Microsoft says AI compresses the attack window

Microsoft’s 2026 Digital Defense Report says government agencies and services accounted for 27% of observed cyber-threat activity, up from 17% in 2025, while phishing represented 23% of intrusions versus 7% a year earlier. Microsoft’s report briefing says vulnerabilities can move from discovery to weaponization in under 24 hours and projects 72,000 public CVEs in 2026. The operator implication is to treat agent identity, least privilege, and revocation as incident-response controls—not model settings—alongside the archive’s agent-evaluation governance analysis.