--- title: Microsoft's AI Risk Report Misses Key Detail | daily.dev description: Microsoft's '2026 Digital Defense Report' highlights government agencies as top targets for AI-driven cyberattacks, but omits its own role in that exposure,... canonical: https://daily.dev/posts/microsoft-s-ai-risk-report-misses-key-detail-cxgcwkqqe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft's AI Risk Report Misses Key Detail | daily.dev og:description: Microsoft's '2026 Digital Defense Report' highlights government agencies as top targets for AI-driven cyberattacks, but omits its own role in that exposure,... og:url: https://daily.dev/posts/microsoft-s-ai-risk-report-misses-key-detail-cxgcwkqqe og:image: https://api.daily.dev/og/posts/cXGCwkQQe.png og:image:alt: Microsoft's AI Risk Report Misses Key Detail og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft's AI Risk Report Misses Key Detail **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Microsoft's '2026 Digital Defense Report' highlights government agencies as top targets for AI-driven cyberattacks, but omits its own role in that exposure, Andrew Grotto argues. Microsoft holds 85% market share in US public sector productivity software and accounts for nearly 23% of known exploited vulnerabilities tracked by CISA since November 2021, far more than runner-up Cisco's 6%. The VA dropped its Data Loss Prevention program after bundling security into a Microsoft license, putting 18 million veterans' records at risk. Chinese and Russian state actors have repeatedly breached Microsoft products, including the SolarWinds attack. Microsoft's last Patch Tuesday disclosed a record 974 vulnerabilities. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of known exploited vulnerabilities (KEVs) are attributed to Microsoft products? Microsoft accounts for nearly 23% of all known exploited vulnerabilities tracked by CISA from November 2021 through October 2026, and nearly 16% of those disclosed so far in 2026 alone. The next-highest vendor, Cisco, trails far behind at about 6% total and 7% in 2026, less than half Microsoft's share. _Tracking which vendors drive the most exploited CVEs helps teams prioritize patching, a job daily.dev's security coverage supports._ ### Why did the VA discontinue its Data Loss Prevention program? The US Department of Veterans Affairs discontinued its Data Loss Prevention program in 2023 after moving to bundle security tools into a sole-source Microsoft enterprise license. The move reportedly put 18 million veterans' personal records at risk of leakage. The VA has since started seeking alternatives to Microsoft, reversing course on its reliance on a single vendor. _Vendor lock-in risks like this are exactly what IT decision-makers weigh before consolidating on one provider, a debate daily.dev tracks closely._ ### How many vulnerabilities did Microsoft disclose in its most recent Patch Tuesday update? Microsoft disclosed a record-setting 974 vulnerabilities in its most recent Patch Tuesday release, the highest count on record for the company. This surge is believed to result from Microsoft using AI to identify flaws in its own already-deployed products, though critics argue it still doesn't offset the company's broader security track record. _Keeping pace with record Patch Tuesday volumes is a recurring challenge daily.dev readers managing enterprise patching follow closely._ ## Similar posts on daily.dev - [What the 2026 Microsoft Digital Defense Report reveals about AI, identity, and the future of cybersecurity](https://daily.dev/posts/what-the-2026-microsoft-digital-defense-report-reveals-about-ai-identity-and-the-future-of-cyberse-bvckqn1gq) · SpecterOps · 0 upvotes · 0 comments - [Critical Microsoft Vulnerabilities Doubled: From Exposure to Escalation](https://daily.dev/posts/critical-microsoft-vulnerabilities-doubled-from-exposure-to-escalation-yvil6l63i) · BleepingComputer · 0 upvotes · 0 comments - [Microsoft’s new AI system finds 16 Windows flaws, including four critical RCEs](https://daily.dev/posts/microsoft-s-new-ai-system-finds-16-windows-flaws-including-four-critical-rces-llyntj9ux) · CSO Online · 1 upvotes · 0 comments - [Microsoft Warns AI Will Bring More Windows Patches and Faster Deadlines](https://daily.dev/posts/microsoft-warns-ai-will-bring-more-windows-patches-and-faster-deadlines-60t6g3q1n) · Security Boulevard · 0 upvotes · 0 comments - [U.S. Public Sector Under Siege: Threat Intelligence for Q1 2026](https://daily.dev/posts/u-s-public-sector-under-siege-threat-intelligence-for-q1-2026-8m81pzwkh) · Trend Micro · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft) [View this post on daily.dev](https://daily.dev/posts/microsoft-s-ai-risk-report-misses-key-detail-cxgcwkqqe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft's AI Risk Report Misses Key Detail","url":"https://daily.dev/posts/microsoft-s-ai-risk-report-misses-key-detail-cxgcwkqqe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-s-ai-risk-report-misses-key-detail-cxgcwkqqe"},"datePublished":"2026-11-02T15:04:00.180Z","dateModified":"2026-11-02T15:04:34.869Z","description":"Microsoft's '2026 Digital Defense Report' highlights government agencies as top targets for AI-driven cyberattacks, but omits its own role in that exposure,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e4e3d0ac58a99f843a37d154b226cebb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e4e3d0ac58a99f843a37d154b226cebb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-s-ai-risk-report-misses-key-detail-cxgcwkqqe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Microsoft's AI Risk Report Misses Key Detail"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/microsoft-s-ai-risk-report-misses-key-detail-cxgcwkqqe#faq","mainEntity":[{"@type":"Question","name":"What percentage of known exploited vulnerabilities (KEVs) are attributed to Microsoft products?","acceptedAnswer":{"@type":"Answer","text":"Microsoft accounts for nearly 23% of all known exploited vulnerabilities tracked by CISA from November 2021 through October 2026, and nearly 16% of those disclosed so far in 2026 alone. The next-highest vendor, Cisco, trails far behind at about 6% total and 7% in 2026, less than half Microsoft's share. Tracking which vendors drive the most exploited CVEs helps teams prioritize patching, a job daily.dev's security coverage supports."}},{"@type":"Question","name":"Why did the VA discontinue its Data Loss Prevention program?","acceptedAnswer":{"@type":"Answer","text":"The US Department of Veterans Affairs discontinued its Data Loss Prevention program in 2023 after moving to bundle security tools into a sole-source Microsoft enterprise license. The move reportedly put 18 million veterans' personal records at risk of leakage. The VA has since started seeking alternatives to Microsoft, reversing course on its reliance on a single vendor. Vendor lock-in risks like this are exactly what IT decision-makers weigh before consolidating on one provider, a debate daily.dev tracks closely."}},{"@type":"Question","name":"How many vulnerabilities did Microsoft disclose in its most recent Patch Tuesday update?","acceptedAnswer":{"@type":"Answer","text":"Microsoft disclosed a record-setting 974 vulnerabilities in its most recent Patch Tuesday release, the highest count on record for the company. This surge is believed to result from Microsoft using AI to identify flaws in its own already-deployed products, though critics argue it still doesn't offset the company's broader security track record. Keeping pace with record Patch Tuesday volumes is a recurring challenge daily.dev readers managing enterprise patching follow closely."}}]} ```