gravity of an institution that has been enormous for long enough to have developed its own geological weight. The buildings are larger, more formal. The conference rooms have better chairs. The people move with the specific purposefulness of employees who have been here through multiple corporate paradigms and learned to take the long view.
Ethan meets with a team of eleven for the initial findings presentation. Nathan Byers sits to his right. The Chief Security Officer, a woman named Dr. Priya Mehta, sits at the head of the table with a yellow legal pad and a mechanical pencil and takes notes in a handwriting so small Ethan can't read it from across the table.
The Microsoft scan ran for eighteen days. The final report is 2,100 pages.
1,847 vulnerabilities total.
71 critical.
The critical findings include, most significantly, a set of vulnerabilities in Microsoft's Azure cloud infrastructure that relate to how the platform handles cross-tenant isolation under specific high-load conditions. In plain language: under the right circumstances, a sufficiently sophisticated actor could potentially access data in one Azure tenant from another. The theoretical attack surface is enormous — Azure in 2013 is not yet the dominant cloud platform it will become, but it is growing rapidly, and the enterprises already running workloads on it include banks, hospitals, government contractors.
Dr. Mehta stops writing at this finding.
She puts her pencil down.
She looks at Nathan Byers, and the look that passes between them is the specific look of two people who have just been told that the wall they trusted is not as solid as they thought.
"How long has this been present?" she asks. Not to Ethan. To Nathan.
"We're still tracing the code history," Nathan says. "Preliminary estimate — eighteen months, minimum."
A silence.
"Who else knows about this?" she asks Ethan.
"No one. I found it. I disclosed it to you. The methodology and findings are covered by the authorization agreement."
She picks up her pencil again. "Mr. Reyes, I want to ask you something that may sound unusual."
"Alright."
"Is there a number at which you'd consider working exclusively with Microsoft? Long-term. Full retention."
Ethan takes a breath. He has thought about this possibility — not specifically for Microsoft, but in the abstract. Someone will ask. He has his answer ready.
"No," he says. "I'm building a company. Exclusive arrangements aren't compatible with that."
Dr. Mehta nods slowly. The nod of someone who expected the answer and is not entirely disappointed by it. "Then let's talk about compensation."
The Microsoft settlement is $112 million.
It takes longer to negotiate than Google's — eleven days of back-and-forth between Patricia Holt and a team of four Microsoft attorneys, a dispute about the scope of the NDA's non-compete provisions, a secondary dispute about the consulting arrangement, a final dispute about the attribution clause in the remediation agreement. Patricia handles all of it with the calm competence of someone who has stopped being surprised by the number on the table and started focusing on the architecture of the deal.
Ethan wires $7 million into a dedicated R&D account for Apex Systems.
He calls Vincent Darrow and has a three-hour conversation about capital structure and investment strategy. He is twenty-four years old and has $190 million, gross, before taxes, and he is already thinking about the next thing, and the next, and the shape of what he is building.
Protocol Zero updates his credit balance after the Microsoft settlement clears.
> CREDIT BALANCE: 6,800
> SYSTEM NOTE: HOST'S DEPLOYMENT VELOCITY IS INCREASING. THE CATALOG EXPANDS AS CAPABILITY GROWS.
He opens the catalog that evening and finds that it is, in fact, larger. New categories have appeared below the existing ones, still grayed out, still locked — but present in a way they weren't before.
Quantum Computing Architecture. Aerospace Systems. Biotechnology Interface. Energy Systems.
He reads the names carefully, the way you read a map of territory you haven't yet entered. Then he closes the catalog and goes to make dinner, and he stands at the stove stirring pasta sauce and thinking about Azure cross-tenant isolation, and about what a bank might look like if you could read its walls.