Microsoft says government sector accounts for 27% of observed cyber threat activity in 2026 report
MSFT•Microsoft’s 2026 Digital Defense Report says government agencies accounted for 27% of observed cyber activity from July 2025 through June 2026, up from 17% in 2025. Phishing drove 23% of observed intrusions, while valid-account intrusions led to further credential theft in 52.2% of cases.
1. Government agencies targeted
Microsoft’s Digital Defense Report identified government agencies as the top target for observed cyber activity between July 2025 and June 2026, accounting for 27%, compared with 17% in 2025.
2. Phishing and credentials
Phishing drove 23% of observed intrusions, up from 7% in 2025. Valid-account intrusions led to additional credential theft in 52.2% of cases.
3. Detection and response
Dwell time increased across sectors, pointing to slower detection, while response improved once intrusions were identified.
