Microsoft’s latest Digital Defense Report, published in October 2026, makes a point worth taking seriously even if you skip the rest of the report: identity compromise, not malware or firewall breaches, is now the primary way attackers get into a business’s systems. If your business has put more effort into firewalls and antivirus than into login security, this is the report telling you where the actual risk has moved.
What the report actually found
Microsoft’s 2026 Digital Defense Report found that cloud-identity abuse — attackers getting in by compromising a legitimate login rather than exploiting a technical vulnerability — was behind 78% of observed attacks on critical infrastructure. That’s a striking number, and it reflects a broader shift: as businesses have gotten better at patching software and securing networks, attackers have shifted toward the comparatively easier target of stealing or guessing someone’s login credentials, or tricking them into approving a fraudulent sign-in.
Why this matters more for small business than it might seem
It’s tempting to read “critical infrastructure” and assume this is about large utilities and government systems, not an ordinary small business. But the underlying mechanism — a compromised login being the actual way in — applies just as much to a 12-person accounting firm’s cloud email as it does to a power grid operator’s systems. If anything, smaller businesses are often more exposed on exactly this point, because enabling multi-factor authentication and conditional access policies properly takes a deliberate decision and a bit of setup effort, and it’s an easy thing to leave on the to-do list indefinitely when there’s no dedicated IT security person pushing it forward.
A firewall and antivirus software are still worth having, but neither of them helps if an attacker simply logs in with a stolen or guessed password — there’s no “breach” to detect in the traditional sense, because from the system’s point of view, it’s just a login.
What to actually prioritise
1. Confirm multi-factor authentication is switched on for every account with access to email, file storage, or financial systems — not just for a few “important” accounts, since attackers typically go after whichever account is easiest, not whichever one looks most senior. 2. If your business uses Microsoft 365 or Google Workspace, look at conditional access or equivalent sign-in policies — these can block or flag logins from unexpected locations or devices, which is exactly the kind of signal that catches credential-based attacks that MFA alone sometimes misses. 3. Treat “we have antivirus and a firewall” as necessary but no longer sufficient — identity security deserves equal billing in how your business thinks about protection, not a lower priority than the technical controls.
If you’re not confident your current login security actually matches where the real risk now sits, that’s a conversation worth having before an incident forces it. Our cybersecurity team can review your current identity and access setup and tell you plainly where the gaps are.
Microsoft’s full 2026 Digital Defense Report is published at microsoft.com/mddr.
The attacker’s easiest way in changed. It’s worth making sure your defences changed with it.