If you got "needs improvement" on your performance review and missed your target bonus, but the company's stock went up 30% meaning your total compensation still increased, what would you expect? Would you consider that to be a fair punishment?

The standard Nadella is setting is that cash bonuses needs to be determined by cybersecurity impact, and that expectation needs to be in every part of the company. So he cut his (non-discretionary) cash bonus by 50%.

He could've cut his stock package as well, but you're not going to work at a company where meteoric increases in the stock price can be clawed back if your performance was bad. People would freak out and ask if their stock would be cut if a cybersecurity incident occurred.