Microsoft’s annual defence report tracks AI inside existing attack workflows

Microsoft released its 2026 Digital Defense Report on 1 October. Its summary describes attackers using AI in reconnaissance, social engineering, malware and exploit development, and post-compromise work. The company says much observed use still accelerates particular stages of existing workflows rather than replacing the whole operation.

The report follows threats across identity, applications, cloud infrastructure and software dependencies. That view also shapes its discussion of AI systems connected to tools and business data. The report is based on Microsoft’s security and threat-intelligence visibility, which is substantial but differs from a complete census of global attacks. The useful reading is to connect its observed techniques with the systems an organisation actually operates and can monitor.