Microsoft Warns AI is Spearheading Faster Cyberattacks
Microsoft has issued a stark warning about the accelerating pace of cyberattacks driven by artificial intelligence. The 2026 Microsoft Digital Defense Report reveals that AI is being weaponized across various stages of cyberattacks, from vulnerability discovery to post-compromise activity. The median time between a vulnerability being discovered and its weaponization has dropped to well below 24 hours, while organizations typically take 30 to 60 days to address critical vulnerabilities. This widening gap creates a significant window of opportunity for attackers.
The report highlights that nearly 40,000 Common Vulnerabilities and Exposures (CVEs) were published in the first half of 2026 alone. AI is enabling both security researchers and malicious actors to identify weaknesses more rapidly and automate parts of the attack process. Microsoft Threat Intelligence has observed a shift towards AI systems directing activity and even carrying out parts of attacks autonomously, though fully autonomous attacks are not yet common. In one controlled evaluation, an AI system executed a 32-stage attack sequence.
The report also underscores the growing use of AI in social engineering and technical attack workflows, allowing campaigns to be tailored more quickly and at greater scale. Despite these advancements, many underlying routes to compromise remain familiar, with user execution and valid accounts accounting for 50% of initial access. Legacy vulnerabilities, such as a 2020 CVE, continue to pose significant risks, with 58% of detections linked to it.
Microsoft emphasizes the need for organizations to strengthen their security foundations, particularly as AI reduces the time available to identify and contain emerging threats. The company recommends focusing on identity management, least privilege, data protection, exposure management, monitoring, and secure software development, extending these controls to AI systems and agents. Security teams are also leveraging AI to automate tasks, correlate information, and assist with vulnerability discovery and threat detection.