By Sinisa Markovic
Publication Date: 2026-10-02 12:47:00
Threat actors are using AI to find bugs, build malware and run intrusions faster than defenders can keep up.
Microsoft’s 2026 Digital Defense Report, covering July 2025 to June 2026, describes a near-term period in which attackers collect the benefits of AI first and defenders have to move quickly to close the gap. “AI is changing the physics of cybersecurity,” the company said.
Bugs found faster than they get fixed
Vulnerability discovery and weaponization once required human experts. In a lot of cases, the job comes down to “simply writing a prompt,” Microsoft noted.
The median time from vulnerability discovery in the wild to weaponization has dropped to well below 24 hours. The number of CVEs tracked for 2026 is on track for a record of an estimated 72,000.
Remediation moves slower than discovery, so Microsoft expects a multi-year period in which known, unpatched vulnerabilities pile up. Well-funded attackers may be able to stockpile zero-days found this…
