Security teams at UK firms are being asked to move faster against a longer list of flaws, while the day-to-day failures attackers still use have not gone away. Microsoft's 2026 Digital Defense Report describes both sides of that problem: a heavier public vulnerability workload, and attackers using AI in parts of the attack, alongside the old routes of a stolen password or an over-privileged account.
The report is a vendor's view of the threat landscape, not an audit of any one business. It is still a clear brief for the work that cannot wait for a new platform. Know what is exposed to the internet. Patch what would hurt if it were abused. Make a stolen password less useful.
A heavier vulnerability year
Microsoft's 2026 Digital Defense Report says nearly 40,000 Common Vulnerabilities and Exposures were published in the first half of 2026, putting the year on track for a much higher total. The report also describes AI being used across parts of the attack chain, including reconnaissance, phishing, vulnerability discovery and activity after a system has already been compromised. Microsoft's report library is where the Digital Defense series sits, and teams comparing sources can read CrowdStrike's 2026 Global Threat Report alongside it.
Volume on its own does not tell a firm which flaw to fix on Thursday. It does explain why a flat queue of "patch everything" collapses. Nearly 40,000 published CVEs in six months is more than a small IT team can assess one by one. Prioritising by exposure and by what the system does for the business is the only way the queue stays honest.
The gap between weaponisation and remediation
Microsoft describes a timing problem. The median time between discovery of a vulnerability in the wild and its weaponisation has fallen below 24 hours. Remediation of critical vulnerabilities that are exposed externally can take 30 to 60 days. That gap is where incidents fit. A flaw can be usable by an attacker while the organisation is still checking impact, testing the update, booking maintenance and rolling the patch out.
Closing the whole gap to under a day is not realistic for every system. Shortening it for the systems that face the internet is. An accurate inventory of those assets comes first. A server nobody remembers cannot be patched on a timetable. A test environment that matches production well enough to try the update comes next. A maintenance window that actually happens comes after that. The report's figures are medians and ranges, not a deadline written into a contract, but they are a reason to stop treating critical external patching as a quarterly tidy-up.
Familiar weaknesses still open the door
AI is not the only factor Microsoft emphasises. Attackers continue to exploit weaknesses that security teams have been naming for years: compromised accounts, excessive permissions, exposed services, and software or tools that the organisation already trusts. In the data the report cites, user execution accounted for 30% of observed initial access, and valid accounts accounted for another 20%. Someone running something they were persuaded to run, or someone signing in with a real password, is still how a large share of intrusions start.
That is a useful correction to a tooling conversation that only talks about novel attacks. Multifactor authentication, fewer administrator accounts, and a habit of asking why a service is reachable from the internet will still reduce real incidents in 2026. A phishing message drafted with a model is still phishing. The control is the account it is trying to steal, and what that account is allowed to do afterwards.
- List internet-facing systems, including the ones a project stood up and forgot.
- Rank vulnerabilities by exposure and by business impact, not by the raw count of CVEs.
- Require multifactor authentication, and remove standing administrator rights that nobody reviews.
- Join the signals you already have: endpoints, cloud, identity, email and the applications staff use.
Use defensive automation with a person on the escalation
AI can help defenders sort alerts, spot patterns and automate parts of incident response. Those tools need the same discipline as any other agent. A security automation with broad permissions can disable the wrong account, close a port the business needs, or bury a real alert under a new pile of generated ones. The aim is not more alerts, and it is not to apply every patch in one window. It is to reduce the exposure that matters and to respond before an attacker moves further in.
Clear permissions and a human escalation path belong in the design. If the automation cannot explain what it changed, it is not ready for production. The same pattern shows up when business agents, rather than security tools, are given tools and identities. The security risks of AI agents are the other side of this report: attackers speed up, and a helpful internal agent can become another identity to abuse.
Speed up the work you already know
Microsoft's report is an argument for faster basic defence, not for a rip-and-replace of the security stack. Inventory, identity, patching of what is exposed, and a joined-up view of alerts are the levers a UK firm can pull without waiting for the next product launch. Maintenance and support is where patching and platform updates actually happen after a site or an application is live. Cloud architecture decides which services are reachable, and who can change that.
Web Works Rise is a UK-led team in Birmingham, with delivery from a development hub in Tunisia. If a public site or a business application needs a clearer picture of what is exposed, and a routine for updates that does not wait two months, talk to the team. The report's timetable is already shorter than a leisurely maintenance cycle.