Two things landed within a fortnight of each other. Microsoft published its annual threat report, and then shipped the largest security update in its history: more than 1,400 fixes in a single release, one of them for a flaw attackers were already using. If you run IT for a UK business, the second one has a deadline this week.
The Microsoft Digital Defense Report 2026 covers threat activity from July 2025 to June 2026. It is long, and most coverage of it has been a summary of the summary.
This is the short version for organisations of 50 to 2,000 staff: what actually changed, what to do in the next seven days, and why the answer increasingly depends on whoever runs your IT. Transputec works with UK organisations on exactly that question.
The report’s uncomfortable finding is that most intrusions still begin with a person or a credential rather than a clever exploit, which means the fix is mostly unglamorous and mostly already available to you.
What Happened This Week
On 13 October Microsoft released its largest ever set of security fixes. Counts differ between trackers, which is normal, but every one of them is past 1,400. For scale, the previous record was set a month earlier at roughly 970.
One fix matters more than the rest right now. CVE-2026-96951 is a Windows Shell security feature bypass rated 8.8, and it defeats Mark of the Web, the warning Windows shows when you open a file that came from the internet. A crafted file arriving by email or chat opens without the warning that would normally make somebody hesitate.
Microsoft flagged it as already exploited when the fix shipped. The US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog the same day, with a remediation deadline of 16 October. That deadline binds US federal agencies rather than UK businesses, but it is a useful signal: CISA gives three days when it believes the risk is live.
There is a sting in the tail for anyone still running Windows 10 outside the Extended Security Updates programme. Those machines do not receive this fix at all. If that describes part of your estate, the end of support position stopped being a budgeting question this week and became an exposure.
What the Microsoft Digital Defense Report Found
Microsoft publishes the full Microsoft Digital Defense Report free, and it is worth having the real numbers rather than the recycled ones. These are the findings that change what a mid-sized organisation should do.
| Finding | Figure | Why it matters to you |
|---|---|---|
| Exposed cloud workloads under attack | 5.3 hours on average | A misconfiguration is found the same working day, not eventually |
| Intrusions involving data theft | 63% | Most incidents are now about taking data, not just disrupting you |
| Valid account intrusions leading to further credential theft | 52.2% | One stolen login is rarely the end of it |
| Email phishing attachments aimed at stealing credentials | 89 to 95% | The attachment is usually bait for a login page, not malware |
| Ransom detonations against enterprises | up 15.8% year on year | Ransomware has not peaked |
| QR code phishing detected | over 145 million | A channel most awareness training still does not cover |
The sector picture is worth a glance too. Government agencies and services were the most affected at 27% of observed activity, followed by information technology at 17% and research and academia at 14%. If you supply any of those, you are inside somebody else’s threat model whether or not you feel like a target.
One framing point from Microsoft is doing a lot of work in the report: AI is changing the physics of cybersecurity, with both sides now operating at machine speed. That is marketing language for a real thing, which is that the gap between a mistake and its exploitation keeps shrinking.
Not sure how fast your estate actually patches
Transputec runs patching, monitoring and incident response for UK organisations as part of its cyber security services. A short review will tell you how long a critical fix currently takes to reach every device you own.
Get a Strategic ConsultationIdentity Is the Control Plane
The single clearest message in the Microsoft Digital Defense Report 2026 is that identity is where the fight happens. Most intrusions start with a person or a credential rather than an exploit, and user execution and valid accounts remain the most common ways in.
That 52.2% figure deserves a second look. More than half of intrusions using a valid account went on to steal further credentials. The first login is a beachhead, not the objective, which is why detecting the second step matters as much as preventing the first.
Microsoft’s recommendation is phishing-resistant multi-factor authentication and passkeys. That wording is deliberate. Ordinary MFA, the kind that sends a code or a push notification, is bypassed routinely now, which we covered when looking at attacker-in-the-middle phishing. Having MFA switched on is no longer the same as being protected by it.
Phishing Did Not Go Away, It Changed Channel
If your awareness training still shows people a badly spelled email, it is training them for the wrong decade.
The report counts more than 145 million QR code phishing attacks detected through Defender for Office 365, and more than 46 million business contact impersonation attacks over twelve months. A QR code moves the attack onto a personal phone, outside every control you own.
Voice phishing is the part most organisations are least ready for. Microsoft found that 93% of voice phishing attempts kept the victim on the line long enough to begin social engineering. Those calls work because a phone call carries an urgency an email does not, and because almost nobody has been trained to end one.
The practical change is cheap. Add a rule that no password reset, payment change or access grant ever happens on an inbound call, and that verification always goes back through a known channel. It costs nothing and it removes the mechanism these attacks rely on.
The Speed Problem
Of all the figures in the Microsoft Digital Defense Report, 5.3 hours is the one worth putting in front of a board.
That is the average time between a cloud workload being exposed and being attacked. Not discovered eventually. Attacked, the same working day. Scanning is automated and indiscriminate, so the question is no longer whether anybody will notice your mistake.
Set that against how long a normal organisation takes to deploy a critical patch across every device, including the laptop in a drawer and the server nobody owns. For most, the honest answer is weeks. This week’s release, with more than 1,400 fixes to triage and one already being exploited, is a direct test of that gap.
You do not need to patch 1,400 things by Friday. You need to know which handful are being exploited, get those out fast, and be able to prove the rest followed. That is a process question rather than a tooling one.
Why This Points at Your IT Provider
Here is the part the other write-ups of the Microsoft Digital Defense Report have missed, and it is the part with legal weight attached.
The Cyber Security and Resilience Bill will bring medium and large managed service providers into the UK’s NIS regulations for the first time, with a 24 hour deadline for reporting significant incidents and a duty to tell affected customers afterwards. It has passed the Commons and is at Report stage in the Lords.
Read that alongside the report and the two point at the same place. Microsoft’s data says intrusions start with credentials and spread at machine speed. The Bill says the organisation holding privileged access to your systems will soon be legally accountable for how it manages and reports exactly that.
So the question to put to whoever runs your IT is no longer whether they take security seriously. It is how long a critical patch takes to reach every device, what happens in the first 24 hours of an incident, and whether they expect to be regulated. The answers are about to become checkable.
What to Do in the Next Seven Days
Short list, in order, and none of it needs a budget round.
- Confirm CVE-2026-96951 is patched across your Windows estate. It is being exploited now, and it defeats the warning your users rely on.
- Find your Windows 10 machines outside ESU. They did not get this fix and will not get the next one.
- Check your MFA method. If it is push notifications or SMS, plan the move to phishing-resistant methods rather than congratulating yourself on having MFA.
- Write the voice phishing rule. No resets, payment changes or access grants on an inbound call, ever, and verification always goes back through a known number.
- Ask your provider two questions. How long does a critical patch take to reach every device, and do you expect to be in scope of the Cyber Security and Resilience Bill?
- Look at your cloud exposure with 5.3 hours in mind rather than a quarterly review cycle.
The first two are this week. The rest are this month, which still leaves you inside Cyber Security Awareness Month with something real done rather than a poster in the kitchen.
Reading the Report Without Reading All of It
The full Microsoft Digital Defense Report 2026 runs long, and most people will not finish it. If you only take three things from it, take these.
Identity is the control plane, so spend there first. Speed is the differentiator, because 5.3 hours of exposure and a weeks-long patch cycle cannot both be acceptable. And the attack surface now includes the AI tools your staff adopted without telling anyone, which the report treats as a target in its own right rather than a footnote.
Microsoft’s own report page carries the executive summary if you want the detail without the full document.
Transputec covers the operational side of all three through its cyber security services and a 24/7 UK security operations centre, which is the part that decides whether 5.3 hours is a statistic or your Tuesday.
The Short Version
The Microsoft Digital Defense Report 2026 says most intrusions still start with a person or a credential, that exposed cloud workloads are attacked within about five hours, and that ransomware is still growing. None of that requires a new product to address.
Cyber Security Awareness Month is a reasonable prompt to act on any of this, though the calendar is not the reason. The reason is that the window between exposure and exploitation has closed to about a working day.
This week it comes with a deadline attached. More than 1,400 fixes shipped on 13 October, one of them for a flaw already in use, and machines outside Windows 10 ESU did not receive it at all. Start there, then work down the list.
If you want a straight answer about how fast your own estate patches and what happens in the first day of an incident, Transputec’s cyber security services team can walk through it with you.
FAQs
What is the Microsoft Digital Defense Report?
It is Microsoft’s annual analysis of the threats it observes across its own services and customer base. The 2026 edition covers activity from July 2025 to June 2026 and draws on Microsoft’s visibility across identity, email, endpoint and cloud. Microsoft publishes it free alongside an executive summary for people who want the findings without the full document.
What is the most important finding for a mid-sized UK business?
The Microsoft Digital Defense Report finds that most intrusions begin with a person or a credential rather than a technical exploit, and that exposed cloud workloads are attacked within about 5.3 hours on average. Together those say the highest-value work is identity hardening and speed of response, not buying another detection product. More than half of intrusions using a valid account went on to steal further credentials.
What is CVE-2026-96951 and do we need to act?
It is a Windows Shell security feature bypass, rated 8.8, that defeats the Mark of the Web warning shown when a file arrives from the internet. Microsoft confirmed it was already being exploited when the fix shipped on 13 October, and CISA added it to its Known Exploited Vulnerabilities catalog with a 16 October remediation date. Patch it. Windows 10 machines outside Extended Security Updates do not receive the fix.
Is ordinary MFA still good enough?
Not on its own. Microsoft’s guidance in the report is specifically phishing-resistant multi-factor authentication and passkeys, which is a deliberate distinction. Push notifications and SMS codes are routinely defeated by attacker-in-the-middle phishing, where the attacker relays your login in real time and steals the session rather than the password. Having MFA enabled is no longer the same as being protected by it.
How does this relate to the Cyber Security and Resilience Bill?
They point at the same place from different directions. Microsoft’s data shows intrusions spreading at machine speed through credentials. The Bill will make medium and large managed service providers accountable under the UK’s NIS regulations, with a 24 hour reporting deadline and a duty to notify affected customers. If somebody else runs your IT, their patching speed and incident process are about to become regulated rather than discretionary. Transputec covers both sides of that question, since the Microsoft Digital Defense Report describes the threat and the Bill describes the accountability.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
