Microsoft Digital Defense Report: How AI is reshaping the cybersecurity landscape

What happened

Threat activity can span infrastructure, identities, applications, cloud environments, and software supply chains. AI systems and agents increasingly interact with data, tools, and business systems.

And activity that looks incomplete in one part of an environment can become clearer when separate signals are considered together. Read the 2026 Microsoft Digital Defense Report The pace of change also matters. Microsoft is a software development and software company based in Redmond.

AI models are becoming more capable, automation is expanding, and new connections are forming across the systems organizations rely on. These developments can change the speed and scale of security activity even as the underlying security fundamentals remain familiar.

Several findings in this year’s report illustrate that. AI in the threat landscape Threat actors are incorporating AI into reconnaissance, social engineering, malware (software written to damage a system or steal from it) and exploit development, and post-compromise activity. AI can give threat actors (the person or group behind an attack) greater speed, scale, and ability to tailor activity more efficiently.