The board conducted three investigations — the Log4Shell crisis, the high-profile Lapsus$ attacks and Microsoft’s Exchange Online breach — and gained the respect of security professionals for harshly calling out corporate and technical deficiencies at major corporations. In its review of the Microsoft Exchange Online hack, the CSRB decried “a cascade of Microsoft’s avoidable errors that allowed this intrusion to succeed” and insisted that “this intrusion was preventable and should never have occurred.” “Microsoft’s security culture was inadequate and requires an overhaul, particularly in light of the company’s centrality in the technology ecosystem and the level of trust customers place in the company to protect their data and operations,’ the CSRB said in a scathing report that triggered major changes at the world’s largest software maker. The CSRB was in the midst of an inquiry into the Chinese government-linked Salt Typhoon hacks of multiple US telcos when disbandment instructions arrived.