The Pulse
Microsoft Sees AI Compressing Cyberattack Steps to Seconds
Microsoft’s 2026 Digital Defense Report says AI is speeding up parts of the cyberattack chain, while vulnerability weaponization can follow discovery in less than 24 hours. The company says most complex intrusions still involve human direct
AI.info Team · Written with AI ·
Microsoft says AI is compressing parts of the cyberattack chain from days to seconds, while the median time between a vulnerability’s discovery in the wild and its weaponization has fallen to well below 24 hours. The figures appear in the company’s 2026 Digital Defense Report, published October 1. Microsoft says attackers are applying AI to reconnaissance, phishing, malware and exploit development, data analysis and activity after breaking into a system. The report also warns that fixes for critical vulnerabilities on externally exposed systems can take organizations 30 to 60 days.
From AI assistance toward autonomous attacks
Microsoft describes a shift over the six months covered by its observations: AI is moving from assisting human operators to directing attack activity, with some operations approaching autonomous execution. The company says attacks are increasingly automated at scale with limited operator involvement, and that it is seeing the emergence of AI-orchestrated activity in the wild. It does not say that fully autonomous cyberattacks have become routine.
The report gives one measure of what AI systems can do under controlled conditions: in an evaluation, a frontier system linked 32 stages of a complex, multi-stage attack. That result came from a controlled environment, not a documented real-world intrusion. Microsoft says most complex intrusions still involve meaningful human direction, even as AI can speed up or take on work that once required scarce expertise and substantial operator time.
“This doesn’t mean fully autonomous cyberattacks have suddenly become the norm.”
Tanmay Ganacharya and Wes Malaby, authors of Microsoft’s 2026 Digital Defense Report
The gap between discovery and repair
Nearly 40,000 vulnerabilities, tracked as CVEs, were published in the first half of 2026, Microsoft says, putting the year on pace to roughly double that count. The report’s separate timing measure tracks vulnerabilities discovered in the wild through to weaponization: the median is now well below a day. Microsoft contrasts that pace with the 30-to-60-day period it says enterprise remediation can take for critical vulnerabilities exposed to the internet.
The difference leaves organizations with a window in which a known weakness may be usable before a fix reaches affected systems. AI is not the only factor in that timing, and the report does not attribute every faster exploit to AI. Microsoft’s broader claim is that AI can accelerate vulnerability discovery and compress portions of the attack process, on both the offensive and defensive sides.
People and credentials still open doors
The report says familiar routes into organizations remain important. Microsoft Defender Experts data puts user execution at 30% of observed initial access and valid accounts at another 20%. Between February and early May 2026, Microsoft Defender also observed attacker-supplied commands associated with ClickFix-style attacks running on more than 1.1 million unique devices, roughly eight times the previous level cited by the company.
Those figures frame AI as an accelerant to existing security problems, rather than a replacement for them. Microsoft says attackers continue to exploit people, identities, exposed systems and trusted access; an AI agent with excessive permissions can add another route to data and infrastructure. The report advises organizations to limit privileges, find exposed assets, secure software dependencies and extend controls to the identities, permissions, data and tools available to AI agents.
Microsoft’s warning cuts both ways
The company argues that defenders can apply AI to find weaknesses sooner, connect security signals and speed investigations. But more data alone is not enough, the report says: teams need context that helps them decide what to address and act before attackers do. Microsoft’s central timing concern is concrete—the company puts typical remediation for critical external vulnerabilities at weeks, against a median weaponization interval of less than 24 hours.