'AI helps hackers exploit vulnerabilities in under a day'

According to the Digital Defense Report 2026, published by Microsoft on October 23, Vietnam ranked 7th in the Asia-Pacific region and 20th globally in terms of frequency affected by cyber threat activities in the first half of 2026.

The American technology company also assessed that AI is speeding up both offensive and defensive activities in cybersecurity. On the attack side, the time between detecting and exploiting AI vulnerabilities is shortening significantly.

Mr. Phan Hong Son, Chief Technology Officer of Microsoft Vietnam, emphasized that "the basic attack goals and methods remain unchanged", with steps such as searching for vulnerabilities, building tools, executing commands and penetrating the system, but AI is helping attackers perform faster and on a larger scale.

Microsoft statistics show that the average time from the time a vulnerability is actually discovered until it is turned into an attack tool is now reduced to less than 24 hours. Because it is a median statistic, the actual time in many situations may be longer or shorter. According to Mr. Son, there are vulnerabilities where crooks write code to attack using automatic tools in just a few minutes, at most a few days. Whereas in the past, this often had to be calculated by week or month.

Meanwhile, the development of AI is also said to be the reason for expanding the ability to find vulnerabilities. Statistics for the first half of 2026, after many AI tools were used in cybersecurity, the number of announced vulnerabilities reached 40,000, equal to the whole of 2025.

Microsoft also assesses that AI is expanding from a support role to directly coordinating and moving towards performing the attack itself. Microsoft's report said that in a controlled test, an AI system performed 32 consecutive steps of an attack.

On the contrary, AI opens up new ways for defense forces. The application of source code analysis helps organizations detect vulnerabilities earlier and strengthen software before being exploited; At the same time, security teams can use AI to connect unusual signals, investigate and respond to threats at machine speed.

However, many organizations still need 30 to 60 days to fix critical vulnerabilities. According to a Microsoft representative, the big challenge today is "the gap between information and action".

"Signals from devices, identities, clouds, email, and AI systems are only truly valuable when continuously connected to the organization's context. AI can automate repetitive work so experts can focus on in-depth investigations, but human experience and judgment still play an essential role," Microsoft assessed.

One of the points emphasized in the report is digital identity - an important intrusion path for hackers. Specifically, Microsoft said 73.3% of initial intrusion attempts recorded were related to user behavior, valid accounts or forms of non-technical fraud, including phishing. The proportion of intrusions related to phishing increased from 7% last year to 23% in the latest reporting period.

According to Mr. Son, when they have valid login information, hackers can access the system like a normal user, making detection more difficult. AI continues to complicate the problem when it comes to creating personalized phishing content or simulating legitimate activities.

The report also warns that the impact of cyber security incidents is increasingly going beyond the initial target of attack. When identities, applications, data, cloud computing, software supply chains and AI systems are tightly connected, a breach can lead to data theft, cyber espionage, ransomware distribution or service disruption.

One example recorded by the company is that ClickFix-style malicious commands were executed on more than 1.1 million devices between February and May, an eightfold increase. With this form, attackers seek to lure users into performing operations themselves or running commands according to fake instructions, instead of relying solely on direct exploitation of technical vulnerabilities.

Microsoft representatives believe that businesses need to strengthen identity protection, apply multi-factor authentication, control access rights based on conditions and analyze behavior to detect signs of abnormalities. An account logging in from an unusual location, accessing large amounts of data, or performing actions that are out of habit may be a signal that needs to be checked.

The company also recommends applying the Zero Trust model, granting the minimum necessary permissions to each account, enhancing authentication and shortening the time to detect and handle incidents. Organizations also need to protect the AI ​​systems they are using, because they can become targets for attacks or abuse if given too broad access.

"The question is no longer just how to prevent every attack, but how to detect earlier, respond faster and maintain resilience when incidents occur," Mr. Son said, recommending that organizations take action now to both protect AI as part of the digital ecosystem, and leverage the power of AI itself to improve defense capabilities.

Luu Quy