[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcIuVdophCB-eRE8aF2-GaYeXOJlD18Q2CTmXMY8qfYU":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"c259146c-511c-4182-8771-c04a364197db","Preparing governments for an era of interconnected cyber risk","preparing-governments-for-an-era-of-interconnected-cyber-risk-cb18dd","According to this year’s Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025. The post Preparing governments for an era of interconnected cyber risk appeared first on Microsoft Security Blog.","According to Microsoft's 2026 Digital Defense Report, government agencies and services were the most impacted sector by cyber threats, accounting for 27% of observed activity and remaining primary targets for nation-state operations. The report highlights that phishing attacks accounted for 23% of intrusions (up from 7% in 2025), dwell times increased across sectors, and attackers increasingly mimic legitimate activity to evade detection. Microsoft recommends governments prioritize five resilience areas: preparing for faster threat environments, building security into AI ecosystems, planning for incident spread, strengthening identity and access controls, and establishing public-private partnerships.","Microsoft reports government agencies targeted in 27% of cyber threats in 2026, up from 17% in 2025.","https:\u002F\u002Fblogs.microsoft.com\u002Fon-the-issues\u002F2026\u002F10\u002F01\u002Fpreparing-governments-for-an-era-of-interconnected-cyber-risk\u002F","https:\u002F\u002Fblogs.microsoft.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F5\u002F2026\u002F09\u002FMDDR_BANNER-1024x576.png","2026-10-01T14:00:00+00:00","2026-10-01T16:00:12.858245+00:00",7,[17,20],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"AI","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":47,"vendors":134},[48,77,105],{"slug":49,"name":50,"problem":51,"products":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":78,"name":79,"problem":80,"products":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",[82,90,97],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":91,"vendor_name":18,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":106,"name":107,"problem":108,"products":109},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[135],{"slug":91,"name":18,"logo_path":92,"roles":136},[137],"reported_by",{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":156},"governments-face-surge-in-cyber-threats-as-phishing-and-evasion-tactics-escalate","Governments Face Surge in Cyber Threats as Phishing and Evasion Tactics Escalate","Government agencies accounted for 27% of all observed cyber threat activity, making them the most targeted sector globally, with phishing attacks tripling from 7% to 23% of intrusions in a single year. Attackers are increasingly mimicking legitimate user behavior to extend dwell times and evade detection, meaning traditional signature-based defenses are insufficient. The rise of nation-state operations targeting public sector infrastructure highlights that governments must treat cybersecurity as a strategic resilience issue, not merely an IT problem. Failure to act compounds risk across interconnected public services, where a breach in one agency can cascade into widespread societal disruption.",[143,144,145,146,147,148,149,150,151,152,153,154,155],"CIS Control 9 – Email and Web Browser Protections","CIS Control 6 – Access Control Management","CIS Control 17 – Incident Response Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 IR-4 – Incident Handling","NIST SP 800-53 AT-2 – Security Awareness Training","NIST Cybersecurity Framework DE.CM – Security Continuous Monitoring","NIST SP 800-61 – Computer Security Incident Handling Guide","GDPR Article 32 – Security of Processing","ITIL 4 – Service Continuity Management","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1078 – Valid Accounts (Evasion via Legitimate Activity)",{"MITRE ATT&CK T1566 – Phishing":157,"ITIL 4 – Service Continuity Management":158,"NIST SP 800-53 IR-4 – Incident Handling":159,"GDPR Article 32 – Security of Processing":160,"NIST SP 800-53 AC-2 – Account Management":161,"CIS Control 6 – Access Control Management":162,"CIS Control 17 – Incident Response Management":163,"NIST SP 800-53 SI-3 – Malicious Code Protection":164,"CIS Control 9 – Email and Web Browser Protections":165,"NIST SP 800-53 AT-2 – Security Awareness Training":166,"NIST SP 800-61 – Computer Security Incident Handling Guide":167,"NIST Cybersecurity Framework DE.CM – Security Continuous Monitoring":168,"MITRE ATT&CK T1078 – Valid Accounts (Evasion via Legitimate Activity)":169},"Covers phishing, now a much larger share of government intrusions.","Service continuity planning helps agencies keep services running during attacks.","Incident handling helps agencies respond to stealthy intrusions.","Requires appropriate security for citizens' personal data held by agencies.","Account management helps detect compromised accounts used to mimic legitimate users.","Access control management limits what attackers can do with stolen access.","Incident response helps agencies contain intrusions that blend in with normal activity.","Malicious code protection can detect payloads delivered by phishing.","Email and browser protections help block the surge in phishing against government agencies.","Awareness training helps staff recognise phishing, which tripled as an intrusion vector.","Incident handling guidance supports agencies responding to rising threats.","Continuous monitoring with behavioural analytics can detect attackers mimicking legitimate users.","Covers attackers using valid accounts to blend in and avoid detection."]