Microsoft: Governments Now the Most Impacted Sector for Cyber Threats

Why governments are in the crosshairs

Microsoft says governments are also the most frequently targeted sectors for nation-state activity. In its view, they are attractive targets because they hold sensitive information, operate essential services, and sit at the center of networks of agencies, contractors, technology providers, and critical infrastructure operators.

The report examines cyber threat trends observed between July 2025 and June 2026. Microsoft notes that dwell time, the period between an attacker gaining access and defenders detecting and stopping them, increased this year across multiple sectors. Organizations responded faster once an intrusion was identified, but detecting threats early remains a challenge.

One reason is that attackers increasingly use techniques that mimic legitimate activity. Phishing accounted for 23% of observed intrusions in 2026, up from 7% in 2025, which Microsoft says underlines the importance of compromised identities as an entry point for broader attacks.

The blog post was written by a Microsoft author together with Terrell Cox, Microsoft's Corporate Vice President and Deputy Chief Information Security Officer. A companion blog by Cox looks at what the findings mean for CISOs and security professionals.

Five priorities for governments

Microsoft argues that security in the AI era is no longer simply about preventing individual intrusions, but about ensuring institutions can operate where risks are interconnected, threats move faster, and attackers remain hidden longer. It lists five priorities.

• Prepare for a faster threat environment. Microsoft says the time from a vulnerability's discovery in the wild to active weaponization can be well below 24 hours. The number of publicly disclosed vulnerabilities (CVEs) is projected to reach a record 72,000 in 2026. Governments need clear responsibilities and trusted relationships in place before an incident.
• Build security into the AI ecosystem. Governments should treat AI security as a resilience challenge, promoting secure-by-design practices, testing and evaluation, stronger supply chain protections, transparency, accountability, and international cooperation. Microsoft says the aim is to integrate AI security into broader critical infrastructure protection, not to create a separate agenda.
• Plan for incidents to spread. Microsoft found that 52.2% of intrusions involving valid accounts resulted in additional credential theft. Governments should judge incidents by where they could lead, and response plans should cover suppliers, partners, and service providers.
• Enable timely, two-way public-private information sharing. Signals that look inconclusive alone can reveal coordinated activity when combined across organizations. Public agencies should also return actionable intelligence, guidance, and warnings.
• Prepare essential services to operate through disruption. This covers transportation, communications, schools, universities, and critical infrastructure operators.

Information sharing and exercises

On information sharing, Microsoft says policymakers can help through protections for good-faith sharing, common anonymization standards, and investment in shared threat intelligence and detection capabilities. Sharing should also lead to investigations, disruption efforts, and accountability for those behind serious intrusions.

For essential services, the company says planning documents alone are not enough. It recommends regular tabletop exercises that bring together policymakers, operational leaders, law enforcement, critical infrastructure operators, and private-sector partners. Microsoft points to its Advancing Regional Cybersecurity (ARC) program, most recently in Kenya, as an example of scenario-based exercises and cross-sector collaboration. It also suggests shared-service approaches to extend security and response capabilities to local governments and public institutions that cannot build them alone.

What it means

Microsoft's message is that resilience is no longer only about recovering from an attack. Government leaders, it says, should know which services are most critical, which identities, systems, suppliers, and infrastructure support them, and how incidents will be escalated. According to Microsoft, the governments best prepared will be those that can contain harm, adapt quickly, and keep delivering critical services when citizens need them the most.