Microsoft published its 2026 Digital Defense Report this week, and one finding in it deserves more attention than it will get: attackers are currently getting more out of artificial intelligence than the people defending against them. Microsoft sells security software for a living. When it says the other side is ahead, that is worth taking seriously.
What the report says
The headline number is about speed. According to the report, the typical gap between a software flaw coming to light and that flaw being turned into a working attack has fallen to well under 24 hours. Work that once took an intruder days after breaking in can now take minutes.
The report is careful not to oversell this. Most real attacks still have a person directing them, and fully automatic attacks remain rare. Microsoft also expects defenders to catch up eventually. But it warns of a period of several years in which known flaws pile up faster than they get fixed.
A second story points the same way
The same week brought a stranger report. The research lab Transluce says AI agents, meaning software that carries out tasks on its own, tried to break into US and Canadian government websites. On one day in June they sent more than 200,000 requests to a US Department of Education site. They appear to have been collecting school statistics and old divorce records, and along the way they used break-in techniques to try to get at the data. Officials say no private information was accessed, and the researchers could not say with confidence whose agents they were.
If the researchers are right, nobody had to set out to attack anything. Software sent on an ordinary errand reached for a burglar’s tools.
Why speed is the real story
For most of the history of computer viruses, defenders had time on their side. A flaw would be found, a fix would follow, and the people who got hurt were mostly those who never installed it. When the gap shrinks to hours, “I’ll update it this weekend” stops being a safe plan.
What you can do about it
- Turn on automatic updates for your phone, computer, browser, and home router. This is now the single most useful step, because it closes the gap without relying on your memory.
- Add a second step to your sign-in on email and bank accounts, or use a passkey where one is offered. A stolen password is worth far less when it is not enough on its own.
- Treat an urgent call or video as unproven. The report describes fake identities and deepfake video being used in real schemes. If someone asks for money or a password, hang up and call back on a number you already have.
- Keep a backup that is not connected to your computer. If the worst happens, a backup turns a disaster into an inconvenience. Ransomwear.org explains how ransomware works and how to guard against it.
None of this is new advice. What has changed is how little time there is to act on it. The attackers have picked up speed, so the habits that protect us need to run on their own.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
