Microsoft Digital Defense Report 2026: phishing's share of intrusions rises from 7 to 23 percent

Microsoft published the findings of its 2026 Digital Defense Report on 1 October 2026. According to a post on the company's Microsoft On the Issues blog by Vice President Mike Yeh, the report covers threat trends from July 2025 to June 2026.

• Phishing was used in 23 percent of observed intrusions, up from 7 percent in 2025.
• In 52.2 percent of intrusions that relied on valid accounts, attackers went on to steal more credentials.
• The number of publicly disclosed vulnerabilities (CVEs) is expected to hit a record 72,000 in 2026; attackers can turn a newly found flaw into a working weapon in far less than 24 hours.
• Public sector bodies accounted for 27 percent of observed threat activity, more than any other sector and up from 17 percent in 2025.

Why it matters

According to the report, criminal gangs and state-backed groups want different things but increasingly break in the same ways: stolen identities, internet-facing applications, social engineering and legitimate admin tools. In several sectors, attackers stayed undetected for longer. For companies in Türkiye, this could mean that phishing awareness among staff, strong authentication and fast patching should stay at the top of the list.

A separate post on the Microsoft Security Blog says threat actors use AI for reconnaissance, social engineering, malware and exploit development, and post-compromise activity. Microsoft stresses the fundamentals: identity and authorization, data protection, least privilege, monitoring and testing.