What Microsoft sees in 165 trillion security signals per day

Microsoft has published its Digital Defense Report 2026 — a comprehensive report on the current cyber threat landscape, based primarily on data from July 2025 through July 2026. The statistics Microsoft can collect thanks to the scale of its infrastructure are particularly interesting: each day, the company processes more than 165 trillion security signals, screens 5.2 billion emails, and analyzes around 31 million identity risk detections.

Without trying to summarize the entire report (the full document covers dozens of different topics), the overall picture is well captured by four figures:

5.3 hours — the median time from the launch of an internet-exposed container to the first exploitation attempt.

This is one example of a broader trend: according to Microsoft, the median time from a vulnerability being discovered in the wild to the appearance of an exploit is less than a day, while remediating critical external vulnerabilities in organizations can take 30–60 days. In other words, the window between an attack opportunity emerging and attackers taking action is measured in hours, while vulnerability remediation can still take weeks.

In 52.2% of intrusions, which began with the compromise of a valid user account, attackers immediately harvested additional credentials once inside.

Microsoft also highlights the growing role of attacks against identity and access management systems: attackers are increasingly exploiting trusted relationships instead of directly compromising systems. The trend is especially pronounced in critical infrastructure: abuse of cloud accounts was present in 78% of the observed attack techniques targeting such environments.

On 1.1 million devices over several months, Microsoft observed the execution of commands that users were prompted to run as part of ClickFix attacks.

Over the course of a year, Microsoft also identified more than 145 million QR-code phishing attacks. What stands out here is not the novelty of the technique but its industrial scale: attackers are using social engineering on a massive scale to bypass technical defenses.

58% of detections among the five leading CVEs involved Zerologon — CVE-2020-1472, disclosed back in 2020.

A significant share of real-world malicious activity still involves not new techniques but long-known issues for which patches are available.

_Together, these four figures paint a coherent picture. Attacks are becoming faster and easier to scale in the age of AI, but attackers also do not always need to find new ways to gain access. It is enough to exploit existing trusted relationships, trick users into taking the desired actions, and look for targets that have left known vulnerabilities unremediated for years.

Under these conditions, the critical factor is how much time passes between a problem emerging and its detection, remediation, and containment of its potential impact._