What happened

Microsoft’s report covers July 2025–June 2026 and describes AI-assisted acceleration, identity compromise, and interconnected operational risk.

Why it matters

Response authority and continuity planning matter when the window for action narrows.

Key numbers & facts

  • Government accounted for 27% of observed threat activity, versus 17% previously.

Practical implications

  • Exercise incident roles, supplier escalation, and essential-service recovery before a disruption.

Likely future impact

Analysis, not a confirmed outcome.

  • Resilience planning could become a more regular executive responsibility.

Evidence

  • Microsoft, published 2026-10-08; direct source linked below.

What remains uncertain

  • Figures describe Microsoft’s observations, not a census of every cyberattack.