Microsoft has released its Digital Defense Report for 2026. Terrell Cox, CVP & Deputy CISO, Customer Security Management Office at Microsoft, describes the annual report as “an opportunity to step back from individual threats and look broadly at what Microsoft’s security and threat intelligence teams are seeing.”
In this analysis, I’ll run you through the key findings and pull-out information you can use to strengthen and inform your existing security strategy — without having to download and read the full report.
AI is accelerating cyberattacks: Microsoft has recognized threat actors using AI for reconnaissance, social engineering, malware and exploit development, and post-compromise activity. The report says AI is giving attackers greater speed, scale, and customization. While fully autonomous attacks are not yet the norm, increasingly large parts of an attack can be carried out with AI, turning it from an assistant into an operator.
Identity is still the primary target: Microsoft reports that “User execution, valid accounts, social engineering, and phishing represent the majority (73.3%) of initial access attempts.” Once attackers gain access, over half of intrusions lead to credential theft. This means one compromised identity can become the gateway to many more, as attackers use stolen credentials to gain access to other systems and accounts.
Attackers are exploiting interconnected systems: As infrastructure becomes increasingly interconnected, a single compromised identity, software dependency, or cloud service can provide access far beyond the original target, creating a domino effect through organisations and supply chains. Microsoft specifically cites open-source software, cloud identities, edge devices, and operational technology as areas being attacked at an unprecedented rate. At the same time, the period between a vulnerability being discovered and exploited is decreasing, meaning organizations have less time to deliver patches.
Defense needs to match the speed of attacks: AI has created unprecedented speed, scale and customization for AI-driven attacks. Microsoft argues that defenders need to operate at the same speed. AI can help security teams continuously hunt for vulnerabilities, correlate signals across multiple sources, investigate incidents, and automate defensive actions. As Cox puts it: “AI is giving defenders new ways to find and address weaknesses while giving cyberattackers new ways to look for them. The work on both sides continues to advance.”
Ultimately, Microsoft is calling for a shift from periodic security practice towards continuous defence. As the report puts it, attacks conducted at machine speed will require defenders to move at the same speed.
Resilience is critical: While prevention remains important, Microsoft argues that organizations also need to prepare for disruption. The report describes the current environment as an “era of polycrisis”, where geopolitical instability, economic pressure, rapid technological change, and persistent cyber activity overlap, increasing the impact of an attack and reducing response times.
In response, Microsoft calls for resilience by design. Organizations need to design systems that can weather disruption, maintain critical operations, contain damage, and recover quickly IF prevention fails. As Microsoft puts it, “recovery and continuity are as critical as prevention.”
Microsoft’s 10 Security Priorities for Organizations
While the above is an overview of the report’s key findings, Microsoft also provides a clear list of security priorities for organizations:
- Govern cyber risk at leadership level
- Defend identity as the primary control plane
- Govern AI and protect data
- Reduce exposure and edge risk
- Correlate signals across the environment
- Adopt continuous threat and vulnerability management
- Validate exposure through proactive testing
- Secure software dependencies
- Participate in collective defence
- Prepare for long-term technological transitions
