Microsoft’s 2026 Digital Defense Report, published on October 1, delivers a stark warning: in the early phase of the AI era, attackers are benefiting from artificial intelligence faster than defenders.

The headline finding is speed. The median time from a vulnerability’s discovery in the wild to its weaponisation has fallen to well below 24 hours, collapsing the patching window defenders rely on. Post-compromise activity that once took days now takes minutes, and some attack steps take seconds. Phishing has surged as an entry vector from 7 to 23 per cent of investigated intrusions, as generative AI crafts personalised lures at scale.

The report, built on more than 165 trillion daily security signals, ties active AI-assisted operations to state-linked groups in China, Russia and North Korea. It documents cases including trojanised npm packages, a prompt-driven ransomware prototype and a malicious browser extension with over 600,000 installs. Microsoft projects a record of about 72,000 new CVEs in 2026.

Government agencies were the most targeted sector at 27 per cent, followed by IT at 17 per cent. Microsoft urges organisations to adopt phishing-resistant MFA, tiered admin controls and automated threat detection, warning of a multi-year pile-up of known but unpatched flaws.