On October 23, Microsoft Vietnam presented findings from the Microsoft Digital Defense Report 2026. The report is based on data about cyber threat activity worldwide from July 2025 to June 2026.
The report says artificial intelligence is significantly changing the speed of cyberattacks, while digital identity remains a leading target for cybercriminals.
Vietnam ranked 20th worldwide for the impact of cyber threats
In the first half of 2026, Vietnam ranked seventh in the Asia-Pacific region and 20th worldwide among countries where customers were most frequently affected by cyber threat activity.
Phan Hong Son, Microsoft Vietnam's technology lead, said Southeast Asia is drawing more attention from cybercriminals. He attributed this to the region's rapid digital transformation while IT infrastructure in many areas remains incomplete. The expansion of online services also creates more points that attackers can exploit.
Worldwide, government agencies and public services were the most affected group, accounting for 27% of all cyber threat activity observed by Microsoft, up from 17% the previous year.
This group is also frequently targeted in state-linked attack campaigns because it holds large amounts of sensitive data and operates essential services.
Microsoft also found that AI is accelerating the exploitation of security vulnerabilities.
The median time between a vulnerability being observed in the wild and its exploitation fell below 24 hours. Many organizations, however, still need 30 to 60 days to fix critical vulnerabilities.
Phan Hong Son said about 40,000 vulnerabilities were recorded in all of 2025, while the number recorded in just the first six months of 2026 was nearly equal to the total for the previous year.
He said that detecting a vulnerability and building an exploitation tool used to take weeks. With AI, these steps have become much faster, and some operations can be automated within minutes.
More than 73% of initial intrusion attempts involve people and digital identities
According to the report, 73.3% of initial intrusion attempts involved user behavior, valid accounts or some form of fraud.
Phishing, or fraud aimed at stealing information, accounted for 23% of observed cases, up from 7% the previous year.
In 30% of initial intrusions, a user acted at an attacker's request, while 20% involved a valid account.
Among intrusions using valid accounts, 52.2% led to the theft of additional credentials, allowing attackers to expand their reach.
Phan Hong Son said this trend is driven in part by the fact that stealing an account is usually much easier than bypassing complex technical security systems.
"Once attackers have a valid identity or account, they can walk through the front door into the system without breaking it down," he said.
Attackers can also use AI to imitate the account owner's normal behavior, such as logging in at familiar times or carrying out everyday activities. This makes anomalies harder to detect.
Microsoft recommends that organizations prioritize identity protection through multifactor authentication, access controls and strict management of AI systems and AI agents.
As AI agents receive more access to data and are given tasks to perform on behalf of people, companies need to control their permissions so the tools do not become a new security weakness.
Phan Hong Son said organizations should use AI to speed up defense, protect the AI systems they operate and regularly test their information security.
Sources: Dân Trí
