Note from the author: Fair warning: this turned into a longer post than planned. I’m under no illusion that everyone has been waiting for another 2,000 words on cyber security. So, for the time-poor among us, here are my five key takeaways. If you’ve got a coffee and ten minutes to spare, the full article follows.
My five takeaways
- AI is accelerating familiar attacks, not replacing them. Identity compromise, exposed systems, phishing and weak security fundamentals remain the most common routes in.
- Identity is now the main security control plane. Human accounts, service principals, applications and AI agents all need the same attention to privilege, visibility and lifecycle management.
- Patch velocity matters more than patch availability. Knowing a vulnerability exists is not enough when attackers can begin weaponising it within hours.
- SOCs need context and correlation, not more alerts. Endpoint, identity, cloud, email, network and threat intelligence must work together to expose the full attack path.
- OT and critical infrastructure risk often starts in ordinary IT. Cloud identities, vendor access, remote-management tools and shared credentials can create a route from digital compromise to physical disruption
What stood out most to me
The report didn't change my view of security. It reinforced it.
The majority of breaches still come back to a relatively small number of issues: identity, exposure, visibility and privilege.
What has changed is the speed.
Attackers are increasingly able to identify opportunities, develop infrastructure and exploit weakness faster than many organisations can make operational decisions.
That's why resilience matters.
The organisations that perform best are rarely the ones with the largest security stack. They're the ones that understand their environment, have clear ownership of risk and can act quickly when something goes wrong.
The most important message in Microsoft’s Digital Defence Report 2026 is not that artificial intelligence is transforming cyber security. We already knew that. It is that AI is accelerating attacks against security weaknesses organisations have understood for years but have still not consistently fixed.
Weak identity controls. Unpatched edge systems. Poor visibility. Excessive privilege. Fragmented telemetry. Unknown dependencies. These are not new problems. What has changed is how quickly and cheaply attackers can now find them, combine them and turn them into a working attack path.
For security leaders, that creates an uncomfortable reality: the next 12 to 24 months will be shaped less by entirely new attack techniques and more by familiar weaknesses being exploited at machine speed.
Identity is no longer just the front door
Microsoft describes identity as the primary control plane for modern defence. From what we see through security operations, incident response and offensive testing, that is difficult to disagree with.
In fact, some of the more significant incidents we've worked recently have involved little or no malware at all. The attacker already had a valid identity, a trusted management pathway or an abused cloud application. Once that trust boundary has been crossed, traditional malware-focused thinking becomes less useful.
The report says password spraying accounted for more than 99% of observed cloud initial-access efforts between December 2025 and June 2026. The surprising part isn't that password spraying still works. It's that in 2026 we're still finding organisations where it works. Attackers continue using it because many organisations still have accounts with reusable passwords, inconsistent MFA enforcement, legacy authentication paths or weak controls around unmanaged access.
Successful authentication is not proof that activity is legitimate.
That distinction matters because much of our traditional detection logic has been built around clearly malicious artefacts. When attackers use legitimate identities and sanctioned services, the activity can appear operationally normal. Microsoft’s account of the Storm-2885 intrusion is a strong example: a privileged cloud identity was used to reset credentials, register authentication methods, interfere with security alerts, operate through legitimate services and pivot from cloud management systems into on-premise infrastructure.
This is where identity monitoring must go beyond counting failed sign-ins. Defenders need to understand changes in privilege, newly registered credentials, unusual token use, unfamiliar applications, abnormal API activity and deviations from how an identity normally behaves.
The same principle applies to non-human identities. Applications, automation accounts and AI agents increasingly have access to data, tools and business processes. Microsoft warns that attackers are already targeting service principals, API credentials and trusted workflow integrations because these identities can operate at scale while attracting less scrutiny than human accounts.
Organisations have spent years building joiner, mover and leaver processes for employees. Many have nothing comparable for agents, applications or machine identities. Over time, those identities acquire permissions, credentials and connections that nobody fully understands. Unless that changes, agentic AI risks becoming the next major source of privileged identity sprawl.
AI is collapsing the time defenders have available
There is a tendency to discuss AI-enabled cyberattacks as though every attacker is about to deploy a fully autonomous hacking platform. That is not what the evidence currently shows. Microsoft states that most observed real-world operations still retain meaningful human direction, particularly around target selection and complex operational decisions.
That is an important corrective to some of the hype.
The immediate risk is not that every intrusion becomes autonomous overnight. It is that individual parts of the attack lifecycle become faster, cheaper and easier to scale. Reconnaissance, vulnerability discovery, exploit development, phishing personalisation, data analysis and post-compromise decision-making can all be accelerated independently.
Microsoft estimates that 72,000 CVEs could be tracked during 2026 and says the median time between vulnerability discovery in the wild and weaponisation has fallen to well below 24 hours. At the same time, the report warns that vulnerability discovery is running ahead of remediation, potentially creating a multi-year increase in known but unpatched vulnerabilities.
That is the issue security leaders should focus on. Finding vulnerabilities faster does not mean organisations can safely fix them faster.
Patching still involves asset identification, testing, maintenance windows, change approval, application owners and the risk of disrupting production. Attackers do not have those constraints. They can scan, adapt and exploit continuously, while defenders may still be negotiating whether an emergency change can happen on Thursday evening.
Microsoft puts this well: being able to patch is one of the most underrated security fundamentals. In practice, patchability is an architectural and operational capability, not simply a vulnerability-management metric. The meaningful measure is not whether a vendor has released an update. It is how long it takes for that update to reach every exposed system, and what happens to systems that cannot be patched quickly.
The report shows why this matters. Microsoft found that many attacks associated with vulnerability exploitation still involved old, well-known CVEs. It also notes that exposed container workloads face a median time of just 5.3 hours between starting and receiving their first exploit attempt.
One recurring lesson from our incident response team is that attackers rarely need the newest vulnerability. More often, they take advantage of the exposed system that has been waiting months for a patch because operational constraints, change processes or application dependencies have pushed remediation further down the priority list. The organisations most affected are not always those with the highest vulnerability counts, but those with a small number of high-consequence exposures that remain visible to attackers for extended periods.
Security leaders therefore need to separate patching volume from exposure reduction. Ten thousand low-risk workstation updates do not compensate for one vulnerable VPN appliance exposed to the internet.
The first questions should be: What is externally accessible? What controls identity or remote management? What would provide a route into our cloud or management plane? Can we patch it quickly? If not, can we isolate it, monitor it or retire it?
AI makes that prioritisation more urgent, but it does not remove the underlying operational challenge.
The SOC needs context, not more alerts
Another point in the report strongly aligns with what we see in security operations at CSA Cyber: the value of a SOC is not determined by how many alerts or detection rules it produces.
Most SOCs don't have an alert problem. They have a context problem. The challenge isn't generating another detection. It's understanding whether an alert matters, what assets are involved, how it connects to other activity and whether it represents genuine risk to the business.
Microsoft argues for correlation-first detection, where individual signals are combined into coherent attack narratives across endpoint, identity, email, cloud, application and network telemetry. It also says threat intelligence should operate throughout the detection lifecycle, informing detection priorities, enrichment, scoring and suppression rather than being consulted only after an incident.
That is the right direction, but it is more difficult than buying another integration.
Effective correlation depends on understanding the environment being monitored. A SOC needs authoritative context about service accounts, management infrastructure, VPN ranges, cloud workloads, administrative processes, workforce locations and normal authentication patterns. Without that context, automation can simply correlate noise faster.
The rise in ClickFix is a useful example. Microsoft observed user-pasted ClickFix commands on more than 1.1 million unique devices between February and early May 2026, representing an approximately eightfold increase. It also recorded roughly 23x growth between December and May.
At CSA Cyber we have also seen the same pattern across customer environments. ClickFix campaigns change quickly, reuse legitimate execution paths and move across sectors within hours. Detection therefore cannot depend on one command, domain or payload hash. It has to recognise the behaviour: deceptive user interaction, unusual clipboard-driven execution, payload retrieval and the follow-on identity or endpoint actions.
The same challenge appears with AI-assisted attacks. Microsoft describes “living-off-the-AI” activity where trusted AI command-line tools could be abused to search for secrets, inspect files and execute actions. It argues that the useful detection surface moves away from fixed process indicators and towards behavioural patterns such as unexpected inference traffic, permissive execution flags and unusual AI-driven file access.
This reinforces a wider point: understanding normal activity is becoming more important than recognising obviously malicious tools.
AI will have an important defensive role here. Microsoft says its own security team uses custom agents to investigate 75% of incoming incidents autonomously, allowing specialists to focus on novel threats and stronger defensive architecture.
That does not mean organisations should switch on unrestricted autonomous response. It means SOC leaders should identify the repetitive, evidence-heavy tasks that machines can perform consistently: enrichment, timeline construction, alert clustering, query generation, incident summaries and low-risk containment.
The goal is not to remove analysts. It is to stop skilled analysts spending their time copying data between consoles and rebuilding context that the platform should already provide.
OT risk starts with identity and visibility
The report’s coverage of operational technology deserves more attention than it is likely to receive.
Many organisations still treat OT security as a segmentation problem. Separate the industrial network, restrict connectivity and assume the boundary will contain the risk. Segmentation is important, but it becomes far less effective when an attacker obtains valid credentials, trusted remote access or control of a shared management service.
Microsoft highlights default credentials, shared service accounts, vendor access and maintenance accounts that have remained unchanged since systems were commissioned. It also points out that many industrial devices were designed before modern identity concepts and cannot support MFA or certificate-based authentication.
The consequence is not simply data loss.
When digital systems control physical processes, compromised access can contribute to production stoppages, equipment damage, safety incidents and disruption to essential public services. The report notes that cloud identity abuse was the most commonly observed technique against critical infrastructure, accounting for 78% of the technique mix in its dataset.
That figure should challenge the assumption that an OT attack must begin with specialist industrial malware. One of the biggest misconceptions around OT security is that the compromise starts in OT. In many cases it starts somewhere far less exotic: an identity, a remote-access solution, a third-party connection or a poorly governed management platform. The OT impact is simply the final stage of a much broader attack path.
The biggest obstacle is often visibility. Many organisations cannot confidently identify every OT asset, identity, vendor account or dependency within their environment. Some have a high-level network diagram or an asset register created for an audit, but not a continuously maintained view of what is connected, who can access it and which business process depends on it.
That needs to become an operational priority. As Microsoft argues, organisations cannot govern what they cannot see. OT identity risk should have a named owner, a current inventory and a direct connection to business-continuity planning.
This is particularly important because nation-state activity is increasingly focused on maintaining persistent access that can serve multiple objectives. Microsoft observes that Chinese, Iranian and Russian actors seek positions within strategic sectors that could support espionage, pre-positioning or future disruptive activity. The United Kingdom was also the most frequently affected European country in Microsoft’s sample of nation-state activity, and ranked fifth globally for customers impacted by cyber threats.
The absence of immediate disruption should not be mistaken for the absence of risk. Persistent access may be the objective.
Resilience is now the real measure of security
The report repeatedly returns to interconnected risk, and this may be its most useful strategic theme.
Risk increasingly sits in the relationships between systems: identity connected to cloud management, developers connected to production pipelines, vendors connected to OT, agents connected to data, and open-source packages connected to thousands of downstream applications.
This is why isolated controls can look healthy while the overall system remains fragile.
Security leaders need to understand not only whether individual technologies are protected, but what would happen if one trusted component were compromised. Which systems could it reach? Which identities could it impersonate? Which controls could it disable? Which operational services depend on it?
That thinking must extend into ransomware planning. Public leak sites may focus attention on whichever ransomware brand is currently most visible, but the underlying economy remains fluid. Microsoft’s own telemetry found Akira was the most active ransomware family it detected, while public leak-site data placed Qilin first. Microsoft cautions that leak sites may be selective or misleading, which is a useful reminder that visibility of a ransomware brand is not the same as prevalence in real incidents.
The more durable focus is the path from access to impact: exposed infrastructure, stolen identities, unsanctioned remote-management tooling, credential theft, cloud persistence and weak recovery boundaries.
Resilience therefore has to mean more than having backups. It means being able to detect compromise, contain it across identity, endpoint and cloud, maintain critical operations, rebuild trust and make decisions while information is incomplete.
Conclusion
My main takeaway from Microsoft’s Digital Defense Report 2026 is that AI is not making the fundamentals obsolete. It is making failure to address them far less forgiving.
Over the next 12 to 24 months, organisations should pay particular attention to identity as a control plane, patch velocity for exposed systems, behavioural detection across trusted services, governance of human and non-human identities, and visibility across IT, cloud and OT dependencies.
The organisations that cope best will not necessarily be those with the most security tools. They will be the ones that understand their environment, connect their signals, remove exposure quickly and continue operating when a trusted part of that environment is compromised.
That is a much harder challenge than buying another product. It is also where the most meaningful security improvement will come from.
CSA Cyber
.png?width=624&height=427&name=Engineered%20to%20Endure%20Campaign%20Assets%20(2).png)