Microsoft published its 2026 Digital Defense Report this week, drawing on more than 165 trillion daily security observations across its global infrastructure. The report covers a 12-month period from July 2025 through June 2026, and the numbers have direct implications for how small businesses think about the basics.
A quick caveat before we get into it: Microsoft’s incident data skews heavily toward government agencies, large enterprises, and IT organizations. Government faced the highest volume of attacks (27%), followed by IT and research. Small businesses aren’t well-represented in that data, and some of the more alarming statistics about nation-state actors using AI aren’t particularly relevant to a 40-person professional services firm or a regional manufacturer. We’ll delineate where the findings apply to small businesses and where they’re more of a large-enterprise story.
With that said, here’s what the report found.
Phishing Tripled as a Way In
The number that stood out most to us was that phishing accounted for 23% of the intrusions Microsoft’s incident responders investigated during the report period, up from 7% the year before. As a result, phishing went from a secondary attack method to the most common one Microsoft observed in a single year.
Part of that increase is due to AI. Microsoft reports that AI is being used to generate large-scale, personalized phishing lures that pass grammar checks, convincingly spoof familiar domains, and, in some cases, impersonate specific individuals within a target organization. The company detected more than 46 million business contact impersonation attacks during the 12-month period, along with more than 145 million QR-code phishing attacks blocked by Defender for Office 365.
Voice phishing also showed up prominently. Microsoft found that 93% of voice phishing attacks held victims long enough for social engineering to begin, meaning the caller was convincing enough that the target stayed on the line and engaged.
What makes phishing effective isn’t sophistication. It’s that people trust recognizable names, urgent requests, and familiar workflows. AI makes the lures better, but the human dynamic underneath hasn’t changed. Someone gets a convincing email or phone call, responds without thinking it through, and hands over something they shouldn’t.
The best you can do is train employees to slow down, verify sensitive requests through a separate channel before acting, and treat any message asking for credentials, money, or access with suspicion. AI-generated versions are harder to spot than poorly written ones, but they try to trigger the same behavior.
Phishing is the most common way attackers get into small business networks, and it bypasses most technical security tools entirely. A penetration test shows how far an attacker with stolen credentials could get inside your environment. Talk to MainNerve about what that looks like.
Vulnerabilities Are Weaponized Faster Than Anyone Is Fixing Them
Another key finding was that the median time from vulnerability discovery in the wild to weaponization has dropped well below 24 hours. Microsoft projects roughly 72,000 CVEs will be disclosed for all of 2026, which would be a record.
The implication is that the window between “a vulnerability exists” and “attackers are exploiting it” is now measured in hours. On the other hand, the window between “a vulnerability exists” and “the average organization has patched it” is still measured in weeks. Microsoft’s own data shows that critical external vulnerabilities can remain unresolved for 30 to 60 days inside large organizations. For small businesses, where patching is often reactive rather than on a defined schedule, the window can be much longer.
Automated tools are continuously scanning the internet for systems running known-vulnerable software. Your business doesn’t have to be specifically targeted. If your software hasn’t been updated and it has a known vulnerability, those tools will find it. The PaperCut campaign is a good illustration — four days from patch release to working exploit, 395 organizations compromised, 11 of them in the first 26 seconds.
We’ll reiterate that patching on a real, tracked schedule rather than when someone remembers is the difference between a 24-hour exposure window and a 60-day one. For small businesses using managed IT services, this is a conversation to have with your provider: what’s the process for identifying and deploying critical patches, and how quickly does it happen after a disclosure?
Post-Breach Activity Now Happens in Minutes
Once an attacker is inside a network, AI is compressing what used to take days into minutes. The post-compromise work that previously gave defenders time to detect and respond is now happening faster than most monitoring tools can surface it.
Microsoft is clear that this doesn’t describe most of what it sees. The report notes that complex intrusions “still retain meaningful human direction” in most real-world operations. This isn’t a world of fully autonomous AI attacks running end-to-end without a person involved. It is a world where the parts of an attack that used to take time (mapping the network, finding credentials, moving between systems) are getting faster.
For small businesses without active monitoring, this means detecting a breach in progress is harder than it used to be. The window for catching an attacker before they reach something critical is narrower. This is an argument for limiting what any given account or credential can reach inside your network, reducing the blast radius of a successful intrusion rather than assuming you’ll catch it in time.
This brings us to the finding Microsoft says is most consistent across all incidents in its dataset.
Most Breaches Still Come from the Basics
Despite everything in this report about AI and attack speed, Microsoft’s incident data keeps pointing back to the same root causes. User execution accounted for 30% of observed initial access. Valid accounts, meaning stolen credentials used to log in legitimately, accounted for another 20%. More than 52% of intrusions involving compromised accounts resulted in additional credential theft.
The report specifically calls out excessive standing access as one of the most consistent contributors to breach severity. Standing access means accounts that have more permissions than they need, all the time, whether or not those permissions are being used. When an attacker gets into one of those accounts, they inherit everything it can reach. Reducing standing access, giving accounts only the permissions they need, limits how much damage a single compromised credential can do.
Microsoft recommends specific defenses that aren’t limited to enterprises. Phishing-resistant MFA and passkeys reduce phishing exposure. Conditional access policies that evaluate device and location before granting access reduce the value of stolen credentials. Removing standing privileges wherever possible limits lateral movement after a breach. Organizations of any size can implement these.
“A year ago, much of the conversation about AI and cybersecurity was about what might happen,” said Mark Anderson, Microsoft’s National Security Officer for Australia and New Zealand. “Attackers still get in through stolen logins, convincing phishing emails and systems that haven’t been patched.”
The threat landscape is moving fast, but the entry points haven’t changed much. Stolen credentials, phishing, and unpatched software still drive most intrusions, which means defenses that address those three areas are where the effort is best spent.
Stolen credentials, phishing, and unpatched software account for most breaches in Microsoft’s dataset. A penetration test tells you exactly how exposed your environment is to all three. Reach out to MainNerve and let’s find out.
What This Means for Small Businesses Right Now
The 2026 Microsoft Digital Defense Report is a large-organization dataset being used to describe a large-organization threat landscape. Most nation-state activity, AI-orchestrated intrusions, and government-sector targeting aren’t directly relevant to a small business running Microsoft 365 and a cloud-based accounting platform.
What matters is the speed at which known vulnerabilities are exploited, the sharp rise in phishing as an entry point, and the consistent finding that excessive account permissions make breaches worse once they start. None of those findings require a sophisticated adversary to matter for a small business.
You can add phishing-resistant MFA on your most important accounts or create a patching process that runs on a schedule, not memory. Ensure account permissions are reviewed and trimmed to what people need.
None of these recommendations are new. They show up in every report like this one, year after year, because they address the entry points that keep working.
The AI angle changes how fast things move after an attacker gets in. It doesn’t change what lets them in in the first place. The basics still matter most, and for most small businesses, the work needs to happen there.
If you want to understand where your environment stands against the entry points Microsoft’s report keeps identifying, a penetration test can help. MainNerve has been doing that work for over 20 years. Reach us at mainnerve.com/contact-us or call 833-847-3280.
