Microsoft's annual Digital Defense Report concludes that attackers are adopting AI faster than defenders, using it to find vulnerabilities, write malware and move through networks once inside, BleepingComputer reported Thursday. The company said the balance is likely to even out eventually but that, for now, threat actors hold the early advantage.

What Happened

The 2026 report, published Thursday and summarized in posts on Microsoft's security and policy blogs, draws on Microsoft's own threat telemetry. Its central finding concerns speed. According to BleepingComputer, Microsoft found that the median gap between a vulnerability being discovered in the wild and being weaponized has dropped "well below 24 hours." Sophisticated groups can use AI to compress parts of an attack chain from days to seconds, and post-compromise steps such as lateral movement and data theft that once took days can now take minutes.

Microsoft also projected that about 72,000 vulnerabilities will be publicly disclosed this year, a record, and warned of a multiyear period in which the number of known but unpatched flaws climbs because AI-assisted discovery outpaces remediation.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

On targeting, government agencies accounted for 27% of the threat activity Microsoft observed in 2026, up from 17% in 2025, making government the most targeted sector for nation-state operations. For January through June, the U.S. bore 25.5% of global impact, followed by Israel at 7.6%, Ukraine at 4.8%, Taiwan at 3.9% and the U.K. at 3.8%.

Phishing made up 23% of observed intrusions this year, compared with 7% in 2025. And when attackers got in using valid accounts, 52.2% of those intrusions led to further credential theft, Microsoft said.

Why It Matters

The report describes how specific state-backed groups are using AI. Chinese actors use AI tools for vulnerability research and exploit development alongside conventional phishing and remote access trojans. Russian operators are leaning on so-called vibe coding and AI-generated tooling to speed up their work. North Korean remote IT workers use AI to build fake personas and run social engineering, while other North Korean groups use agentic workflows and model-written code to deploy malware.

Microsoft cautioned that most campaigns remain human-directed. Frontier systems have shown end-to-end autonomy in laboratory settings, but the company said real-world use so far is concentrated in particular stages of an attack rather than whole operations run by machines.

For defenders, the numbers point to a patching problem as much as an AI problem. If weaponization routinely happens within a day of discovery, monthly or even weekly patch cycles leave a window that attackers can now exploit at scale. The tripling of phishing's share also suggests that AI-written lures are making an old technique more effective.

Recommendations

Microsoft's security blog post urged organizations to treat AI systems as part of the wider enterprise, securing agent identities, access, authentication and monitoring, and to correlate signals across endpoints, identities, cloud and applications. It also called for automating response to known techniques while keeping human analysts focused on novel attack paths.

A separate post aimed at governments set out five priorities: responding to threats faster, building security into AI infrastructure, planning for incidents that escalate, two-way intelligence sharing between the public and private sectors, and keeping essential services running during disruption through exercises and shared security services for smaller institutions.

What to Watch

The forecast of 72,000 disclosed vulnerabilities will be tested as the year closes, and the backlog of unpatched flaws Microsoft predicts will show up first in how quickly vendors and customers can apply fixes. On the policy side, the report puts most directly the question of whether governments will fund shared-service defenses for smaller institutions that cannot staff their own security teams, and whether security is built into AI infrastructure from the start.