Artificial Intelligence · Cybersecurity
Microsoft says attackers are outpacing defenders with AI
Microsoft's 2026 Digital Defense Report said attackers were using AI to speed vulnerability discovery, malware creation and post-compromise work, while state-backed groups were already applying the tools in live operations.
- Microsoft's 2026 Digital Defense Report said AI was reducing the time, expertise and cost needed to discover and exploit weaknesses.
- The report said attackers currently had the advantage, even though Microsoft expected defenders to gain similar benefits later.
- Microsoft said remediation was slower than discovery and warned that known but unpatched vulnerabilities could rise for years.
- The company said the median time from vulnerability discovery in the wild to weaponisation had fallen to well below 24 hours.
- Microsoft said Chinese, Russian and North Korean state-linked actors had already used AI in live operations, but most campaigns still needed human direction.
Microsoft said in its 2026 Digital Defense Report that AI was changing offensive and defensive operations by reducing the effort needed to find weaknesses and by helping attackers move faster than security teams. The company said defenders might eventually gain similar benefits, but attackers had the current edge.
The report said vulnerability discovery was moving faster than remediation, partly because many systems could not be changed quickly. Microsoft warned that this could leave many known flaws unpatched for longer and allow well-resourced adversaries to accumulate large numbers of zero-days.
Microsoft also said the gap between finding a weakness in the wild and turning it into a weapon had fallen to under 24 hours. It said AI was helping with malware generation and with later-stage tasks such as data theft, secret discovery and lateral movement.
The company said state-linked actors from China, Russia and North Korea had already used AI in live activity for tasks including vulnerability research, social engineering, malware creation and infrastructure management. Microsoft added that most real campaigns still depended on humans to make decisions and handle complex steps, and that fully autonomous attacks had not become the norm.
Named in this story
Companies
- Microsoft
- published the report and made the claims
Organisations
- Chinese state-sponsored actors
- were said to use AI to find and exploit vulnerabilities
- Russian state-sponsored threat actors
- were said to use AI-generated tooling and coding assistance
- North Korean remote IT workers
- were said to use AI for persona work, social engineering and access maintenance
- North Korean threat actors
- were said to use AI for malware and attack infrastructure
- Konni hacking group
- was cited in a previous report as using AI-generated PowerShell malware
Products and systems
- 2026 Digital Defense Report
- the report that set out Microsoft's findings
How the source tells it
The piece was cautionary and time-pressured, with Microsoft's own report language stressing near-term attacker advantage rather than giving a neutral technical summary.
- urgency short deadlines and calls for defenders to move quickly create time pressure
- alarm worst-case forecasts about multi-year vulnerability backlogs and stockpiled zero-days
- novelty repeated emphasis on AI as changing attack speed, scale and autonomy