The non-cynical answer is that they’re counting contractor/vendor time in this full time equivalent answer. Which would probably be a good thing, because I imagine that the best people in cybersecurity aren’t actually employees of Microsoft.