Microsoft: Vietnam is in the top 20 in the world in terms of impact of cyber threats

(Dan Tri) - According to Microsoft, Vietnam ranks 20th globally and 7th in the Asia-Pacific region in terms of the frequency of customers affected by cyber threat activities in the first half of 2026.

On October 23, Microsoft Vietnam announced findings from the Microsoft Digital Defense Report 2026, based on data on global cyber threat activities in the period July 2025 to June 2026.

The report shows that artificial intelligence (AI) is dramatically changing the pace of cyberattacks, while digital identities continue to become a top target for cybercriminals.

Vietnam ranks 20th in the world in terms of impact by cyber threats

According to the report, in the first half of 2026, Vietnam ranked 7th in Asia-Pacific and 20th globally among countries whose customers are most frequently affected by cyber threat activities.

According to Microsoft, Vietnam ranks 20th in the world and 7th in the Asia-Pacific region in terms of the frequency of customers affected by cyber threat activities in the first half of 2026 (Photo: Microsoft).

Presenting the research results, Mr. Phan Hong Son, Chief Technology Officer (Tech Lead) of Microsoft Vietnam, commented that Southeast Asia is becoming an area of ​​interest for cybercriminals.

According to him, the reason comes from the rapid speed of digital transformation, while the information technology infrastructure in many places is not really complete. The expansion of online services also means the emergence of more points of possible exploitation.

Globally, government agencies and public services were the most impacted, accounting for 27% of all cyber threat activity observed by Microsoft, up from 17% the previous year.

This is also a group that is often targeted in country-related attack campaigns, due to holding large amounts of sensitive data and operating many essential services.

Mr. Phan Hong Son, Chief Technology Officer of Microsoft Vietnam, shares notable findings from the Digital Defense Report 2026 (Photo: Doan Thuy).

Another notable finding is that the rate of exploiting security vulnerabilities is increasing rapidly thanks to AI.

Microsoft noted that the median time from when a vulnerability is discovered in the wild to when it is exploited has dropped to less than 24 hours. Meanwhile, many organizations still need 30-60 days to fix critical vulnerabilities.

Mr. Phan Hong Son said that if the whole year of 2025 recorded about 40,000 security holes, in just the first 6 months of 2026, this number was almost equivalent to the whole year before.

According to him, previously the process of detecting vulnerabilities and building exploitation tools could take many weeks. With AI, these steps are significantly shortened, some steps can even be automated in a few minutes.

More than 73% of intrusion attempts start with people and digital identities

Besides AI, Microsoft representatives warned that digital identity is one of the most exploited weaknesses.

According to the report, 73.3% of initial intrusion attempts involved exploiting user behavior, legitimate accounts, or other forms of phishing.

Notably, phishing (fraud to steal information) accounted for 23% of observed cases, a sharp increase compared to 7% the previous year.

The data also shows that 30% of initial intrusions involved users acting on the attacker's request, while 20% used legitimate accounts.

Of intrusions using legitimate accounts, 52.2% resulted in the theft of additional credentials, helping the attacker expand the scope of their attack.

According to the 2026 Digital Defense Report, 73.3% of initial attempts to gain unauthorized access involved human factors, legitimate accounts or forms of phishing (Graphic: Doan Thuy).

Explaining this trend, Mr. Son said that stealing accounts is often much easier than finding ways to bypass complex technical security systems.

"Once there is a valid identity/account, the attacker can properly walk through the main door into the system without having to break the door," Mr. Son said for example.

Fraudsters can also use AI to simulate the account owner's normal behavior, such as logging in at familiar times or performing daily activities, making it difficult for the system to detect abnormalities.

Artificial intelligence (AI) is helping hackers speed up the process of discovering and exploiting security vulnerabilities and carrying out cyber attacks (Illustration: Getty).

Faced with these risks, Mr. Son emphasized that businesses need to change their security thinking, from trying to prevent all attacks to preparing to respond and recover when incidents occur.

Microsoft recommends that organizations prioritize identity protection with multi-factor authentication (MFA), access control, and strict governance of AI and AI Agent systems.

In particular, as AI Agents are increasingly empowered to access data and perform work on behalf of humans, businesses must control their powers to avoid turning these tools into new security weaknesses.

Mr. Son said that businesses need to combine the use of AI to speed up defense with protecting the AI ​​systems themselves in operation, while regularly testing and evaluating information security.