What the 2026 Microsoft Digital Defense Report Means for MSPs

Summary

Microsoft's 2026 Digital Defense Report finds that AI is now directing attacks rather than assisting them, reducing attack chains from days to minutes. Password attacks fell 26% but token theft more than doubled, voice phishing over Teams rose 502%, unsanctioned RMM agents now mark most human-operated intrusions, and a 2020 CVE still leads the exploit table. For MSPs, the takeaways are that identity-only monitoring leaves tenants vulnerable, and that manual response can no longer keep pace with threats directed by AI agents.

Versioned Specifics:

• Original publication date: October 2026
• Key problems addressed: AI-directed attacks, token theft and device code phishing, Teams vishing and ClickFix, RMM tool abuse, patch latency, AI agent identity and governance
• Relevant inforcer solutions: inforcer TDR, 365 Manager, Copilot Readiness Assessments
  

What the 2026 Microsoft Digital Defense Report Means for MSPs

Microsoft published its 2026 Digital Defense Report on October 1. It draws on more than 165 trillion security signals a day, covers July 2025 through June 2026, and runs to more than 100 pages written mainly for enterprise security leaders.

This article breaks down the key implications of this report for MSPs that must manage and protect multiple Microsoft 365 tenants, often without the large security teams that some enterprise organizations can afford to keep in-house.

The report's single biggest shift is AI changing the speed, scale and autonomy of attacks, which has implications for nearly every other finding in the report. Microsoft's own assessment is that, in the near term, attackers are reaching those advantages first, and that defenders "will need to move sharply in order to close the gap." Below are the six findings we think matter most to MSPs, and what each one means for the tenants you protect.

• Read the Whole Report
  

1. AI now directs attacks instead of merely executing them

Microsoft Threat Intelligence now sees AI used at every stage of an intrusion: reconnaissance, phishing, malware and exploit development, and post-compromise activity. For sophisticated actors, the report says, the attack chain can be reduced "from days to minutes."

Lab evaluations and a small number of real-world cases also show a trend leading toward full-chain autonomy, including a controlled test in which frontier models carried out a multi-stage, 32-step attack chain against an emulated enterprise and achieved full domain compromise. Microsoft's forecast is blunt: "what is on the leading edge today will be commoditized within a year."

We explained the difference between generative and agentic AI, and why it matters for Microsoft 365 security, in our recent guide to agentic AI vs generative AI in cybersecurity. The findings from Microsoft’s report reinforce the security challenges we outlined there.

Careful readers of Microsoft's report may notice that it states fully autonomous attacks are not currently the norm. But it would be a mistake to interpret this as a sign that the threat such attacks pose is illegitimate.

The truth is that autonomous attacks are becoming more common, and that their speed and scale is already changing the security landscape, even in cases where a human is still in the loop. A 32-step chain in a lab is a preview of what will likely soon be the norm for cyber attacks.

What this means for MSPs: Attacks can now be carried out in less time than it requires to manually investigate a single alert. And as this becomes more common, manual threat detection and response will become progressively less effective. That means MSPs need to modernize if they want to keep protecting their customers and earning their business.

2. An attack that finishes in hours can still set you back weeks or months

The report puts the median time from a vulnerability being discovered in the wild to being weaponized at "well below 24 hours," and expects 2026 to set a record of roughly 72,000 published CVEs.

On the other side of that gap, median enterprise remediation time for critical external CVEs is 30 to 60 days. Microsoft's recommendation is to patch any internet-facing or identity system within 72 hours of a critical disclosure. The executive summary adds that 63% of intrusions involved data theft.

What this means for MSPs: The intrusion itself may be over in an afternoon. But the damage to the customer’s tenant (and your MSP’s relationship with them) is often long-term. In addition to whatever data is stolen during the breach itself, the recovery process typically takes weeks of work that costs additional time and money: resetting credentials, working out what was accessed, notifying their own customers, and more. These costs can be even more significant.

3. Identity attacks have moved past the password

There is good news in the identity chapter of Microsoft’s report. Password attacks are down 26% year over year, which Microsoft reads as strong evidence that MFA and passkeys are working. The rest of the chapter describes how attackers have responded.

Token theft, device code phishing and password spray

In the first six months of 2026, the share of adversary-in-the-middle (AiTM) phishing and token theft attacks more than doubled. Microsoft notes the share is still comparatively small, but calls it "the direction of travel." Device code phishing, which tricks a user into authorizing an attacker's device on Microsoft's real sign-in page, has gone from niche to "a preferred credential theft method for both nation-state and financially motivated actors." And password spray has not gone anywhere: it still accounts for over 99% of observed cloud initial access efforts, with more than 124 million attempts recorded in a 180-day window.

Once attackers gain entry, the next steps often follow predictable patterns. Valid accounts made up 20% of initial access in Microsoft's incident response cases, and over half of those intrusions (52.2%) involved follow-on credential theft. Microsoft's responders describe the sequence as:

• Compromising a human identity
• Discovering non-human credentials
• Escalating privileges
• Acting on the objective

Storm-2885: an intrusion that looked like routine administration

The clearest example in the report is a threat actor Microsoft tracks as Storm-2885, uncovered in February 2026. The actor compromised a highly privileged cloud identity, used it to reset credentials and register additional authentication methods, then used a legitimate Microsoft Entra ID application with Graph API access to read hundreds of thousands of emails across hundreds of mailboxes.

The same privileged access let the attacker close alerts, downgrade incidents and resolve detections as they went. In Microsoft's words, the activity "blended into expected cloud application behavior, making it difficult to distinguish from legitimate administrative or business use without careful correlation."

What this means for MSPs: A valid credential makes malicious activity look like legitimate use, and identity-only monitoring sees nothing wrong. Catching this requires a tool like inforcer TDR, which correlates threat signals across the entire Microsoft 365 environment for every tenant an MSP manages, so that a routine-looking sign-in is read alongside the mailbox rule, the OAuth consent and the data access that followed it.

4. Human error is still the most vulnerable way into most tenants

Across two years of Microsoft incident response findings, user execution was the single largest initial access vector at 30%, followed by valid accounts (20%), malicious copy and paste (13%) and phishing (11%). The report describes an initial access landscape "dominated by human-centric and identity-centric entry points."

The fastest-growing technique in that category is ClickFix, where a fake error message or CAPTCHA persuades a user to paste a command into their own machine. Between February and early May 2026, Microsoft Defender observed ClickFix-style command execution on more than 1.1 million unique devices, roughly an eightfold increase, which Microsoft attributes to kits for hire.

Microsoft Teams has also become "a more prominent access vector." Weekly confirmed malicious voice phishing (vishing) volume over Teams rose 502% from the previous year. Over 90% of the attackers using Teams have added voice calls to their approach, and across the attacks Microsoft studied, 93% of attackers succeeded at least once in keeping a target on the line long enough to begin social engineering, despite the "External" banners and call warnings Teams displays.

Alongside this, Microsoft detected more than 46 million business contact impersonation attacks over the twelve months, in which attackers pose as a known business contact to open a conversation rather than deliver a payload. As the report puts it, BCI "is, overwhelmingly, a conversation."

What this means for MSPs: Not every attack arrives this way, but a growing share now comes through the collaboration tools inside the tenant, and via Teams in particular. No software can completely eliminate the possibility of a person being susceptible to a convincing call or a fake error page. What the right security solution can do is detect that attack quickly once it has happened, by looking at more than just the identity layer.

5. Attackers follow trust: your own tools and your oldest flaws

In a chapter of the report entitled "Legitimate access becomes the threat," Microsoft describes a consistent pattern: attackers increasingly abuse the tools, cloud services, and administrative functions an organization already trusts, rather than bringing custom malware of their own. There are two findings in that chapter that every MSP should pay close attention to.

Unsanctioned RMM tools

The first is about remote monitoring and management (RMM) tools. Microsoft now calls the appearance of an unsanctioned RMM agent "one of the most reliable mid-stage indicators of a human-operated intrusion."

These agents are typically introduced within minutes of a threat actor establishing a foothold, configured to launch on logon, and give the attacker the operational reach of a senior administrator from a single agent.

Across Microsoft's post-incident reviews, an unsanctioned RMM agent consistently preceded credential harvesting, lateral movement, token theft with mailbox rule or OAuth consent abuse, and encrypted exfiltration through the agent's own transfer channel.

The endpoint evidence is often minimal: routine-looking RMM activity, signed where possible, "indistinguishable from sanctioned administration." Microsoft's recommendation is to limit remote assistance tools to IT.

Unpatched vulnerabilities

The second is about patching. Of the detections tied to the five leading CVEs Microsoft analysed, 58% were associated with CVE-2020-1472, the Netlogon vulnerability first disclosed in 2020. Microsoft's own red team puts it plainly: "Being able to patch is the most underrated fundamental."

What this means for MSPs: RMM is the MSP's own instrument, which is exactly why an attacker's copy of it looks like business as usual. And a six-year-old CVE leading the exploit table shows that attackers still succeed far more often through known, unpatched vulnerabilities than through new ones. Keeping every tenant's systems patched remains one of the most effective defences an MSP can offer. When inforcer TDR contains an incident, its prevention tab names the control that would likely have stopped it, and 365 Manager lets you push that change to every tenant that needs it without logging into each one. Our guide to the six layers of TDR for Microsoft 365 covers where RMM and endpoint signals fit in that picture.

6. AI agents are the newest identities in your customers' tenants

The report also devoted an entire chapter specifically to AI agents. Microsoft has observed that 88% of enterprises are already experimenting with agents, and 82% of leaders plan broader rollouts within the next 12 to 18 months.

The attacks Microsoft sees against the agent surface are led by malicious link injection and exfiltration (52%), jailbreak and safety bypass attempts (16%), and tool and agent abuse (12%).

Microsoft frames each agent as an identity of its own and recommends taking steps to protect it. Each one should:

• Carry an auditable identity with metadata about who created it and why
• Hold only the access it needs
• Keep a valid human sponsor who is accountable for what it does

Establishing governance, visibility and data controls for AI is the third of the report's ten security priorities.

What this means for MSPs: As customers switch on Copilot and agents, non-human identities multiply inside tenants the MSP is accountable for, with permissions nobody reviews. Copilot readiness matters a great deal in this landscape. inforcer’s Copilot Readiness Assessments allow MSPs to audit each tenant's configuration across Microsoft 365 adoption, security posture, data governance and technical readiness, so that gaps can be found and fixed before agents inherit them.

Six key findings from Microsoft’s 2026 Digital Defense Report at a glance

Sources:

• Microsoft Digital Defense Report 2026 (Microsoft Security Insider)

What should MSPs change first?

If the report has one instruction for defenders, it is to stop treating alerts as independent events. Cross-signal correlation is the fifth of Microsoft's ten security priorities, and the report calls signal cross-correlation "a decisive variable": attack patterns that no single data source reveals become visible when endpoint, identity, cloud, application and email telemetry are read together.

Every finding above supports this course of action. The Storm-2885 intrusion described in finding 3 was only distinguishable from normal administration "with careful correlation." An unsanctioned RMM agent looks routine on the endpoint and only becomes an incident when it's connected to the token theft that followed. A fraudulent Teams call leaves no trace until the command it persuaded someone to run shows up somewhere else.

Problems like this are beyond addressing with the tools MSPs used years ago, like identity-only security and manual alert triage. Our response was to build a security solution from the ground up that used agentic AI to defend tenants from threats that use the same kind of technology. That solution is inforcer TDR, which delivers:

• Correlation across the whole Microsoft 365 estate. Signals from every layer of each tenant are read together to separate genuine threats from isolated events, with results for every tenant you manage in a single view.
• Containment at machine speed. Confirmed high-risk threats are contained automatically within the rules of engagement your MSP sets, with an average containment time under 60 seconds.
• Prevention built into response. Every incident names the control that would likely have prevented it, ready to push to every tenant through 365 Manager.
• Reporting your customers can read. Built-in reports show what was caught, what was stopped and what was changed to harden the tenant.

See how inforcer TDR contains threats to your Microsoft 365 tenants in under 60 seconds:

Scope & Limitation Statement

This article summarizes selected findings from the Microsoft Digital Defense Report 2026 (published October 1, 2026, covering July 2025 to June 2026) and interprets what they mean for MSPs managing Microsoft 365 tenants. The report does not contain findings specific to MSPs or SMBs; the implications drawn here are our analysis. All statistics are Microsoft's and come from Microsoft telemetry and incident response data, not from the whole threat landscape, and several (such as the share of AiTM and token theft attacks) describe a trend from a small base. Descriptions of inforcer TDR and 365 Manager reflect the products as of October 2026.

FAQs

What is the Microsoft Digital Defense Report?

The Microsoft Digital Defense Report is Microsoft's annual analysis of the global threat landscape, drawing on its own security telemetry, incident response engagements and threat intelligence. The 2026 edition was published on October 1, 2026, covers July 2025 through June 2026, and is based on more than 165 trillion security signals processed each day.

What are the key findings of the 2026 Microsoft Digital Defense Report?

AI now directs attacks and can reduce attack chains from days to minutes. Password attacks fell 26% while AiTM and token theft more than doubled. Teams vishing rose 502%, ClickFix hit 1.1 million devices, unsanctioned RMM agents now mark most human-operated intrusions, and a 2020 CVE still leads the exploit table.

Does the report say cyber attacks are now fully autonomous?

No. Microsoft states that fully autonomous attacks are not yet the norm, and most complex intrusions still involve human direction. It does report AI-orchestrated activity in the wild, a 32-step lab attack chain completed without human help, and expects today's leading-edge techniques to be commoditized within a year.

What does the report recommend for Microsoft 365 identity security?

Microsoft recommends phishing-resistant MFA for everyone, device-bound passkeys for administrators, removing phishable fallback methods such as SMS codes, and blocking unmanaged device code flow. It also stresses protecting identities after initial access by detecting credential harvesting, suspicious OAuth activity and lateral movement before one account leads to broader access.

Why does the report matter for MSPs if it is written for enterprises?

The same attacks land on SMB tenants, usually without an in-house security team to absorb them. Token theft, Teams vishing, RMM abuse and unpatched CVEs are all tenant-level problems an MSP is accountable for. The report's recommendations on correlation, patch speed and agent governance apply directly to multi-tenant management.

How does inforcer TDR address the findings in the report?

inforcer TDR correlates threat signals across every layer of Microsoft 365 within each tenant, which is how it catches post-login activity that identity-only tools miss. Confirmed threats are contained automatically within rules the MSP sets, averaging under 60 seconds, and each incident names the control that would have prevented it.