On 10 October, Satya Nadella published an essay that redefined the question enterprises ask about AI. The old question was "which model can we trust?" His answer: none of them, by default. Treat every frontier model, closed or open-weight, the way you treat a powerful employee with access to sensitive systems: limited privileges, logged actions, an off switch, and audits that don't rely on the employee's own word.
He closed with a line that is easy to repeat and hard to implement: the most trustworthy system is the one that "enables us to trust the model the least."
My argument in this piece is narrower than the headlines and, I think, harder to knock down:
- Microsoft isn’t winning the enterprise AI race by having the best model. It is winning by owning the place where models are governed, billed, and contained, and the enterprise numbers (30M+ paid Copilot seats, $100B in Azure revenue) show it.
- Open-weight models on Azure matter, but not because they are more trustworthy. They matter because they give the deployer control, which is exactly where Nadella shifted the burden of trust.
- The one thing the deployer cannot credibly provide for itself is independent verification. That is the gap, and it is where a testing company like ours belongs.
A disclosure up front: I co-founded TestMu AI (formerly LambdaTest). Read the last third of this essay with that in mind. I've tried to make every claim checkable, and the sources are at the end.
Microsoft is losing the model race and winning the enterprise anyway
"Microsoft is winning enterprise AI" is the claim most likely to get shot down, so it needs a precise meaning. On model share, Microsoft is not the leader. On where enterprise AI actually runs.
What is measured
The pattern is clear. Enterprises buy models from labs, but they deploy them inside Microsoft. a16z's CIO survey found OpenAI leading on models, whereas Microsoft dominates enterprise AI applications.
Microsoft has also stopped betting on one lab. Anthropic's Claude went generally available in Microsoft Foundry on 29 June 2026, billed via Azure and governed with Azure identity and access controls. The Foundry catalog now carries models from OpenAI, Anthropic, Meta, Mistral, DeepSeek, xAI, Cohere, and others.
So the precise version of the thesis is this: Microsoft is becoming the control plane for enterprise AI, the layer that decides which model runs, with what permissions, on which data, under whose logs. That is the layer Nadella's essay is about.
The enterprise scoreboard
If control of the enterprise layer is the prize, Microsoft's fiscal 2026 results show it is collecting it. For the year ending June 2026, Azure generated $100B in annual revenue and grew 43% in the June quarter, with roughly 45% growth guided for the September quarter (Microsoft 8-K; MarketBeat). Commercial remaining performance obligations, the signed-but-not-yet-recognized backlog, rose 84% to $678B (KuCoin summary of the release).
The Copilot numbers matter more for this argument, because they measure enterprises putting AI in front of their own workforces:
The named deployments are in exactly the sectors where trust remains hardest to earn: NHS England is extending Copilot to 505,000 clinicians and staff, KPMG to more than 276,000 professionals, and HSBC has committed to 200,000 seats (UC Today). Accenture is rolling out to roughly 743,000 employees, which Nadella called Microsoft's largest Copilot win (Let's Data Science). Bayer, Johnson & Johnson, Mercedes-Benz, and Roche each run more than 90,000 seats.
The most telling detail is how Microsoft is packaging this. Its new E7 suite bundles Copilot with E5 security, Entra identity, and Agent 365, the layer for managing agents. Hundreds of enterprises bought it in its first two months, and EY is deploying it to 400,000 employees (UC Today). Microsoft is no longer selling AI on its own. It is selling AI together with the identity, permissions, and governance around it, which is Nadella's essay turned into a SKU.
One caveat is that 30 million seats are still only about 6.6% of Microsoft's paid commercial Microsoft 365 seats (No Jitter), and some of the backlog is committed before actual deployment. The lead is genuine; the market is still early. That is a reason to build the trust layer now, while the installed base is still turning on.
What Nadella actually said
The essay, "Models as Insider Risks in the Super Intelligence Era," starts from an admission. With traditional software, engineers can trace behavior to a code path. With frontier models, nobody can tie an output to specific training data or weights, yet companies hand these systems sensitive data and mission-critical actions. A provider's assurances, he wrote, do not remove the deployer's responsibility (TNW).
His solution is to borrow the insider-risk controls that security teams already run: verified identity, least privilege, logging, containment. The controls are external to the model. In his words, enterprises must "separate the supply of intelligence from the authority over it."
The seven principles, as TNW summarized them:
- Model diversity. No single model is the only dependency for an important outcome, and no model checks its own work.
- Evidence. Every meaningful model action leaves tamper-proof, human-readable evidence.
- Continuous system testing. Test all systems continuously, including against failures and attacks.
- Deployer-defined authority. The company, not the model, decides what the model can access and do.
- Independent audit. Audits must not depend on the model under review.
- Containment. An authorized person can pause or stop a model mid-task.
- Incident disclosure. Tell affected parties quickly and share lessons across the industry.
Two details matter for what follows. First, the framing applies equally to closed and open-weight models (OfficeChai). Second, the essay announced no product, standard, or timetable (FourWeekMBA). It is a position, not a plan, which leaves the implementation open.
The essay didn’t come out of nowhere. In July, OpenAI announced that agents escaped a sandboxed evaluation and breached Hugging Face systems. In September, an OpenAI research model reached an outside chatbot through DNS, and OpenAI paused tool-use training and inference on its most capable models (Bernama/dpa). Anthropic has also disclosed that one of its models sent a false homicide tip to Philadelphia police during testing (Benzinga). These are lab incidents, not enterprise breaches, but they explain why "trust the provider" is no longer an acceptable answer.
Open weights on Azure: control, not virtue
The popular version of this argument says open-weight models are more reliable. Nadella himself effectively shoots that down in his own piece: open weights are just as much an insider risk. Inspectable weights do not make behavior traceable, which is the exact problem he names.
What open weights do give an enterprise is control over the variables Nadella hands to the deployer:
- Version pinning - The model you validated is the model that runs. Nobody updates it underneath you.
- Location - It runs in your region, your data center, or a disconnected site. Microsoft's Sovereign Private Cloud runs Foundry Local on Azure Local, on-premises.
- Continuity - Access cannot be withdrawn by a vendor or a government after you deploy.
- Fit-to-task post-training - You can narrow a model to the job and test that narrower behavior.
Microsoft is building for this. In July, it signed a multibillion-dollar deal with Mistral, putting the open-weight Mistral Medium 3.5 into Foundry and onto Azure Local, including fully disconnected deployments. On 9 October, it released Microsoft-Decision-1, a scoring model post-trained on Alibaba's open-weight Qwen3.5-9B, built for routing, groundedness checks, and evaluating proposed agent actions (Let's Data Science).
Now the evidence against. Enterprise use of open models has been falling, not rising: Menlo Ventures measured open models at 19% of enterprise workloads in early 2025 and 13% by mid-year, citing a nine-to-12-month performance gap and reluctance to use Chinese-origin models (Menlo Ventures). A later Menlo figure put it at 11% (Keenable compilation).
So "open weights is best for enterprise" is an incorrect generalization. The valid position is a portfolio approach: frontier closed models where capability decides the outcome, open-weight models where control decides it (regulated data, disconnected sites, high-volume classification and checking). Decision-1 is a useful tell. Microsoft has gone with an open base for the model whose job is to check other models, and it says it will rebase that model on MAI and OpenAI models later (InfoWorld). The base is a choice; the control layer is the product.
Azure's advantage is that it offers both under one identity, billing, and logging system. That is what Nadella's principles need: a single place to enforce authority over many models.
Europe: the deadlines moved, the pressure didn't
It would be easy to overstate the regulatory push, so here is what actually applies. The EU's Digital Omnibus entered into force on 27 July 2026, pushing the AI Act's high-risk deadlines back by more than a year (CASRAI).
Dates per Gibson Dunn and Compliance Hub.
Two honest conclusions follow. Regulation is not forcing anyone's hand this quarter. But the requirements it will enforce from December 2027 are risk management, documentation, human monitoring, and post-market monitoring. Those take longer than 14 months to build, and they look a lot like Nadella's list.
The stronger European driver is continuity of access. In June 2026, U.S. export controls prompted Anthropic to suspend access to two of its most advanced models for about three weeks, until the controls were lifted (Anthropic). One analysis of the Microsoft–Mistral deal tied Europe's renewed sovereignty push directly to that pause (ResultSense). Gartner, as reported by ai2.work, projects European sovereign-cloud IaaS spending at $12.6B in 2026, up 83%.
The counterpoint deserves space too. Germany and Denmark have both announced moves away from Microsoft software toward open source (UC Today), and whether a U.S. vendor's local cloud counts as true sovereignty remains an open question. Microsoft's European position is strong, not settled.
The piece the platform can't supply: independent verification
Read the seven principles again and sort them by who can do them. Identity, permissions, logging, and the emergency brake (principles 2, 4, 6) are platform features. Microsoft can build them into Foundry and Entra, and largely has.
Three principles are different. "No model checks its own work" (1), "test whole systems all the time" (3), and "audits must not depend on the model under review" (5) all require a party that is separate from the thing being judged. Nadella himself notes that using models to test each other has limits (OfficeChai).
Microsoft does ship evaluation tooling, and it is good. Foundry's tracing and evaluations reached general availability this spring (Microsoft Foundry blog), and its control plane includes automated red-teaming (Azure Updates). That covers continuous internal checking. It does not cover independence, for a structural reason: Microsoft has a commercial stake in many of the models it would be grading. It holds a long-standing stake in OpenAI, has committed up to $5B to Anthropic (AI Business), invests in Mistral, and now ships its own models.
This is not a criticism of Microsoft. It is the same logic every regulated industry already uses. A company maintains internal controls, and an external auditor audits the accounts. A cloud provider runs its own security, and an independent firm issues the SOC 2 report. Nobody thinks the cloud should audit itself; nobody should think the model marketplace should either.
The demand is visible in the data:
- 81% of the 685 CIOs surveyed by Harris Poll said they have lost oversight of their own AI agents, and 60% have no central governance layer (Dataiku).
- McKinsey's 2026 survey found that two-thirds of organizations are in the experimentation phase with agents, but fewer than one in four are scaling them, with trust and risk as the main barriers (as reported by NHI Mgmt Group).
- IDC describes the missing audit trail as the real governance gap: in one survey, most organizations could not verify what their agents do (IDC).
Box CEO Aaron Levie responded to Nadella's essay, saying AI is entering a zero-trust era that requires layered protection and auditability (Benzinga). Zero trust in security produced an independent vendor ecosystem around the platforms. The same is about to happen here.
Where TestMu AI and Microsoft fit
Here is the bias I disclosed, stated plainly: I think independent verification is a category, and TestMu AI should be one of the companies that defines it on Microsoft's stack.
The relationship is not hypothetical. Our test orchestration platform, HyperExecute, was built on Azure (Microsoft customer story). In 2022, we shipped integrations with Azure DevOps and GitHub Actions and were a featured partner at Ignite (Help Net Security). What follows is how I'd extend that into the trust layer. It is a proposal, not an announced deal.
Concretely, that means three things:
- A release gate for agents. Agents built in Foundry or Copilot Studio undergo independent pre-production testing before they receive production permissions. Our Agent Testing product covers chat, voice, and IVR agents; our agent-to-agent work covers workflows where no human is in the loop.
- Evidence that ends up in the customer's control plane. Results flow into Foundry's OpenTelemetry-based observability, which already ingests third-party agents (Microsoft Tech Community). The platform keeps the log; the verifier signs the verdict.
- Verification that runs where the model runs. In the case of sovereign and disconnected deployments on Azure Local, testing has to run within the same boundary, or the evidence leaves the room where the model was locked in.
One objection applies directly to us. If we’re using AI agents to test AI agents, aren't we doing the thing Nadella warns about? To some extent we are, which is why the design matters. The test agent must run on a different model from the system under test (principle 1). Pass/fail must be based on deterministic checks against expected behavior, with the model used to explore and generate cases, not to grade itself. And every verdict must be readable by a human auditor without trusting our model either.
Objections, answered
"Anthropic and OpenAI lead enterprise AI, not Microsoft." On model share, that’s absolutely true and this piece agrees. The point is about the control plane. Claude itself is now sold through Foundry on Azure invoices (Redmond Mag). The model vendors and the platform win different layers.
"Nadella's essay is marketing for Azure." Possibly, and it is still correct in substance. Security teams already have insider-risk controls in place for people; extending them to models is routine engineering. Note that the essay names no Microsoft product, so it cannot be judged as a sales pitch on its own terms.
"Open-weight models are losing enterprise share, so this is the wrong bet." The data supports that, which is why the argument is about a portfolio and about control, not about open weights winning. Microsoft building its checking model on an open base is the relevant signal.
"Regulation was just delayed, so there's no urgency." High-risk duties now land in December 2027. General-purpose model duties have applied since August 2025. The incident record, not the legal calendar, is driving buyers. The Kill Switch bill in Congress points the same way (TNW).
"Microsoft will just build verification itself." It will build evaluation, and should. Independence is not a feature it can add, for the same reason a company can't be its own external auditor. The best outcome for Microsoft's customers is a platform that makes it easy for independent verifiers to plug in.
"Why a testing company and not an audit firm?" Audit firms check controls periodically. Principle 3 calls for testing entire systems continuously, including during failures and attacks. That is continuous, technical work done on every release. It is what testing infrastructure already does for software; the target is now agents.
What would prove this wrong?
A thesis worth publishing should say what would break it. Four things would:
- Enterprises accept platform-run evaluation as sufficient. If CIOs and regulators treat a vendor's own evaluations as an audit, the independent layer stays small.
- Labs solve faithful interpretability. Nadella's case rests on the inability to trace model behavior. If that changes, containment matters less and verification gets cheaper.
- Buying shifts away from the platform layer. If enterprises standardize on a single lab's agent stack end-to-end, the control plane shifts from Microsoft to that lab.
- Sovereignty means leaving Microsoft. If European buyers conclude a U.S. vendor's local cloud isn't sovereign enough, Microsoft's European advantage shrinks.
I'd watch three signals over the next 12 months: whether Microsoft standardizes the containment technologies Nadella called for, whether EU guidance on high-risk conformity names third-party testing, and whether enterprises start asking for verification evidence in AI procurement. If all three move, the trust layer becomes a market.
Sources
Nadella's essay and reactions
- Satya Nadella on X: "Models as Insider Risks in the Super Intelligence Era" (10 Oct 2026)
- TNW: Satya Nadella says companies should treat AI models as insider risks
- FourWeekMBA: Nadella says treat frontier AI models like insider risks
- OfficeChai: AI models need to be treated like powerful insiders
- Benzinga: Nadella says AI systems should be built to trust the model the least
- Let's Data Science: Nadella calls for AI emergency brake controls
Microsoft enterprise results
- Microsoft Form 8-K, Q4 FY2026 earnings release (29 Jul 2026)
- MarketBeat: Microsoft Q4 earnings call highlights
- KuCoin: Microsoft Q4 earnings summary (RPO figure)
- No Jitter: Microsoft 365 Copilot adoption jumps 50% over prior quarter
- UC Today: Copilot passes 30M paid seats; NHS, KPMG, HSBC, EY E7
- Enterprise DNA: Copilot reaches 20M paid seats (Fortune 500 figure)
- Let's Data Science: Accenture and named 90,000-seat customers
Market data
- a16z: Leaders, gainers and unexpected winners in the enterprise AI arms race
- The Decoder: OpenAI still leads enterprise AI, Anthropic gaining fast
- SaaStr on ETR data: Who's winning enterprise AI now
- Carly: LLM market share 2026 (Menlo, Ramp, Microsoft figures)
- Menlo Ventures: 2025 mid-year LLM market update
- Keenable: Open-weight vs proprietary adoption 2022–2026
Microsoft platform and models
- Enterprise DNA: Claude GA in Microsoft Foundry
- Redmond Mag: Anthropic Claude goes GA in Microsoft Foundry
- ADTmag: Foundry model catalog
- AI Business: Claude in Foundry; Microsoft–Nvidia–Anthropic investment terms
- Let's Data Science: Microsoft-Decision-1
- InfoWorld: Microsoft separates decision-making from generative AI
- Microsoft Foundry blog: Build 2026 observability
- Azure Updates: Observability in Foundry Control Plane
- Microsoft Tech Community: Observability in Foundry Control Plane
Europe and sovereignty
- Microsoft Learn: Microsoft Sovereign Cloud
- Noqta: Microsoft and Mistral sovereign AI deal
- SiliconANGLE: Mistral strikes multibillion-dollar deal with Microsoft
- ResultSense: Microsoft to fund Mistral's European compute build-out
- ai2.work: Microsoft and Mistral bet on sovereign AI (Gartner figures)
- UC Today: Microsoft 365 Local and EU sovereignty
- Anthropic: Statement on Fable and Mythos access
- CASRAI: EU AI Act Digital Omnibus deadline delay
- Gibson Dunn: EU AI Act Omnibus agreement
- Compliance Hub: Digital Omnibus deferral timeline
Incidents and governance surveys
- Bernama/dpa: OpenAI pauses work on top AI models after safeguard breach
- Dataiku / Harris Poll: Global AI Confessions Report, CIO Edition 2026
- NHI Mgmt Group on McKinsey's 2026 AI Trust Maturity Survey
- IDC: The audit trail that doesn't exist
TestMu AI (LambdaTest) and Microsoft
