Microsoft's Digital Defense Report 2026 says AI is making cyberattacks faster and wider, and that identity attacks now carry most of the load. The report covers July 2025 to June 2026. Its headline figures — 63% of intrusions involving data theft, more than 46 million business email impersonation attacks detected — come from Microsoft's own threat intelligence, which readers should weigh accordingly.
That caveat is not a dismissal. According to Microsoft, the report's four trends are measured and mostly familiar: attackers use AI to find vulnerabilities, generate malware, and run phishing at scale; digital identities are the growing entry point; risks spread through interconnected software and infrastructure; and cyber resilience becomes a leadership job rather than an IT task. The most honest sentence in the summary is one many headlines will skip: attackers' methods and targets have remained largely unchanged. AI, in Microsoft's telling, makes old attacks faster and more scalable. That is a real shift, but it is a shift of speed, not of kind.
Cybersecurity News readers have seen this pattern before. A vendor publishes annual threat data, the AI framing draws the coverage, and the operational details that would actually change a reader's defenses get less attention. This year's report is more useful than most precisely because some of its numbers point at boring, fixable problems.
What the numbers actually say
Three figures carry the report. First, 63% of intrusions globally involved data theft, per Microsoft Threat Intelligence. Second, Microsoft detected more than 46 million business email impersonation attacks. Third, 73.3% of initial access attempts involved user execution, valid accounts, social engineering, or phishing.
Read together, these say the front door is still people and their credentials, not exotic AI exploits. Microsoft's own recommendations confirm the reading: passkeys, phishing-resistant multifactor authentication, and least-privilege access. If attackers mostly walk in through trusted accounts, the defense is also mostly unglamorous. Our guide to what an MFA fatigue attack is and how to stop it covers one of the identity pressures the report describes.
The AI claim deserves its own weight. Microsoft says AI can compress attack chains that previously took days into seconds, for advanced attackers. That is a vendor characterization of capability, not a documented incident count. The report offers no figure for how many observed attacks actually used AI this way. Treat it as a directional warning, not a measured trend.
How much of this is vendor marketing?
Some tension is worth naming. Microsoft sells security products, and a threat report is also a sales document. The report itself concedes that AI helps defenders too — identifying vulnerabilities, detecting threats, accelerating investigations — which conveniently positions Microsoft's own tooling as the answer to the problem the report describes. That does not make the data false. It means the data selects itself: it reflects what Microsoft's telemetry sees, which is dominated by Microsoft's customer base.
The report's own admission that methods are largely unchanged cuts against the more dramatic framing. If attackers still phish, steal credentials, and move laterally, then the practical advice barely changes year to year. Patching, phishing-resistant MFA, and least privilege remain the core. Readers tracking vendor fixes can compare this framing with Microsoft's own patch cadence, as in our coverage of Microsoft's April 2026 Patch Tuesday fixes, where two zero-days were already exploited. Readers following this should also see Microsoft's April 2026 Patch Tuesday fixes 163 bugs, including two exploited zero-days.
The Indonesia numbers need a second look
The release leans heavily on Indonesian figures. Indonesia ranked 24th globally and 10th in Asia Pacific among countries where Microsoft customers were most frequently affected by observed threat activity. Separately, the release cites Indonesia's National Cyber and Encryption Agency (BSSN) — as relayed by Media Indonesia, a secondhand attribution — saying potential cyber threats rose more than 700% in 2025 versus the 2019–2024 period, at roughly 174 potential threats detected per second. By October 2026, BSSN had recorded around 3.13 billion potential threats, averaging 133 per second. This connects to our earlier piece, Microsoft's January 2026 Patch Tuesday lands; New York cyber officials urge immediate updates.
Two problems. The 700% figure arrives through a media citation, not BSSN directly, and neither source explains what counts as a "potential threat." A per-second counter of detected anomalies measures sensor volume as much as attacker activity. More sensors and better detection can raise the number without any real change in attacks. Readers should hold these figures loosely and note that Microsoft's ranking of Indonesia — 24th globally — is a different, more modest measurement than the national alarm the release amplifies.
What to do with this report
The defensible takeaways are the ones the report and the wider record agree on.
- Identity is the main attack surface. Passkeys, phishing-resistant MFA, and least-privilege access are the report's named controls, and they match what independent incident reporting keeps showing.
- Interconnection spreads risk. Open-source software, edge devices, cloud identities, and operational technology are attacked more often, and a single vulnerability can reach multiple organizations through supply chains. Our piece on how independent researchers find zero-days before attackers do explains why disclosure speed matters here.
- Resilience beats prevention alone. The report's advice to test readiness — regular attack simulations, especially for cloud services — is standard and sound.
- Govern your AI use. The report urges visibility over AI applications and agents, including unapproved ones, and access controls on sensitive data. That is new territory for most organizations and worth an internal audit now.
The report's closing quote from Gunawan Susanto, managing director of Microsoft Indonesia, frames security as the foundation for AI adoption: that with strong security foundations, organizations can adopt AI responsibly. It is a fair point, and also a company positioning its own category. The documents support the caution. They do not yet support the revolution.
What remains unknown: how many observed attacks actually used AI in a materially new way, the methodology behind the "potential threat" counts, and whether the acceleration claim holds outside Microsoft's telemetry. Until independent data lands, treat the report as a well-sourced vendor briefing — useful on identity threats, unproven on the AI transformation story.
