Microsoft: AI Favors Attackers for Now — From Vulnerability to Exploit in Under 24 Hours

On October 2, Microsoft published its 2026 Digital Defense Report. Its central message is clear: in the near term, AI helps attackers more than defenders, and defenders need to close that gap quickly.

Key findings

• The median time from a vulnerability being discovered in the wild to it being weaponized has fallen well below 24 hours.
• By contrast, enterprises typically take 30–60 days to fix critical externally exposed vulnerabilities, leaving attackers a wide window.
• Finding bugs and writing exploits used to require human experts; according to the report, in many cases the job now comes down to 'simply writing a prompt.'
• The number of CVEs tracked for 2026 is on track for a record of about 72,000.
• Phishing was the entry point in 23% of investigated intrusions.
• The report notes that some frontier models were able to run a 32-step attack chain on their own and take over an entire domain in an undefended test environment.

What it means for enterprises

When the patch cycle is measured in weeks and the attack cycle in hours, the classic 'find the flaw, then fix it' approach is no longer enough on its own. Defenders need to use AI too, but in a controlled and auditable way.

Four priorities

• Shorten patch time: set up a separate, fast patch process for critical internet-facing systems.
• Use AI in defense: apply AI-assisted tools to log analysis, vulnerability prioritization and incident response.
• Protect the AI tools themselves: control what data goes to the AI tools employees use and what each agent can access.
• Identity and phishing: strengthen multi-factor authentication and phishing awareness.

The remot angle

As companies use AI in defense, AI calls themselves become a security surface. remot routes those calls through a single point, masking sensitive data, limiting which team may use which model and logging every call. That way AI can be put to work in defense quickly without creating a new data-leak risk.