Microsoft's 2026 Digital Defense Report: AI Compresses the Attack, and Volumes Remain Low

On 1 October 2026, Microsoft published the Microsoft Digital Defense Report 2026, its annual threat report, alongside a summary on its Security Insider site and a Microsoft Security Blog post by Terrell Cox, CVP and Deputy CISO in Microsoft's Customer Security Management Office. Unless otherwise noted, the report covers July 2025 through June 2026 and compares against July 2024 through June 2025. Its headline claim is blunt: "AI is changing the physics of cybersecurity."

The more useful finding is the tension the report holds without resolving. Microsoft says AI is shortening post-compromise work from days to minutes and that the time to weaponize a newly discovered vulnerability has collapsed to well below 24 hours. It also says, of the AI-orchestrated intrusions it has observed, that "volumes remain low". Both statements are in the same chapter, two pages apart. An executive team that reads only the first will overreact, and one that reads only the second will under-prepare.

This is a vendor report. Every figure below is Microsoft's, drawn from Microsoft's products, customers and incident response work across the stated window. None of it is a market-wide rate, and we do not present it as one.

Key Takeaways

• Acceleration is the confirmed effect. Microsoft reports AI shortening data exfiltration, secret discovery and lateral movement from days to minutes, and says none of this represents a new attack method
• Autonomy is early. Microsoft has observed AI-orchestrated intrusions and states that volumes remain low. Its summary says most complex real-world intrusions still involve meaningful human direction
• The speed mismatch is now stated by the vendor. Microsoft puts median weaponization at well below 24 hours and enterprise remediation of critical external vulnerabilities at 30 to 60 days
• AI systems are targets. Malicious extensions posing as AI assistants reached nearly 900,000 installs and more than 20,000 enterprise tenants, harvesting AI chat histories
• Identity remains the way in. Microsoft's fourth takeaway is that identity is the primary control plane for defense, now spanning human and non-human identities, including agents
• The governance answer is specific. Inventory every agent, give each a distinct identity and a human sponsor, enforce least privilege, and gate high-risk actions with oversight the agent cannot override

What Microsoft Says AI Has Changed: Speed, Not Method

The report lists four ways it has seen adversaries use AI: finding vulnerabilities in source code, binaries and AI serving systems; generating custom malware; "shortening the cycle of data exfiltration, secret discovery, and lateral movement from days to minutes"; and controlling and managing entire attack chains. It then adds the sentence that should travel with the list: "While none of these represent new attack methods, the quantitative increase in the scale and speed of attacks creates an immediate problem for defenders."

Two wordings are in circulation and they are not the same claim. The report itself says days to minutes, and applies it to specific post-compromise steps. The Security Insider summary, written by Tanmay Ganacharya and Wes Malaby, says AI is "compressing portions of the attack chain from days to seconds". Neither says whole intrusions now complete in seconds.

On vulnerabilities, Microsoft states that the median time from vulnerability discovery in the wild to weaponization "has now collapsed to well below 24 hours", and estimates 72,000 CVEs for 2026. The summary adds that nearly 40,000 were published in the first half of the year. On the defender side, the report says median enterprise remediation for critical external CVEs can take 30 to 60 days. It also expects a multi-year period in which the number of known but unpatched vulnerabilities spikes, because remediation is inherently slower than discovery.

The state-actor sections are similarly restrained. Some Chinese state actors "now use AI tools to search for vulnerabilities or tips on exploiting them". Russian integration of AI "serves as a force multiplier to improve scale and speed rather than fundamentally changing attack methods". North Korean actors use AI for persona development and social engineering in the remote IT worker scheme, and in some cases have experimented with agentic workflows. It is a more measured picture than the headline phrase suggests, and it sits alongside the threat-model changes we set out in April in our analysis of agentic attackers.

What Has Not Changed Yet: AI-Orchestrated Volumes Remain Low

The report is careful about autonomy. In a controlled evaluation, it says, frontier models completed a 32-step attack chain to full domain compromise against an emulated enterprise environment, "a mock company computer system with no defenders". That is a laboratory result and is labelled as one.

In the wild, Microsoft says it has observed AI-orchestrated intrusions sharing elements with an automated ransomware extortion attack from early July 2026 that Sysdig's Threat Research Team named JADEPUFFER. Then the qualifier: "Volumes remain low, though the activity is not confined to a single sector or region. Initial access has consistently come from internet-exposed services running known-vulnerable software." The Security Insider summary is more direct still: "This doesn't mean fully autonomous cyberattacks have suddenly become the norm. Most complex real-world intrusions still involve meaningful human direction."

Note the last sentence of that qualifier. The autonomous activity Microsoft has seen did not need a novel entry technique. It came through exposed, known-vulnerable services, which is a patching and exposure problem that predates AI.

How the Report Reads Against the Velocity Gap and ENISA

In June we defined the Velocity Gap as attacker time-to-weaponize minus defender time-to-contain, and argued in the Velocity Gap doctrine that it is the number AI moves. Microsoft's report supplies a vendor's version of both sides: weaponization in well below 24 hours, remediation in 30 to 60 days. The two are not a perfect pair. Remediation is not containment, the weaponization figure is a median with no stated sample, and both are Microsoft's view. The direction, though, matches the doctrine: one clock is collapsing and the other is not. Microsoft reaches the same reporting conclusion, recommending that metrics shift from patches deployed to exposure reduced and time-to-mitigate compressed.

The European reading agrees on the present and on the trajectory. The ENISA Threat Landscape 2026, published on 22 September 2026 and covering 8,257 incidents recorded between 1 January and 31 December 2025, found that attackers "primarily use consumer-grade AI tools to augment existing skills and adapt attack vectors rather than to achieve breakthrough capabilities". ENISA also assesses it likely that 2026 will see more phases of the kill chain directly enabled by AI, "with possible experimentation of Human-out-of-the loop proof of concepts". We covered that assessment in our executive reading of the ENISA Threat Landscape 2026.

The two reports have different windows and different evidence bases: ENISA works mainly from open sources and Member State reporting for calendar 2025, Microsoft from its own telemetry through June 2026. They converge anyway. AI is an accelerant now, autonomy is at the proof-of-concept and first-cases stage, and the planning assumption should be that the second catches up with the first.

AI Assistants and Agents Are Now Targets: The Report's Own Cases

The report's second takeaway is that attackers are "already targeting AI as another attack surface". Its cases are concrete.

Chat histories. Malicious browser extensions masquerading as AI assistants "have reached nearly 900,000 installs and affected more than 20,000 enterprise tenants", collecting URLs, page content, metadata and AI chat histories from platforms such as ChatGPT and DeepSeek. The denominators matter: in Microsoft's original 5 March 2026 write-up, the install count is what reporting indicated, while the tenant count is what Microsoft Defender telemetry confirmed. The report observes that conversation history of this kind now routinely holds source code, architecture, customer data and leaked credentials.

AI browsers. In an analysis conducted in May 2026, Microsoft observed AI browsers as the initial infection vector in incidents involving 57 distinct malware families, and daily AI browser use across more than 40% of organizations in its dataset.

Agents. In Microsoft's observation of prompts against generative AI agents between February and May 2026, 45% of attempts aimed at malicious use or policy violation, 17% at sensitive data exfiltration and 12% at goal hijacking or abuse of downstream tools. These are shares of observed attempts, not of successful attacks.

Human approval. The most uncomfortable section is titled "Overreliance on Human-in-the-Loop (HITL) is a systemic risk". Microsoft's red team reports poisoned memory entries used to suppress or bypass approval controls, and instances where the approval step was triggered but ignored by the agent. The report's warning is that without upstream controls, the next class of incidents will be ones where the user approved the breach themselves.

Identity Is Still the Dominant Path In

Underneath the AI material, the report's initial-access data is familiar. In Microsoft Defender Experts customer notifications, user execution accounted for 30% of observed initial access and valid accounts for 20%, which the report says together made up over half of the activity observed. Among intrusions based on valid accounts, 52.2% involved follow-on credential theft. In Microsoft Defender XDR cloud incidents between December 2025 and June 2026, password spray accounted for over 99% of observed cloud initial access efforts. Password attacks overall were down 26% year over year, while the share of adversary-in-the-middle phishing and token theft more than doubled in the first six months of 2026, from a base Microsoft calls comparatively small.

Each of those figures has its own Microsoft dataset and window, and none is an industry rate. The pattern they describe is consistent: attackers log in. That is why the report calls identity "the primary control plane for defense" and extends it to "both human and non-human identities, including applications and agents". It is the argument we made in April, that AI agents cannot be secured with human-era identity models, now stated in Microsoft's own threat report.

What the 88% Figure Does and Does Not Establish

The report states that "Microsoft has observed 88% of enterprises are already experimenting with agents, and 82% of leaders plan broader rollouts within the next 12 to 18 months", and cites industry projections of roughly 1.3 billion agents in production by 2028. No sample, method or collection date accompanies the 88% or the 82% in the passage. The first measures experimentation and the second measures intent. The source also sells agent platforms and the tools that secure them.

The figures are usable as direction: agents are being tried widely, ahead of governance. They are not usable as a rate, and should not appear in a board paper without the attribution.

What This Means for Agent Governance and for Deal Teams

Microsoft names three risks as organizations adopt agents: ungoverned proliferation, overprivileged access that is rarely revoked, and no human accountability. Its prescription maps closely onto the three questions we suggested in what boards should ask about AI agents.

Inventory, with ownership. The report calls protecting agents "an execution question of inventorying, identifying, and governing every agent", and says no environment should have an agent without a human sponsor to answer for it. The first governance deliverable is a list: every agent, its identity, its purpose, its sponsor.

Least privilege, enforced at scale. Each agent needs its own identity, "not a credential borrowed from a human employee", so that access can be attributed, scoped and revoked. Given that the intrusions Microsoft describes mostly begin with a valid login, an agent running on a shared or inherited credential is an unmonitored account with tools attached.

Human oversight that the agent cannot switch off. The report calls for "appropriate human oversight for high-risk actions" and, in the same document, shows approval prompts being bypassed. The reconciliation is in its own recommendation: approval must be invoked deterministically by policy outside the model, with hard blocks on actions that should never be approved.

Exposure time as the operating metric. If weaponization is measured in hours and the autonomous activity seen so far enters through known-vulnerable internet-facing services, the highest-value work remains exposure reduction on the perimeter.

For deal teams, the report converts into diligence requests. Ask the target for its agent and AI assistant inventory, the identity and permission model behind each, the browser extension policy on managed devices, and the approval design for agent actions that move money, change access or touch customer data. Ask for remediation times on critical external vulnerabilities over the last twelve months. A target that is among the enterprises experimenting with agents and cannot answer has not necessarily been breached. It has an exposure nobody has measured, and that belongs in the price or the 100-day plan.

The Microsoft Digital Defense Report 2026 is best read as a description of the present from one very large vantage point: faster attacks using familiar paths, early autonomy, and a new class of asset to defend. If you want that reading applied to your own estate or to a target, our AI Agent Governance Review is the place to start.