Microsoft Digital Defense Report: Government agencies become the top target of global security threats

Microsoft recently released its latest annual "Microsoft Digital Defense Report" and pointed out that "government agencies and public services" will be the most severely affected by security threats among all industries and fields in the world in 2026, with their proportion rising from 17% in 2025 to 27%, an increase of 10 percentage points; government agencies are also the most frequently targeted targets of nation-state actions.

According to Microsoft's analysis, the government not only holds sensitive information and provides services necessary for people's livelihood, but is also at the core of multi-party networks including agencies, contractors, technology service providers, and critical infrastructure operators, making it attractive to attackers.

It is worth noting that attackers are not only targeting important institutions, but also staying hidden in the system for an extended period of time. The report shows that the "dwell time" has increased in many industries and fields this year. Latency is the time between an attacker gaining access and a defender discovering and stopping the attack.

Microsoft pointed out that although organizations' response speed after discovering a breach has improved, how to detect threats early is still a challenge. Attackers increasingly gain access by imitating legitimate activities, making malicious behavior more difficult to detect. For example, phishing is heating up. Intrusions caused by phishing accounted for 23% of all observed intrusions at Microsoft in 2026, a significant increase from 7% in 2025, showing that identity theft is still an important entry point for attackers to further expand their operations.

Microsoft further found that 52.2% of breaches involving valid accounts resulted in the theft of additional credentials. In other words, once an attacker gains an initial foothold, they may quickly expand their operations to other accounts and systems. What may initially appear to be a single security incident may further evolve into ransomware, espionage, data theft, or even disruption of critical services.

As the latency of attackers increases and the proportion of phishing attacks increases, how to detect stolen identities and abnormal activities early has become an important issue for organizational defense.