Most Intrusions Still Start With a Person: What Microsoft's 2026 Report Says

Every year, Microsoft's Digital Defense Report gives security teams a rare thing: a view across a very large volume of real attack telemetry, written by the people who see it. The 2026 edition carries a line that anyone responsible for human risk should pin to a wall: "Most intrusions still start with a person or a credential rather than an exploit."

That sentence is not about careless staff. It describes where attackers choose to begin, because a conversation or a sign-in is usually cheaper to attack than a hardened system. This post walks through what the report says, which figures are worth reading closely, and what a calm, proportionate response looks like.

What the report actually says about people

The Microsoft Digital Defense Report 2026 lists "people remain the main entry point" among its headline findings. It names user execution, ClickFix-style social engineering, phishing and impersonation as the common techniques. It also describes identity as the primary control plane, meaning that once an attacker holds a valid identity, the rest of the environment tends to open up.

Microsoft's own summary on the Microsoft Security Blog, published on 1 October 2026, makes the same point in softer terms: "People, identities, exposed systems, and trusted access continue to feature prominently in the threat activity Microsoft observes." It adds that security teams should keep building on fundamentals such as identity and authorisation, least privilege and monitoring.

None of this means technical flaws have stopped mattering. The report also flags open-source supply chain compromise and attacks on edge devices as emerging threats. The finding is narrower and more useful than a slogan: for the intrusions Microsoft sees, the front door is usually a person or a credential.

The figures worth reading closely

Several statistics in the report bear directly on human risk. We have kept each one to the wording Microsoft uses, because they come from different datasets and should not be stitched into a single story.

• Voice phishing: 93% of voice phishing attacks kept the victim on the line long enough to begin social engineering. Microsoft does not give a time period for this figure.
• Phishing attachments: between 89% and 95% of email phishing attachments led to a credential theft effort. Again, no time period is stated.
• QR codes: more than 145 million QR-code phishing attacks were detected between July 2025 and June 2026 by Microsoft Defender for Office 365.
• Impersonation: more than 46 million business email impersonation attacks were detected over the past 12 months.
• Identity: 52.2% of valid account intrusions involved follow-on credential theft, and Microsoft notes that one compromised identity can fuel the compromise of many more.
• Data theft: 63% of intrusions involved data theft.

A caution on reading these. The 93% figure tells you how often a call succeeded in starting a conversation. It does not tell you how often the call ended in a breach. Likewise, a "credential theft effort" is an attempt, not a confirmed loss. Treat the numbers as evidence of where attackers are putting their effort, not as success rates.

There is also encouraging news. The report says Tycoon2FA activity had fallen 95% from its November 2025 peak by June, after Microsoft acted against its infrastructure in March 2026, and that its share of CAPTCHA-gated phishing dropped from 76% to 12%. Coordinated disruption works, even if the gap it leaves tends to be filled.

Why the first conversation matters so much

Read the figures in order and a pattern appears. A person is contacted, a credential is captured, one identity opens several systems, and data leaves. Each stage depends on the one before it, which means the first link carries more weight than it first appears.

The diagram below arranges the four figures as a chain of dominoes. It is a way of seeing the pattern, not a funnel: the statistics come from different datasets, so the percentages do not describe the same group of incidents moving from stage to stage.

The gap at the right-hand end is the point. Technical controls such as phishing-resistant MFA and conditional access narrow what a stolen credential can do. A trained, confident person who knows how to pause is what stops the chain at the start, before any control has to catch it.

An illustrative example

To make this concrete, here is a deliberately generic scenario, not a specific incident. An employee receives a call from someone who says they are from IT support and need to fix a sign-in problem. The caller is calm, knows the employee's name and manager, and asks them to approve a prompt or read out a code. Because the person stays on the line, the caller can adapt to every hesitation.

That is the behaviour the 93% figure describes: the conversation itself is the attack. Nothing in an email filter, an endpoint agent or a firewall sees it. What the employee does next depends on whether they have a simple, rehearsed way to say "I will call you back on the number in the directory."

What to do about it

The report's own recommendations centre on phishing-resistant MFA, passkeys, tiered administration and strong privileged access. Alongside those, a few human-side measures are proportionate and practical:

• Agree a call-back rule. Any request involving credentials, MFA prompts, payments or remote access is verified through a separate, known channel, whoever appears to be asking.
• Make pausing normal. Tell staff, and mean it, that checking a request is expected and will never be treated as obstruction, even when the request appears to come from a senior colleague.
• Test more than email. Include voice, QR codes and messaging apps in your awareness programme, because that is where the figures show attackers working.
• Give people a fast reporting route. A one-click report button and a prompt, friendly response encourage reports even when someone has already clicked.
• Shrink the blast radius. Because one identity can open many doors, use least privilege and review MFA device changes and unusual inbox rules, as the report's identity findings suggest.

Awareness training will not prevent every incident, and no one should claim it will. What it can do is raise the number of people who notice, pause and report, and that changes how many attempts become incidents.

The bottom line

Microsoft's 2026 report does not say people are the weak point. It says people are where attackers start, which is a different claim and a more useful one. If the first move is a conversation, a prompt or a sign-in, then the best early defence is a workforce that is equipped, rehearsed and supported when it speaks up.

Sources: Microsoft Digital Defense Report 2026; Insights from the 2026 Microsoft Digital Defense Report, Microsoft Security Blog, 1 October 2026.

Phishing Tackle offers the tools businesses need to strengthen their human risk strategies, with multi-platform testing, real-time behavioural insights, and actionable data to keep your organisation ahead of modern cyber threats.

Contact us today to learn how Phishing Tackle can help safeguard your organisation from the growing array of cyber risks.