Andrew
Conway

Somewhere in Redmond, Washington, a man is reading a statistic that would keep most executives up at night - 42 percent of security alerts are never investigated - and turning it into a product launch. That's Andrew Conway's job. As Vice President of Security Marketing at Microsoft, he is the narrative architect behind the world's most scrutinized security portfolio.

His career reads like a stratigraphy of Microsoft itself. He arrived when the company was still trying to figure out what software was. He stayed through the identity crisis years, the mobile pivot, the cloud transformation, and the AI gold rush. At every inflection point, Conway moved closer to the thing that mattered: security became the story, and he became the person telling it.

The path wasn't straight. He started in developer and designer tools, the unglamorous work of explaining compilers and frameworks to engineers who mostly didn't need explaining to. From there he migrated into identity and security strategy in 2007 - a quiet move that would define the next two decades. Security was not yet cool. It was a cost center, a checkbox, a thing that happened after the fact. Conway helped make it the thing that happened first.

By 2012 he was running product marketing for Enterprise Mobility + Security (EMS), Microsoft's first serious bet that identity, device management, and security belonged together in a single cloud-native platform. The bet paid off. EMS became a linchpin of the Microsoft 365 bundle. Conway described the momentum with characteristic precision: "EMS has rapidly become a leading choice because it delivers what customers tell us they need most to transform their businesses - a comprehensive yet flexible born in the cloud service." Not poetry. But the kind of sentence that closes enterprise deals.

The promotion to General Manager followed, and then Vice President. His ascent tracked the maturation of Microsoft Security from a collection of products into a business that, by any measure, belongs in conversations with the largest pure-play security companies on earth.

Here is the compressed version: Microsoft watches 24 trillion security signals every day, protecting nearly 650,000 customers. Someone has to explain why that matters to a CISO with a hundred vendor pitches in their inbox. Conway is that someone.

But the job is more than messaging. Conway shapes how Microsoft frames the security conversation in public - what statistics get amplified, which framing wins. When he publishes on the Microsoft Security Blog, which he does often, the numbers he picks become the industry's reference points. The 42% of uninvestigated alerts. The one full workday per week analysts lose to manual toil. These aren't random facts. They are chosen because they make the AI-powered security argument self-evident.

The Security Copilot launch represented a genuine inflection in his work. For years, the AI-in-security pitch was theoretical. Then early adopter data started arriving: analysts completing tasks 26% faster, 40% more accurate, with efficiency gains in the 40-60% range. Conway published those numbers and let them do the work. The best marketing is evidence. He's known this for a while.

His February 2026 post on "autonomous defense" is the clearest articulation yet of where Microsoft's security marketing is headed. The vision is an "agentic SOC" - a security operations center where AI agents handle triage and routine response while human analysts reserve their bandwidth for the threats that actually require judgment. Conway frames it not as replacement but as leverage: "Defense is driven by continuous signal correlation, automated decision making, and human expertise applied where it matters most."

He is also the most publicly vocal Microsoft executive on the cybersecurity talent shortage. The 3.4 million unfilled jobs globally is a figure he returns to repeatedly - in blog posts, in his March 2023 CNBC appearance, in podcast conversations. The argument is consistent: there are not enough defenders. AI is not a luxury; it's arithmetic.

The Twitter/X handle tells you something the corporate bio doesn't. @conwaymoto. The "moto" is motorcycles - specifically, the kind you ride on a track. Conway is a track day enthusiast, the sort of hobby that requires both a certain recklessness and a certain precision. He's also a Lewis Hamilton fan and a Jorge Martin MotoGP devotee. Two champions who won by being faster in conditions that punished everyone else.

He describes himself on X as an "English and American father and husband" - a small biographical fact that places him between two national identities, which may explain something about how he navigates the Microsoft global organization with apparent ease. English understatement, American directness. It's a useful combination in enterprise marketing.

What you don't find is a public presence cluttered with opinions about things outside his lane. Conway writes about security. He posts about security. When he makes a prediction, it's grounded in data that Microsoft actually collected. In an era of executives who build personal brands by opining on everything, there's a quiet discipline in staying focused.

Conway is not a circuit speaker who recycles the same keynote for years. His media appearances are targeted: a CNBC segment when the cybersecurity talent shortage hit the mainstream news cycle, a podcast when a host wanted someone who could explain Microsoft's end-to-end security architecture without putting listeners to sleep.