Satya Nadella on Zero Trust for AI and Why Every Company Should Own Its Intelligence

Satya Nadella says he once believed that alignment would emerge naturally as AI models scaled. He no longer holds that assumption. Harry Stebbings introduces the Microsoft CEO by recalling how he started 20VC from a London bedroom at 18, without money or a network, and describes this interview as a personally meaningful conversation.

Stebbings asks about Nadella's recent argument that people should assume a model is compromised. Is he suggesting that users cannot rely on model providers' disclosures? Nadella answers that scaling continues to produce more capable models, but alignment has not simply followed, and understanding the mechanisms inside models remains elusive.

Given those uncertainties, Nadella proposes applying an established security idea: zero trust. The goal is an engineered environment that can contain a malfunctioning agent before it causes harm. If agents become more capable while remaining imperfectly aligned, he says, users need a separate trust system they can rely on.

Asked who should build and govern that system, Nadella separates the security architecture from the research problem of AI safety. In his view, alignment needs to be embedded in model training, potentially from pre-training itself; he doubts reinforcement learning alone can deliver it. External containment, by contrast, is work security practitioners can undertake now.

Nadella describes Microsoft's Agent 365 and its security tooling as examples of the approach: give each agent an identity, log its actions and tool calls, protect those records from tampering, establish policies, and monitor behavior against them. He also wants model calls and reasoning traces to be available for inspection by trusted parties and checked with multiple models.

Stebbings asks whether the architecture exists today. Nadella says it does, and warns against conflating two challenges. AI safety may be difficult and unfinished, but that does not mean users have no security measures available. His prescription is to build the external trust system and aggressively monitor deviations from policy.

There is a complication: a model's chain of thought can itself be unfaithful. Nadella argues that a provider hiding the trace because it is unreliable makes inspection harder still. He favors standardization and auditable access for trusted partners, while recognizing that inspection does not make the trace inherently trustworthy.

That need for transparency may help open-weight models, Nadella suggests. Closed models may currently be more powerful, but providers could face a problem if they do not give trusted partners enough visibility. Stebbings asks whether the prominence of Chinese open models raises a separate safety concern.

Nadella argues that an unaligned model is not automatically a safe asset for its country of origin: it could also harm that country. He points to progress on open-weight models in the West and says Microsoft's MAI models will use what he calls licensed weights. His preference is for a straightforward software business in which customers can use and control the models.

Stebbings asks how traffic and spending might split between open and closed models over the next two years. Nadella does not offer a percentage. He says the answer depends on where the frontier moves and how far established tasks become saturated: once a problem is stable, cheaper models can often serve it, especially when a customer can train on its own usage traces.

For evaluations that keep advancing, customers may still pay for frontier capability. Nadella also describes a future of multiple agents and subagents, potentially including local models. He expects a continuing frontier market but believes most token usage could become commoditized; that could mean open weights or cheaper closed models competing on price.

His own Copilot use, Nadella says, combines less expensive closed models with open-weight models. Stebbings turns to a related business question: should companies have specialized intelligence built around their own data? Nadella calls the future of the firm in an era of intelligence one of the central questions.

Nadella invokes Friedrich Hayek's account of distributed knowledge: useful, often tacit knowledge resides throughout an economy, rather than in a single intelligence or a single firm. For companies, he argues, AI should increase their ability to accumulate that knowledge rather than leak it away.

He calls the resulting concern a reverse information paradox. Kenneth Arrow described the difficulty of selling information without revealing its value; here, Nadella says, the buyer of intelligence also needs protection. The issue extends beyond raw data to the exhaust of use, including feedback signals that could improve a provider's model rather than remain valuable to the customer.

Nadella argues that more of the surplus created through a firm's use of intelligence should stay with the firm. That knowledge need not be embedded only in model weights: it can also reside in context and evaluations. He imagines each company maintaining private benchmarks that represent core intellectual property, with models competing to improve against them.

Stebbings wonders whether private evaluations will remain the preserve of unusually advanced AI companies. Nadella compares the moment with the late 1980s and early 1990s, when companies that used PCs, spreadsheets and email seemed exceptional. Such practices spread over time, he says, and the idea of being 'AI native' could likewise become ordinary.

The conversation shifts to whether AI will produce a large implementation economy. Nadella says systems integrators have long helped businesses adopt technology, but AI implementation combines business and technical work in a distinctive way. It is neither conventional management consulting nor classic systems integration alone.

He cites Unilever as an example: the company built an agentic system for order-to-cash work and trade claims, starting with a frontier model and then substituting a lower-cost MAI model for claims. Nadella says the customer can train on its own traces and control the model. Forward-deployed engineers helped initially, while the company's IT team now manages the system.

Such engagements begin with questions about the business objective, the evaluation and the agent architecture. Nadella expects a new set of ecosystem skills to develop around that combination, with forward-deployed engineering becoming a more familiar part of implementation.

Stebbings asks whether companies must own the full stack, from chips to models to applications. Nadella says it depends on industry structure. An application might instead use a router and decision engine to select the best model for each task, drawing on multiple competing open- and closed-weight models.

A vertically integrated winner remains a possibility, but Nadella thinks the market has recently moved in the other direction. He sees increasing competition in silicon, the systems around it, models and applications. His preferred outcome is horizontal specialization, with multiple winners at each layer and the ability to combine their products.

Stebbings says he underestimated the depth of inference demand and would have invested differently had he understood it a year earlier. He asks whether the world has enough power and infrastructure for the prospect of $100 billion training runs, which only a small number of labs could afford.

Nadella approaches the question from the revenue side. A training run is part of research and development expenditure; companies can spend at that scale only if they generate enough revenue, and ultimately if their contribution to a growing economy supports it. The supply side matters too: power generation, chip fabrication and other capacity are long-lead investments.

Many suppliers are building in response to demand, but Nadella says nobody knows exactly when capacity will come online or how supply and demand will balance. The basic economics of a company will still apply: revenue, costs and profit. For him, the larger question is what happens to global GDP growth.

Asked whether AI could significantly raise growth, Nadella says he thinks and hopes it can. He points to healthcare and the use of Copilot in the UK's National Health Service: better patient outcomes at lower cost would, in his view, be a meaningful economic benefit. He wants to find areas where adoption yields substantial gains with relatively little displacement.

Software development is another example. Nadella sees unusually elastic demand and large IT backlogs that organizations did not fully recognize. Stebbings asks whether other functions, such as finance, sales and marketing, could see capability improvements comparable to coding.

Nadella says coding benefits from relatively verifiable rewards and reinforcement learning, while similar verification in broader knowledge work is harder. Even so, he points to contact centers, supply chains and business workflows as places where progress is appearing. Science and engineering may also have elastic demand; he mentions faster chip development and simulation as examples.

The speakers discuss maintenance scheduling as another optimization problem. In a quick-fire round, Stebbings asks how Nadella exercises despite travel. Nadella says he has kept a daily morning habit for about 25 years: knee problems have replaced running with incline walking, but he still aims to spend time in the gym even when jet-lagged.

Asked what he has changed his mind about in the past year, Nadella returns to alignment. He recalls the early OpenAI figures who believed in scaling laws, a view he shared in 2018 and 2019. He used to expect alignment to follow from scaling, but now sees it as potentially a harder and different problem.

What seems strange now but may become common in five years? Nadella returns to the idea of company-specific evaluations, suggesting that a firm's identity could be expressed in part through its AI benchmark. Stebbings then asks what most excites him about the next decade, mentioning the potential for drug development in connection with his mother's multiple sclerosis.

Nadella hopes AI, as a powerful general-purpose technology, will diffuse across sectors and countries faster than earlier technologies. His aspiration is a lasting shift in global growth that lifts more people, rather than merely creating a new set of winners and losers. He connects that hope to his father's work as a development economist and to the prospect of greater convergence for the Global South.