Microsoft's 2026 Digital Defense Report, covering July 2025 through June 2026, describes a measurable shift in the mechanics of cyberattacks: artificial intelligence has compressed the window between the discovery of a software vulnerability and its weaponization to a median of under 24 hours. The report also documents the first fully autonomous, AI-orchestrated ransomware extortion incident, a record volume of tracked CVEs, and a sharp rise in AI-enabled phishing as an initial compromise vector.
The timeline has collapsed
- Median time to weaponization: under 24 hours, down from days to weeks
- CVEs tracked in 2026: around 72,000, a record high
- Phishing as the initial vector: 23% of intrusions, up from 7%
- Public-facing application exploitation: 24% of intrusions, up from 15%
The defensive response
In the same window, the OWASP GenAI Security Project released its 2026 Top 10 for LLM Applications and introduced the Agent Control Standard — runtime enforcement for what an autonomous agent is actually permitted to do at execution time, rather than prompt-level guidance alone.
What the paper covers
The full briefing covers agentic attack chains, how state-sponsored actors are adopting AI tooling, a 2026 at-a-glance table, OWASP's new guardrails, and five practical implications for enterprise security and risk leaders. Download the PDF for the complete analysis and references.