Microsoft 2026 report: how attackers use AI

Microsoft published the 2026 Digital Defense Report on October 1, 2026, covering July 2025 to June 2026. According to the company, attackers use AI in reconnaissance, social engineering, malware and post-compromise activity, but mostly in specific parts of existing methods. According to Microsoft, phishing accounted for 23% of intrusions in 2026, up from 7% in 2025. The report also examines agent security: identity, access, revoking permissions. Why it matters: according to Microsoft, basic rules such as least privilege and monitoring still apply to AI.