• Microsoft is offering buyouts to around 60,000 employees.
• Chris Williams, former Microsoft VP of HR, said waiting for a better offer may or may not backfire.
• He shared what employees who are offered a buyout should consider and what they may not realize.

Microsoft is offering buyout packages to some 60,000 employees, or more than 25% of the workforce. That's a huge number in any terms, and it sent a signal and shock wave through the industry this week.

I'm the former VP of HR for Microsoft, and although I've been away from the company for some time and have no insider information, having been on the inside at Microsoft and in the industry for 50 years, here is what Microsoft employees should be considering — and what they may not realize about taking a buyout offer.

Your buyout offer may or may not be the best offer you get

During a buyout, position, tenure, level, and other factors are taken into account for each bespoke offer. The offer is likely to include compensation, benefit continuation, and possibly some acceleration or continuation of equity vesting.

That said, Microsoft might not offer more generous buyouts than severance packages, but companies usually offer better terms to people who take a voluntary separation than people who get laid off. That is not only to induce employees to go voluntarily, but also because the costs to the company are less if these workers voluntarily leave. There is less legal risk, time, and expense. It's also simply easier for the company to manage.

If you're offered a buyout, I usually find it could be the best offer you'll get. If it's not, you could be settling for the same offer as someone in a layoff and miss out on collecting unemployment.

A buyout can force some very hard career choices

If you get a buyout offer, looking at your budget should be your next step. Does the offer provide you with enough to retire? Enough to support an extended job search? The buyout can be a good forcing function for some very hard career choices.

Spend time looking at your cash flows, and pay particular attention to benefits. For many, healthcare costs are a substantial part of their budget. Weighing the buyout offer against continued coverage is often a tipping point in the decision.

Also consider any equity vesting dates you may have. Compare when you might vest with and without the offer, as those dates can mean a significant change in your investments. Whether you should take the buyout is highly dependent on both the offer and your situation. If you had retirement anywhere in sight, this offer might be just the trigger you need to move on. Perhaps the best offer you'll ever see.

However, if you need to continue working, there's a great deal more to consider.

Taking a buyout can give you a head start in a tough job market

The tech industry job market has been rough for the last year or so, and shows all the signs of getting worse. If the buyout doesn't afford you the ability to retire, you should plan on an extended period of job searching, maybe six months or more. It's tough out there. Be prepared.

One thing to consider if you need to continue working is that taking the buyout might give you a short head start in the job market. Assuming Microsoft and others follow this up with more layoffs like they did the last time, the technical job market will be flooded with quality people. Of course, you can search for a job while you have one, but taking the buyout gives you time for a full-time job search.

In any case, if a job search is in your future, don't delay. This market shows no sign of getting better.

Finally, if you're offered a buyout, don't ignore it. It's a sign. I'd read it as a clear signal from the company about your value, at least from their perspective. You can bet on the odds, but if follow-up layoffs happen, I'd bet that those who declined the buyout are somewhere on that list.

Buyout or not, some things to do

This buyout is the latest signal of a broad realignment of the job market, at least in the tech sector. Even if you aren't offered it or don't think you're at risk of later layoffs, you'd be wise to keep all your options open.

Get your résumé up to date. Spend time honing it, emphasizing the clearest set of skills you can. When a market is contracting, the safest bet is having a particular skill someone is looking for. When times are tight, the generalist is often the first person let go.

Work with and expand your network. Have coffee or a Zoom chat with everyone you know. Peers in other companies, even other industries, are invaluable when things get tough. Especially when the world is changing, and predicting the next hot spot is so hard, having as many warm connections across industries is a huge asset.

Don't go asking for jobs as much as keep those connections alive. You never know when someone's manager will say, "We need someone like that." And your friend can say, "I know just the person."

Whether you are offered a buyout, or whether you decide to take it or not, having a network of people to connect with is your single biggest career asset.

What to do if you get a buyout offer

Budget first, and outreach next.

Carefully decide your near- and long-term financial future, and make the decision from hard facts. Then connect with people you know across industries, far and wide. Those connections will be excellent sounding boards and could well provide the path to your next role, or the friends you need in retirement.

When contacted about this story, a Microsoft spokesperson pointed Business Insider to its statement on the official Microsoft Blog, which read in part, "Today, we're introducing a new Voluntary Exit Offer (VEO) to eligible employees within participating organizations." They added that "the VEO is similar to a standard severance offer, which varies by market. The offer includes payment based on completed service and base pay, as well as career transition services, which includes career coaching and job search assistance."

• Edward Tian co-founded GPTZero in college, building it into a success before selling to Superhuman.
• He said he thinks that creating 'artificial scarcity' for the product contributed to its success.
• He said he'd major in the humanities, not computer science, if he went to college today.

This as-told-to essay is based on a conversation with Edward Tian, the 26-year-old cofounder of GPTZero, who's based in New York. His words have been edited for length and clarity.

I was never planning to go down the founder path straight out of college. I had a visual investigations fellowship lined up for after graduation and was ready to start a journalism career.

My cofounder Alex and I went to high school together. When ChatGPT came out, he was pursuing his Ph.D. in computer science at the University of Toronto, and I was in my senior year at Princeton. Over winter break, we built an AI detection tool and put it online. The success was almost overnight.

Three years later, we sold our company, GPTZero, to Superhuman, and have stayed on board to work with the team. Superhuman is a very pro-AI company, and I think it was an unexpected move for us as an AI detection company to join them.

We didn't build GPTZero to say there should be no AI on the internet. I think that's the biggest misunderstanding about why we started our company, but my feelings on AI have changed.

I had a different job lined up for after graduation

I studied computer science at Princeton and worked with a professor at the Princeton Natural Language Processing Lab on AI research. I also worked on a few other startup projects in school, but I was always hoping to work in journalism.

While in college, I became very involved in the open-source investigation community. I ended up working on open-source investigative projects with the BBC and Bellingcat, and had a visual investigations fellowship at The New York Times lined up after graduation, which I was excited about but ultimately didn't take.

After ChatGPT came out, I was inspired to investigate where and when AI was being used online. It took about a week over winter break to build the first version of our AI detection tool, and it was released in January 2023.

We created artificial scarcity to help grow the business

My cofounder Alex and I posted on social media to market the tool so people could try it, but we didn't view it as a business right away. However, it blew up online pretty quickly. After seeing the success, we wanted to double down on the opportunity and turn it into a legitimate site.

One piece of advice I have for founders is that using a waitlist is really helpful for generating hype and excitement. We put the first version of GPTZero on a waitlist because it had reached capacity. So I think that artificial scarcity was also very helpful in the success.

We had a lucky combination of very talented engineers and some traction and buzz, so we started reaching out to VCs. Many of our early VC partners went to my alma mater, and kind of all knew each other. Jack Altman is also an investor, and I remember we had a call where I was in my dorm room, and he was like, "Oh, I recognize that dorm room too."

For founders raising funding for the first time, my advice is not to optimize for the flashiest name or the biggest brand because you think it will attract future talent. Go for where there's familiarity and trust; trust is the most important thing when working with an investor.

We raised around $3.5 million in our first funding round. I stayed at Princeton to finish my senior year and graduate, and we kept growing the business. My cofounder Alex left his Ph.D. program to focus on the business.

It was bittersweet to sell the company

When Shishir, the new CEO of Superhuman, joined in 2025, we spoke with him about his broader platform vision for a suite of products. He thought we could be part of the authenticity suite he wanted to create.

It was bittersweet to think about giving up something that we started from scratch and put so much energy and care into. At the same time, it was a lot easier because the team stayed on. I'm now a director of product at Superhuman.

For company acquisitions, a lot of folks think the three most important things for a great fit are product match, people fit, and economic sense. We had similar people philosophies, and the deal made sense financially. Then, product-wise, we realized we're definitely not against AI use anywhere in education. We just want to make sure there's some authenticity and truth with that usage.

Over the next few years, we're going to take our shot at building a startup within a larger company. I've seen a lot of startup founders go to larger companies and start their moonshots from within.

The bigger mission we have is to take steps to ensure people are being respectful of the person who's on the receiving end of AI generations and productivity now. We want it to be that we're reaping the benefits of AI without making other people deal with more work.

I wouldn't major in computer science anymore

When we first started GPTZero, I think I was actually more pro-AI than I am now. I believe people should know when something is AI-generated, but I wasn't saying not to outsource anything at all.

In the past year, though, I've started to see an over-reliance on AI among people who finished university after ChatGPT was launched, especially with writing. If I went back to college right now, I wouldn't major in computer science. I'd probably major in journalism and get a minor in computer science. I'd get a humanities degree because those are the important skills now.

I've started to see a friction point at work when people can't write or edit, and everything they send reads like AI. Part of what I'm doing now at Superhuman is working on responsible AI usage policies and guidance.

People are allowed to use these tools however they see fit. At the same time, I feel a profound sadness for the internet at large. It's important to make sure we still have human-written content online.

Do you have a story to share about working on a tiny team? If so, please reach out to the reporter at aapplegate@businessinsider.com.

• Kate McNeil opened All the Tropes, a romance bookstore, six weeks after quitting her job.
• Despite concerns about market saturation, All the Tropes thrives as a niche community destination.
• Passion, perseverance, and local support helped McNeil launch her business.

This as-told-to essay is based on a conversation with Kate McNeil, a 41-year-old small-business owner based in Atlanta. It's been edited for length and clarity.

The idea to open a romance bookstore started during COVID.

I joined an online group of fellow romantasy readers, looking to connect with other people who also enjoyed my favorite form of escapism. That group had over 2,000 members, and it was difficult to feel a sense of community. Eventually, it broke off into local chapters.

After COVID, I didn't know of any dedicated space for these same readers to meet in Atlanta. That's how I started the journey to opening the first romance bookstore in my neighborhood. In the two years since I opened, more romance bookstores have opened up, including one less than two miles away.

I thought I'd retire from my teaching job

When I launched All the Tropes bookstore, I was working a job I thought I'd retire from. I taught theater at Decatur High School for six years. My students always came first. I didn't want those kids to feel like I wasn't present or that they didn't have my undivided attention, so the bookstore was a back-burner idea for a few years.

I'd get home from rehearsal at 11 p.m., conduct business research until 2 a.m., then get up at 6 a.m. and go to work the next day and teach.

I took my time to gain a full understanding of the market, but there were still challenges

I learned about dealing with publishing companies and book distributors, connected with local artists to showcase their work, and reached out to local authors. One of the biggest challenges was finding a place for the store.

I knew that I wanted to stay on the east side of Atlanta because I lived in Kirkwood and felt very connected to the community.

In 2024, I found a location a four-minute walk from my home, and I knew it was time to make my idea a reality. In May of that year, I quit my teaching job and prepared to open the bookstore by the end of summer on Romance Bookstore Day.

I had 6 weeks to get the store ready for opening day

I received the keys to the bookstore six weeks before the day I planned to open. The timeline I had for opening day came with a lot of risks. I had cashed in my retirement fund, quit my job, and had a large preorder of "Onyx Storm" before there were bookshelves in the store.

There were many times my friends and I didn't leave the store until 4 a.m. A local artist painted the shop; I printed my merchandise at a local shop in Kirkwood; and I created the fabric wall. There were many nights I had doubts that All the Tropes would come to fruition.

I was a mom with two young kids opening a niche business that, to my knowledge, would be the first in the state, but I was prepared. I had my accounts with publishers, and my branding was complete. Perseverance, my husband, my village of friends, and an invested community got me to opening day.

All the Tropes opened August 17, 2024, on Romance Bookstore Day. In the span of a few months, I went from a passionate high school teacher to the owner and operator of a romance bookstore.

An increase in niche romance bookstores in the city concerns me

Even in a city like Atlanta with several thriving independent bookstores, I wonder about the percentage of residents who read for fun and, more specifically, read romance. While becoming a general indie bookstore would allow me to sell so many other things, I still believe All the Tropes can continue to thrive in a niche market, despite oversaturation.

Unlike a large book retailer, All the Tropes is a destination spot people can come from out of town to visit. Our social presence and promotion of local writers and artists also offer something unique to readers.

All the Tropes could pivot to general fiction, but so far, more stores opening has not impacted store traffic or sales.

4 Things helped me turn my business idea into a reality

All the Tropes continues to thrive because of my original vision of creating a community space for romance book lovers to connect. We now have eight active book clubs and continue to see consistent revenue.

Passion, trusting my gut, therapy, and a supportive group of friends are the reason I was able to turn an idea I brainstormed late at night into a successful niche business ready to grow.

We are now ready for a larger space and to expand our three-person team.

Do you have a unique small business story to share? Email the editor, Manseen Logan, at mlogan@businessinsider.com.

This as-told-to essay is based on a conversation with Siobhan MacDermott, a 56-year-old tech founder based in Menlo Park, California. It's been edited for length and clarity.

I've never been underqualified for any job that I've applied to.

I was vice chair at Bank of America and principal at EY. I held senior roles in cybersecurity at AVG and McAfee. I've sat in boardrooms with Fortune 500 CEOs, advised governments, and built practices from scratch.

Then, in early 2024, when I was 54, I had to relocate from New York City to California for family reasons, leaving the management consulting job I'd held as a partner at The Consello Group. I didn't anticipate what could happen when someone tries to re-enter the institutional world in their 50s — particularly as a woman in a career space that doesn't fit neatly into a job description.

The most surprising barrier has been the gap between what I've actually done and what the market knows how to categorize. I'm worried because I'm not sure where the economy is heading, but I'm an absolute eternal optimist.

I'm not going to accept anything other than staying hopeful.

I felt like my job application was going into the ether

It's been frustrating to watch organizations that desperately need exactly what I've built not hire me.

When I started my job search, I reached out to my network to try to figure out what I could do, who'd vouch for me, and where open positions were. A lot of senior roles were being downsized, but I had a lot of people who initially wanted to help me find something.

The strategies that were a complete waste of time were LinkedIn Easy Apply, recruiter calls that went nowhere, and any process that involved a 45-minute competency-based interview with someone who'd never heard of the big companies I've worked for.

I spent the better portion of every day for over a year applying and looking for jobs. I obsessively searched on LinkedIn for new positions, applying over and over again on the site, company websites, emails, and more, but getting nowhere.

I sent out countless résumés and barely got any responses. These are jobs that I know I'm qualified or overqualified to do, but sometimes I didn't even get the courtesy of the automated "thank you for applying" response.

It was like my application went into the ether. I'd try to find the head of HR for these companies on LinkedIn and reach out to them because I wanted the feedback.

I started trying to think of interesting ways to get attention

The strategy that worked the best during my job search was bypassing HR entirely and using direct outreach to CEOs and board members.

I'd send them letters not even related to a job, but more of an observation of their company to get their attention. I tried to be crafty, saying, "Based on my external assessment of your company, here are some things that I think you should be doing as you think through your next quarter."

Reaching out to CEOs got me in the door, but then they'd send me down to somebody who was pretty junior who'd say, "You're overqualified for this job." They'd courtesy interview me because they'd been told to, but it didn't go beyond that.

Sometimes a CEO would send me to HR, and HR would look at my skill set and say, "It doesn't quite match."

That happened quite a few times.

I adjusted my LinkedIn profile to get a better response, and that helped

I changed my gender to male and back to female a bunch of times to see if it made a difference — I didn't change my pronouns, just my actual gender. I felt like I had more responses on LinkedIn being thought to be male than female.

I also think being in Silicon Valley, you age out a lot faster than you do in other parts of the US, and it's definitely a highly male- dominated space. I had those two things working against me from the get-go.

So I removed the first six years of my career from my work experience on LinkedIn, and I took the dates off of my degrees so that people couldn't tell my age. This made me seem seven to 10 years younger, potentially. Once I took those dates off, I felt like I got more engagement on the site.

My job search in Silicon Valley went nowhere, so I decided to pivot and launch my own venture

I started my company out of necessity, and also out of intellectual boredom. I felt like my brain was starting to rot.

It happened about a year into job searching, when I started feeling financial pressure and frustration. I didn't want my full-time job to be looking for a job. My search wasn't looking like it was going anywhere in the foreseeable future, especially out in Silicon Valley. If you're a computer scientist or an engineer, there are jobs available, but I couldn't find a lot out here not in that space.

I started thinking, what am I good at? What do I know? What are all the pieces that I could put together? What problem can I identify that needs to be solved? That came together pretty quickly, and I launched two companies — Khaos Holdings, a strategic risk-intelligence company, and TeenAegis, a child-safety intelligence business, in January.

We're raising capital, and if the capital comes in, that will be the end of my job search. If the capital doesn't come in, then I'll keep searching — but I've decided that whatever I do will be adjacent to the problem I'm trying to solve now.

One good thing came out of the 2 years since my last job

Being out of work for two years shifted my retirement timeline eight to 10 years from digging into savings. However, since my job search started, I've really homed in on what I want to do with the rest of my career.

The journey I went on was a little bit of a midlife crisis. I asked myself, "What's my purpose in life?" as opposed to "What job do I want to have?" and then identified what skill set could bring me to that.

What led me to where I am was really thinking through questions like: What are all the issues that matter to me? What legacy do I want to leave? How do I want to think about my future for the next 10 or 15 years? How do I want to show up every day?

In the beginning, I was going to apply to anything that I could qualify for that would get me some money. Now I'm not going to do that because I don't think that's going to actually be fulfilling or make me happy. My sense of stability has required a deliberate reframe — from "security comes from a salary" to "security comes from what I've built and what I know."

I'm determined to make this work, but I also realize it may not

The hardest thing is maintaining a positive attitude day after day. If my company doesn't work out, then it's not like I can stop trying.

Taking mental health breaks is important because it's overwhelming, lonely, and hard. You lose your sense of self-worth when you're in this position; people look at you like, "Oh, you're the person who's still looking for a job." So it's hard to continue to put yourself out there.

Still, I do believe there's light at the end of the tunnel. It's just the question of how long the tunnel is.

Do you have a story to share about navigating your career in your 50s? If so, please reach out to the editor, Manseen Logan, at mlogan@businessinsider.com.

• PHP, the open-source computer programming language, had two major vulnerabilities exposed.
• Yonaton Keller woke on Wednesday to panicked messages about the two PHP vulnerabilities.
• He shares three steps you can take to protect your website.

This as-told-to essay is based on a conversation with Yonaton Keller, a 46-year-old product manager at Zafran Security, based in Tel Aviv. His words have been edited for length and clarity.

When I woke up at 6:30 a.m. on Wednesday, I had multiple messages from around 4:45 a.m. alerting me that two vulnerabilities in the PHP programming language had been disclosed.

I immediately understood that this was a very serious situation.

Websites run different versions of PHP, and it's estimated that around 70% of websites worldwide use it. This isn't the first time PHP vulnerabilities have been found, but these ones require essentially no authentication on the attacker's part.

It's a very tricky situation. If it were a year and a half ago, nobody would have really responded to this so urgently. But this might be one of the first major incidents of its kind in this AI era, and the cycle of how attackers operate and how we typically respond is broken.

AI enhances detection and response times, but it also means that any limited-technical person could exploit these vulnerabilities within minutes.

My team was very concerned and had to act fast

I'm based in Israel, so when it was 6:30 a.m., my time, it was the middle of the night in the US. This time gap worked in our team's favor, as we had time to figure out what was going on before our customers woke up.

PHP is an open-source computer programming language used to create websites and web applications. It's such a widely used programming language that we immediately understood that every one of our customers, which includes major corporations and businesses, would likely be affected by this.

With bugs or critical flaws in the infrastructure, like the two that were found in PHP, exploitation is actually quite easy, especially if you use AI agents. That was the first thing we understood: even completely unskilled attackers can use these vulnerabilities to take down sites.

The PHP Foundation said it would disclose the details of the vulnerabilities and release a fix for newer versions of the language around 5 p.m. Israel time. But some details had already been informally disclosed on an online forum. The post was deleted minutes afterward, but screenshots spread around the internet quite quickly in unofficial forums.

So, my team and I dropped everything else and spent all day on Wednesday gathering informal information to see whether we could mitigate the risk of exploitation before an official fix was released.

How to tell if you're at risk

The first step people can take to figure out if they're impacted is to look at their websites and web applications, and try to understand where PHP is involved. You can also assume that most, if not all, of them will use PHP in some way, unless you have very basic HTML-based pages.

The second step would be to look at what vulnerability scanners online are telling you. Tenable, Qualys, and Rapid7 are usually the big three for releasing detection rules and actually detecting the vulnerability. In this case, these vulnerabilities have caused such widespread panic worldwide that they were quick to respond. This is also a way to understand the exact vulnerabilities in your internet-facing assets.

After taking these steps, immediately look online to upgrade your website to the current PHP version. It's quite easy to upgrade that, and it's free. There are some technical steps to do after the fix, so you might need a tech guy to implement them. If you don't update your PHP version, the impact on your business and website can be very, very serious.

Some people are also fully taking their sites offline, and I think that can be the right call if you have evidence that you are being targeted. However, 70% of the internet can't and shouldn't be taken offline just because those sites have some vulnerabilities. It's an emergency step to take if you have evidence of potential exploitation, but it can't be a step taken by everyone.

This was not just about attackers disrupting your website or web application; it was about them taking control of your server, stealing sensitive documents, moving inside your network, and then carrying out malicious operations, such as deploying ransomware or other actions they intended.

The situation has calmed down, but my cybersecurity team is still very concerned

Things have calmed down a bit since Wednesday, but we're still very, very concerned. Patching 70% of worldwide websites doesn't take a minute or two.

Hours after the fix was disclosed by the PHP Foundation, there were already tons of exploitation attempts popping up online. Attackers are getting quicker. I think that in this AI era, when in a matter of minutes, many attackers can attack, you don't have the time you used to.

The whole traditional process of scoping the attack surface, establishing a remediation plan, then calling a guy who's going to be responsible for this remediation plan, et cetera, is broken.

For a long period of time, organizations were investing a lot in what we call post-compromise scenarios. I think the AI era of cybersecurity will involve a lot more security investments in the pre-compromise realm, so defenses can be pre-built and ready for attacks in situations like this.