Security's lopsided hourglass: why AI is helping attackers today

In its latest annual digital defense report, published on October 1, 2026, Microsoft describes a landscape in which artificial intelligence is accelerating offense far faster than defense can organize itself. The overview page on Security Insider is signed by Tanmay Ganacharya, CVP Security Research, and Wes Malaby, GM of Microsoft Security; the report is based on Microsoft's stated analysis of more than 165 trillion daily signals collected between July 2025 and June 2026. Its central thesis is blunt: AI compresses attackers' timelines, cutting the median time between the discovery of a vulnerability and its conversion into a working attack tool to under 24 hours. Organizations, by contrast, typically take 30 to 60 days to patch critical internet-facing flaws.

This asymmetry shows in how intrusion techniques are evolving. According to Mike Yeh, Microsoft's vice president and legal counsel for customer security, phishing rose from 7% of observed intrusions in 2025 to 23% in 2026, with the public sector once again the most targeted, absorbing 27% of hostile activity. The report describes a shift from assistive systems to AI models capable of directing attacks on their own: in a controlled evaluation, according to Microsoft, frontier AI systems carried out 32-stage attacks. We have not verified the details of that test — which models, under what conditions — against the full report, and without them the real significance of the result cannot be judged from the outside. Meanwhile, more traditional but amplified threats, such as ClickFix-style attacks, hit 1.1 million unique devices between February and May 2026, an eightfold increase according to Microsoft.

Geopolitically, the company's data point to the United States as the most targeted territory, with 25.5% of cases, followed by Israel and Ukraine. According to BleepingComputer, the report cites Chinese state actors using AI for vulnerability research, Russian actors deploying AI-generated tools and North Korean actors using it to build fake identities and malware: these are Microsoft's attributions, not independently verified. Then there is the chapter on AI agents, whose number is expected to reach an estimated 1.3 billion in production by 2028, and which are already showing weaknesses: according to Microsoft, in December 2025 a malicious browser extension with more than 600,000 installs reportedly harvested ChatGPT and DeepSeek chat data from around ten thousand organizations. The vulnerability count also deserves a caveat: CVE estimates are not fully consistent across Microsoft's pages, with nearly 40,000 in the first half and an annual total given sometimes as 'roughly double', sometimes as about 72,000. And these figures reflect only the proprietary telemetry of a company that, besides mapping threats, sells its own security products built on the very same technology.

If the time to weaponize a vulnerability is measured in hours and the time to close it in weeks, the problem is no longer purely technological but organizational. Perhaps automation is not creating new vulnerabilities: it is measuring, with new precision, the slowness of the structures that are supposed to respond.

— Olya