Reaction to Microsoft's Digital Defence Report

My (George Hewitt, Principal Solutions Architect) key takeaway is that, despite the chatter about AI-driven risks in the press, most attacks still target people and their credentials (phishing, social engineering and the like) to get hold of a real user’s login details. That’s been the case for several years now.

That said, AI is reshaping the risks by making it easier for attackers to exploit basic weaknesses faster and at scale. In Microsoft’s own incident response cases, exploitation of public-facing applications rose from 15% to 24% of initial access over the past year, edging ahead of phishing as the most common way in. And we need to be aware of the risks autonomous agents pose, both as a route to data loss and as another set of identities to secure.

The 'Ten Security Priorities' in the Exec Summary document sets out an approach for a mature organisation but in many ways, the basics we have been talking about for years have not changed:

Identity is the thing to defend first – That means phishing-resistant MFA (passkeys, not just SMS codes or app approvals), minimal standing privilege, and governing service accounts and AI agents as carefully as people. Microsoft’s Zero Trust workshop is a good platform for this; come and chat to me if you’re interested.

Make sure you patch all the things, quickly. By and large, patches are available but it’s the speed of applying them that now matters. Especially if it’s internet facing.

Make cyber risk a senior-level topic, with right-sized approaches to threat management, monitoring, data protection and recovery, and a few simple measures the board sees regularly (e.g. patch latency and privileged account count).

Read and download Microsoft's Digital Defence Report, Decoding Emergence, here.

If you have any questions about anything in the report, or it's sparked an idea for something in your business, get in touch with George at george.hewitt@waterstons.com