Cyber threats have not become entirely new, but their speed has changed. What does the Microsoft Digital Defense Report 2026 reveal about this development?
Microsoft has once again published its annual Digital Defense Report, which examines the current state and key trends in cybersecurity based on Microsoft’s analysis.
A year ago,I wrote about the key findings of the Microsoft Digital Defense Report 2025. At the time, the report particularly emphasized identity protection, the dual role of AI, attacks targeting cloud services, supply chain risks, and organizational resilience.
The 2026 report shows that some of the previous year’s trends have moved to the next stage. As earlier reports already suggested, development is not slowing down, it is accelerating. Advances in AI create new threats, but also new opportunities for cyber defense. Below are five key findings from the report:
1. AI creates new threats and opportunities
In the 2025 report, advances in AI were presented as a double-edged sword. Attackers were using generative AI for activities such as phishing, vulnerability discovery, malware development, and social engineering. At the same time, AI offered defenders new opportunities to identify threats quickly and automate response.
By 2026, this development has progressed further. AI is now fundamentally reshaping cybersecurity: capabilities once available mainly to top-tier threat actors and intelligence services are now within reach of ordinary cybercriminal groups. Attacks are faster and cheaper to carry out, while also increasing in complexity and scale. AI agents enable attacks to be automated and orchestrated more extensively than ever.
The use of AI in attacks increases the pressure on defenders by enabling new operating models and making established methods faster, cheaper, and more scalable. Using AI to defend against attacks is already essential, and according to the report, it will become increasingly common for both attacks and their detection and mitigation to take place at AI-enabled speed.
2. Identity remains the cornerstone of defense, but there are now more identities
Identity has been at the heart of cyber defense for years. Protecting identities remains essential, but it is important to recognize that identities no longer refer only to human users.
In addition to employee accounts, organizations’ IT environments include application identities and automation accounts, and agentic identities also became significantly more common in 2025–2026. Microsoft emphasizes that agents should have their own identifiable identities. Agents and their permissions must be monitored and managed in much the same way as human identities. This creates a new governance challenge for organizations. Who owns the agent? What data can it access? What actions is it allowed to perform? What happens if its purpose changes but its old permissions remain in place?
According to the report, as the number of agents grows, key risks include uncontrolled agent proliferation, unnecessarily broad permissions, and unclear accountability for agent activity. Organizations should now design an updated identity governance model that also covers agentic identities.
3. Phishing is not disappearing, it is shifting from passwords to exploiting trust
In 2025, ClickFix was one of the report’s most prominent trends. In the 2026 report, the landscape has become more diverse: traditional email phishing, malicious commands executed by users, and trends that gained momentum in 2026 now provide attackers with parallel routes into organizations.
The 2026 report highlights vishing (voice phishing) and quishing (QR phishing) as major emerging trends. Adversary-in-the-middle (AiTM) attacks have also continued to increase.
Strong identity protection remains one of the cornerstones of cybersecurity. Although traditional MFA is still an important safeguard, it is no longer sufficient on its own. Organizations should therefore move to phishing-resistant authentication, such as passkeys, and train users to recognize new forms of phishing.
4. Attackers increasingly exploit what we already trust
The traditional image of a cyberattack involves malware that a security solution attempts to detect and stop. In reality, however, an attacker does not always need to introduce anything new into the environment. If an attacker compromises a user’s identity or can exploit tools and services already used by the organization, malicious activity may appear completely normal for a long time.
In the 2026 report, Microsoft highlights attackers’ growing interest in exploiting legitimate tools, cloud services, and existing permissions. Instead of deploying malware, an attacker may use a stolen account, an approved remote management tool, or normal cloud administration functions. From the defender’s perspective, the problem is obvious: how can an attack be identified when the attacker’s actions technically resemble those of an ordinary user or administrator?
This also changes the starting point for defense. Detecting malware or protecting endpoints alone is not enough; organizations must be able to identify anomalous activity by correlating data from identities, endpoints, cloud services, applications, and networks. This is precisely why Microsoft identifies the correlation of security signals as one of the key defense priorities for 2026.
5. Resilience is becoming increasingly important
Last year’s report identified resilience as an important part of cybersecurity planning, and the 2026 report places even greater emphasis on it. The goal is no longer solely to prevent attacks, but also to ensure that the organization can continue operating even when an attack breaches its defenses.
This changes the objective of cybersecurity. Good security does not mean only having the strongest possible defenses; it also means being able to detect an attack quickly, contain its impact, recover in a controlled manner, and maintain critical operations during disruption. The faster attacks evolve, the more important it becomes that an organization’s security does not rely on the assumption that every attack can be prevented.
Cybersecurity planning should therefore assess whether the organization can continue operating during a disruption, limit the damage, and return to normal quickly. Cybersecurity and business continuity are becoming more closely interconnected than ever.
Microsoft’s 10 security recommendations for organizations
1. Put cyber risk management on the leadership agenda
Cybersecurity is a business risk that should be managed in the same way as other key organizational risks. Business leaders need visibility into the organization’s cybersecurity risks, critical dependencies, potential attack paths, and recovery capabilities.
2. Make identity protection a priority
Identity is one of the most important control points in modern security. Microsoft recommends using passkeys and phishing-resistant MFA, reducing permissions, and governing both human and agentic identities.
3. Establish governance, visibility, and protection for AI
Organizations need to know which approved AI tools, services, and agents are being used in their environment, while also identifying unauthorized or unmanaged use. Access by AI systems to data should be governed through permissions, information protection, and governance practices.
4. Reduce the external attack surface
Internet-facing services and devices account for a significant part of an organization’s attack surface. Microsoft recommends continuously identifying them, prioritizing updates, and ensuring comprehensive logging. Network-level visibility should also be enriched with threat intelligence.
5. Correlate security signals
A single security alert rarely tells the whole story. By correlating endpoint, identity, cloud, application, email, and network signals, attacks can be detected earlier and a comprehensive view of the attack chain can be formed. This also helps defenders anticipate the attacker’s next potential targets.
6. Move to continuous threat and vulnerability management
Instead of relying on periodic vulnerability assessments, Microsoft recommends a continuous model that combines visibility into environmental assets, vulnerability identification, threat detection, and AI-assisted analysis. The goal is to maintain an up-to-date view of where the organization’s most significant real-world risks are located.
7. Proactively test real-world exposure
The existence of controls does not guarantee that they will work in a real incident. Organizations should use assume-breach exercises, particularly around cloud services, SaaS solutions, APIs, and automation tools. Testing should prioritize environments where the organization’s most valuable data is processed or combined.
8. Protect software and its dependencies
The software supply chain is part of the organization’s attack surface. Organizations should maintain visibility into the software and dependencies they use and verify their provenance. They also need the ability to respond quickly if a dependency is found to be compromised.
9. Participate in collective cyber defense
Cyber threats cannot be countered alone. Microsoft encourages organizations to share actionable threat intelligence and indicators with trusted partners and authorities. Collaboration supports the identification, investigation, and disruption of attacker infrastructure in ways that are not possible for an individual organization.
10. Prepare for longer-term technology shifts
Not all security risks are immediate. Microsoft particularly highlights the need to inventory the organization’s cryptographic solutions and prepare for quantum-safe encryption. Future planning should also include developing the AI governance model as technology and use cases evolve.
