Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Security modernization can be slowed by recurring decision patterns that introduce avoidable risk, rework, and fragmentation. In the Microsoft Security Adoption Framework (SAF), these recurring patterns are treated as antipatterns and are addressed by aligning business outcomes, security disciplines, and implementation decisions.
An antipattern is a commonly repeated approach that might seem effective in the short term but often leads to issues or failure over the long term. If you don't address these patterns, they can cause slowdowns or failures.
Why antipatterns matter
Antipatterns commonly appear during high-pressure modernization efforts when local optimization is prioritized over end-to-end outcomes.
If you leave them unaddressed, they can:
- Delay or fragment security modernization.
- Increase operational overhead and tool sprawl.
- Reduce detection and response effectiveness.
- Create governance gaps and unclear accountability.
Common cross-discipline antipatterns
Use this table to identify common antipatterns and the SAF guidance that helps address each one.
| Antipattern area | Typical symptoms | SAF guidance |
|---|---|---|
| Strategy and governance gaps | Security decisions are reactive, inconsistent, or disconnected from business priorities. | Establish Security Strategy, Integration, and Governance and engage business leaders in strategy. |
| Architecture fragmentation | Technical solutions are deployed without an end-to-end architecture or clear integration model. | Establish a Security Architecture discipline and review architecture antipatterns and tips. |
| Identity and access silos | Identity, network, and privileged access are planned separately, producing inconsistent controls and user friction. | Establish an Identity and Access discipline and design a privileged access architecture. |
| SecOps tool-first execution | Large volumes of telemetry are collected or tools are deployed without measurable detection and response outcomes. | Establish a SecOps discipline and avoid SecOps antipatterns. |
| Posture without prioritization | Findings accumulate but remediation focus is weak, resulting in little measurable risk reduction. | Establish a Security Posture discipline and improve posture and compliance outcomes. |
| Implementation not tied to outcomes | Controls are implemented without clear business-scenario mapping, resulting in uneven adoption and low confidence. | Review business scenarios and connect scenarios to technologies. |
Use workshop resources
For teams that want structured facilitation, SAF workshops can help identify and correct antipatterns in planning and execution:
Download consolidated antipattern reference
Use this reference for discussion and planning sessions: