Vietnam among countries frequently targeted by cyber threats

Vietnam ranked seventh in the Asia-Pacific region and 20th globally for the frequency with which Microsoft customers were affected by cyber threat activity during the first half of 2026, according to the company's latest cybersecurity findings.

Microsoft Vietnam released the findings at an October 23 press conference presenting its Microsoft Digital Defense Report 2026, which examines cyber threat activity recorded worldwide between July 2025 and June 2026.

The report identifies three major shifts reshaping the cybersecurity landscape globally and in Vietnam.

Artificial intelligence is accelerating both cyberattacks and defensive capabilities. Digital identities remain a primary entry point for attackers, while the consequences of cyber incidents are increasingly spreading beyond their initial victims because of growing interconnections between organizations, systems and digital supply chains.

Phan Hong Son, Chief Technology Officer of Microsoft Vietnam, said cybersecurity has entered a new era driven by AI, in which attacks can unfold at machine speed and the effects of a single incident can spread across entire digital ecosystems.

He emphasized that organizations must move beyond focusing exclusively on preventing every possible attack.

Instead, they need to improve early detection, accelerate incident response and strengthen their ability to recover and maintain operations when breaches occur.

"With Vietnam among the countries significantly affected by cyber threat activity, organizations need to act now, both by protecting AI as part of their digital ecosystem and by harnessing AI itself to strengthen their defenses," Son said.

Digital identities account for more than 73% of initial intrusion attempts

Microsoft's research indicates that digital identities have become one of the most important targets in modern cyberattacks.

According to the report, 73.3% of initial intrusion attempts involve the exploitation of user behavior, legitimate accounts, social engineering or phishing.

Rather than relying solely on sophisticated technical exploits, attackers are increasingly manipulating users or abusing valid credentials to gain access to corporate networks and systems.

Phishing accounted for 23% of observed attacks over the past year, a sharp increase from 7% in the previous year.

The findings also show that attackers are becoming more effective at concealing malicious activity by imitating legitimate user behavior.

As a result, attacker dwell time, the period between an initial intrusion and its detection, has increased across multiple sectors.

Microsoft's data shows that actions taken by users in response to attackers' instructions accounted for 30% of recorded initial intrusions.

The use of legitimate accounts contributed another 20%.

More concerningly, 52.2% of intrusions involving legitimate accounts subsequently led to additional credential theft, allowing attackers to expand their access into other systems.

These findings highlight how compromised identities can become a gateway to broader breaches, particularly when stolen credentials provide access to interconnected applications, infrastructure and organizational resources.

AI reduces vulnerability exploitation time to less than 24 hours

Another major finding from the Microsoft Digital Defense Report 2026 is the rapidly shrinking interval between the discovery of security vulnerabilities and their exploitation by attackers.

Microsoft reported that the average time between a vulnerability being identified in real-world conditions and its use in an attack has fallen to less than 24 hours, compared with several days previously.

The acceleration is being driven in part by AI-powered tools that can help attackers identify weaknesses, develop exploits and automate elements of their operations.

Meanwhile, many organizations still require between 30 and 60 days to remediate critical vulnerabilities.

This creates a substantial gap between the speed at which attackers can exploit weaknesses and the time defenders need to address them.

Nearly 40,000 Common Vulnerabilities and Exposures (CVEs) were disclosed during the first half of 2026 alone, according to figures cited in the report.

The growing volume of disclosed vulnerabilities, combined with faster exploitation, is placing additional pressure on security teams to prioritize threats and reduce their exposure.

Microsoft's findings suggest that traditional patching schedules and reactive security measures may no longer be sufficient against increasingly automated attacks.

Three cybersecurity priorities for the AI era

Against this evolving threat landscape, Microsoft recommends that organizations focus on three strategic priorities to strengthen their cybersecurity posture.

The first is to protect digital identities and adopt Zero Trust as a foundational security principle.

Recommended measures include phishing-resistant multifactor authentication, least-privilege access controls, privileged account management and the timely removal of permissions that are no longer required.

These controls are intended to reduce the risk of compromised credentials being used to gain unauthorized access or move between systems.

The second priority is to accelerate incident response capabilities and build digital resilience.

As cyberattacks become faster and more difficult to detect, organizations need systems and procedures that enable them to identify suspicious activity earlier, contain incidents more quickly and maintain essential operations during disruptions.

The third priority is to treat AI security as an integral part of the broader digital ecosystem.

With AI adoption expanding across businesses and public institutions, AI-powered applications and autonomous agents are creating additional potential entry points for attackers.

Microsoft recommends extending security oversight across data, applications, application programming interfaces (APIs), tools, infrastructure, supply chains, identities and access permissions.

Organizations should also manage the autonomy granted to AI agents, establish mechanisms for revoking their access rights and address AI-specific threats such as prompt injection attacks.

Such attacks attempt to manipulate AI systems through malicious instructions embedded in content or inputs, potentially causing them to behave in unintended ways.

According to Microsoft, effective cybersecurity in the AI era requires organizations to protect the technologies they deploy while also using AI to improve threat detection, response speed and overall resilience.

For Vietnam, where Microsoft customers continue to experience substantial cyber threat activity, the findings underscore the importance of strengthening identity protection, shortening response times and integrating AI security into enterprise-wide risk management.

Van Anh