Microsoft’s 2026 Digital Defense Report: Attackers Are Walking In Through Trusted Doors, and AI Agents Are the Next One
Most cyber intrusions still begin with a person or a stolen credential, not a clever software exploit. That is the central finding of the Microsoft Digital Defense Report 2026, which covers activity between July 2025 and June 2026. The report adds that AI is widening the attack surface and shortening the time defenders have to react.
Identity is where most breaches start
Microsoft says user execution, phishing, impersonation and the use of valid accounts remain the most common ways attackers get in. The company also found that 52.2 percent of valid-account intrusions involved follow-on credential theft, meaning one compromised login often opens the way to many more.
The scale of social engineering is large. Microsoft detected more than 46 million business contact impersonation attacks in the past year, and more than 145 million QR-code phishing attacks through Defender for Office 365. Between 89 and 95 percent of phishing attachments led to an attempt to steal credentials. In voice phishing, 93 percent of calls kept the victim on the line long enough for the attacker to begin manipulating them.
The report’s answer is old-fashioned discipline: phishing-resistant multifactor authentication, passkeys, tighter privileged access and fewer standing permissions. It stresses that this now applies to non-human identities too, including applications and AI agents.
AI as a tool and a target
The report treats AI in two ways. Attackers use it to move faster and operate at greater scale, and they increasingly go after AI systems themselves.
Microsoft cites a case from December 2025 in which a malicious browser extension, installed more than 600,000 times, harvested ChatGPT and DeepSeek conversation histories. The activity touched nearly 10,000 organisations before it was contained. Such histories often hold source code, customer data and credentials.
Adoption is moving quickly. According to figures cited in the report, 88 percent of enterprises are experimenting with AI agents, and 82 percent of leaders plan wider rollouts within 12 to 18 months. Industry projections put the number of agents in production at around 1.3 billion by 2028.
Microsoft groups the risks around agents into five classes: manipulation of prompts and intent, exposure of sensitive data, compromised identity and privilege, excessive agency, and loss of operational integrity. Its recommendation to policymakers is to settle how agent identity is governed before agents outnumber people.
Who is being targeted?
Government agencies and services accounted for 27 percent of threat activity by sector, ahead of information technology at 17 percent and research and academia at 14 percent. Microsoft says these targets share valuable data, extensive personal information, often under-monitored infrastructure and little tolerance for downtime. The United States took the largest share of observed activity, at 25.5 percent between January 2025 and June 2026.
Speed is a concern in the cloud as well. Exposed cloud workloads were attacked after an average of 5.3 hours, and 63 percent of intrusions involved data theft. In critical infrastructure, 78 percent of observed techniques relied on cloud identity abuse.
Ransomware and a rare disruption success
Ransom detonations against enterprises rose 15.8 percent year on year, with critical manufacturing the most heavily targeted sector by number of attacks.
One result went the other way. In March 2026, Microsoft worked with law enforcement and industry partners to take down infrastructure behind the Tycoon2FA phishing service. By June, its activity was down 95 percent from its November 2025 peak. Its share of CAPTCHA-gated phishing fell from 76 percent to 12 percent.
What it means for Nigerian and African organisations
The report’s country-level data sits in an interactive map, and the published text does not break out figures for individual African markets, so this article makes no claims about Nigeria’s ranking. The patterns it describes are still familiar to anyone watching the continent’s digital economy.
Banks, fintechs and telcos here rely on mobile-first, identity-heavy services, which is the kind of environment where credential theft and impersonation pay off. Many businesses are also starting to plug AI assistants into customer data, often faster than they set rules for what those tools may access. For companies handling personal data, that raises questions under the Nigeria Data Protection Act about oversight and accountability.
Microsoft’s guidance is mostly basic hygiene: reduce exposure, enforce strong authentication, limit what any identity can reach, and share threat signals across systems so patterns become visible. The report also notes that the full document goes deeper on supply chain security, critical infrastructure and national resilience.
The report’s wider argument is that trust can no longer be assumed in digital systems and has to be verified, whether the other party is a colleague, a login or an AI agent.
