Microsoft warns AI is deepening cyber threat links

Microsoft has released its 2026 Digital Defence Report, which says cyber threats are becoming more interconnected across enterprise systems.

The findings describe a security environment in which threat activity now spans infrastructure, identities, applications, cloud environments, and software supply chains. Signals that appear incomplete in one part of an organisation can become clearer when assessed alongside activity elsewhere.

According to the report, artificial intelligence is now appearing across several stages of cyber attacks, including reconnaissance, social engineering, malware and exploit development, and post-compromise activity. Much of that use remains concentrated in specific parts of existing attack workflows rather than replacing established methods altogether.

AI can increase the speed and scale of attacks and make them easier to tailor. But the main targets and pathways remain familiar, with people, identities, exposed systems, and trusted access still central to the threat activity Microsoft tracks.

AI inside organisations

A major theme in the report is the growing role of AI systems and agents inside businesses. These agents can interact with enterprise data, applications, APIs, and tools, often with varying levels of access and autonomy depending on how organisations deploy them.

That broader access means security teams need to assess AI as part of a larger operational system rather than as a standalone model. The security of an AI deployment depends not only on the model itself, but also on the data it can reach, the tools it can use, the identities and permissions attached to it, and the surrounding infrastructure and services.

The report examines issues including agent identity, access controls, authentication between agents, attribution, and the ability to revoke access. It also covers prompt injection, memory, models and data, agent behaviour, and the integrity of the software and services around AI systems.

Microsoft frames those risks as an extension of longstanding security disciplines rather than a break from them. Identity and authorisation, data protection, least privilege, monitoring, testing, and secure software development remain relevant even as AI brings them into more connected workflows.

Race over flaws

Another focus is the effect of AI on vulnerability discovery. Advances in AI-based code analysis are making it easier to examine software and identify weaknesses earlier, giving defenders a better chance to strengthen software before flaws are exploited.

At the same time, the report warns that the same advances could help threat actors improve vulnerability discovery and exploit development. It describes this as an area to watch closely as AI tools on both sides continue to develop.

The shift is presented as a dual-use problem. Defenders may gain more efficient ways to identify and fix weaknesses, while attackers may gain new methods to find them faster.

Connecting signals

Microsoft also uses the report to argue that defence increasingly depends on bringing together fragmented information from different parts of an organisation. Security teams often work with inputs from endpoints, identities, cloud environments, applications, email, networks, and threat intelligence, and those signals become more useful when viewed together.

Activity that crosses multiple systems may leave a pattern that no single source reveals on its own. In that environment, the ability to connect events across systems becomes central to understanding attacks and deciding where to focus attention.

The report extends that argument beyond individual companies, saying trusted intelligence sharing across organisations and public-private partnerships can reveal activity that no single participant can see alone.

It adds that AI may help by automating established techniques and repeatable tasks, including the process of bringing together relevant information. That could give experienced defenders more time for deeper investigation.

Still, the report draws a distinction between what can be automated and what still requires human judgment. Connecting known information and running established techniques can increasingly be handled by automation, while identifying an undocumented attack path or understanding how apparently separate weaknesses fit together still benefits from experienced operators.

The findings depict a threat landscape shaped less by entirely new forms of attack than by tighter links between systems, identities, software, and people. That broader view is becoming more important for security teams responsible for understanding and protecting increasingly connected environments.