Governments now the most targeted sector as attackers stay hidden longer, Microsoft report finds

Microsoft's latest Digital Defense Report, which covers threat trends between July 2025 and June 2026, names government agencies and services as the sector most affected by cyber threats. They accounted for 27% of observed activity, up from 17% the year before. Governments are also the most frequently targeted sector for nation-state activity. Microsoft says they are attractive because they hold sensitive information, run essential services, and sit at the centre of networks of agencies, contractors, technology providers and critical infrastructure operators.

The report also shows that dwell time, the period between an attacker gaining access and defenders detecting and stopping them, increased across multiple sectors. Organisations responded faster once an intrusion was identified, but spotting threats early remains difficult because attackers use techniques that mimic legitimate activity. Phishing accounted for 23% of observed intrusions in 2026, up from 7% in 2025, which underlines how compromised identities remain a key way in.

Speed is another concern. Microsoft says AI is compressing the window for action, and the time from a vulnerability being discovered in the wild to active weaponisation can be well below 24 hours. The number of publicly disclosed vulnerabilities (CVEs) is projected to reach a record 72,000 in 2026. Microsoft argues that security is no longer only about stopping individual intrusions, but about keeping institutions running when risks are interconnected, and it stresses the importance of public-private partnerships.