10 essential insights from the Microsoft Digital Defense Report 2023

As a company committed to making the world a safer place, Microsoft has invested heavily in security research, innovation, and the global security community. We have access to a diverse range of security data which puts us in a unique position to understand the state of cybersecurity and to identify indicators that can help predict the next moves of attackers.

As part of our longstanding commitment to create a safer world, Microsoft’s investments in security research, innovation, and the global security community include:

The vast majority of successful cyberattacks could be thwarted by implementing a few fundamental security hygiene practices. Using the hyper-scale cloud makes it easier to implement them by either enabling them by default or abstracting the need for customers to implement them.

Microsoft Entra data reveals a more than tenfold increase in attempted password attacks when compared with the same period from a year ago. One way to deter would-be attackers is to use non-phishable credentials such as Windows Hello for Business or FIDO keys.

Threat actors are adapting their social engineering techniques and use of technology to carry out more sophisticated and costly BEC attacks. Microsoft’s Digital Crimes Unit believes increased intelligence sharing across the public and private sectors will enable a faster and more impactful response to BEC.

Blizzard actor category

Russian state actors expanded their scope of activity beyond Ukraine to target Kyiv’s allies, principally NATO members.

Typhoon actor category

China’s expanded and sophisticated activities reflect its dual pursuits of global influence and intelligence collection. Its targets include US defense and critical infrastructure, South China Sea nations, and Belt and Road Initiative partners.

Sandstorm actor category

Iran has expanded its cyber activities to Africa, Latin America, and Asia. Leaning heavily into influence operations, it has pushed narratives that seek to foment Shi’ite unrest in Gulf Arab countries and counter the normalization of Arab-Israeli ties.

Sleet actor category

North Korea has increased the sophistication of its cyber operations in the last year, especially in cryptocurrency theft and supply chain attacks.

Attackers have increasingly targeted the highly vulnerability of information technology and operational technology (IT-OT), which can be difficult to defend. For example, of the 78% of internet of things (IoT) devices with known vulnerabilities on customer networks, 46% cannot be patched. A robust OT patch management system is therefore an essential component of cybersecurity strategy, while network monitoring in OT environments may help detect malicious activity.

AI can enhance cybersecurity by automating and augmenting cybersecurity tasks, enabling defenders to detect hidden patterns and behaviors. LLMs can contribute to threat intelligence; incident response and recovery; monitoring and detection; testing and validation; education; and security, governance, risk and compliance.

Microsoft’s researchers and applied scientists are exploring many scenarios for LLM application in cyber defense, such as:

As cyberthreats evolve, public-private collaboration will be key to improve collective knowledge, drive resilience, and inform mitigation guidance across the security ecosystem. For example, this year, Microsoft, Fortra LLC, and Health-ISAC worked together to reduce cybercriminal infrastructure for the illicit use of Cobalt Strike. This has resulted in a reduction of this infrastructure by 50% in the United States.