Israel Ranks Second Globally in Microsoft's 2026 Cyber Defense Report
Microsoft's 2026 Digital Defense Report ranks Israel second globally for cyber attacks, absorbing 7.6% of worldwide activity and 39% of all Iranian-linked cyber threats.
Israel has been ranked second in the world and first in the Middle East and Africa for the frequency of cyber attacks, according to Microsoft's annual Digital Defense Report (MDDR). In the first half of 2026, Israel was the target of 7.6% of all cyber activity measured in the report. The United States ranked first with 25.5%, followed by Israel, Ukraine at 4.8%, and Taiwan at 3.9%. Regionally, Israel recorded 210 state-sponsored cyber events, significantly ahead of the United Arab Emirates with 50 and Egypt with 30.
According to Microsoft threat intelligence data, Israel was the primary target of Iranian threat actors, absorbing 39% of all Iranian-linked cyber activity. The United States ranked second at 23%, followed by the United Arab Emirates at 9%. The report, published for the seventh consecutive year, is based on cyber threat activity observed between July 2025 and June 2026, leveraging Microsoft's global monitoring infrastructure which processes over 165 trillion security signals daily and filters approximately 5.2 billion emails.
AI Acceleration and Expanding Attack Surfaces
A central trend highlighted in the report is the weaponization of artificial intelligence by threat actors to accelerate and scale their operations. The median time from vulnerability disclosure to operational weaponization has dropped to under 24 hours. Concurrently, 2026 is on track for a historic peak with an estimated 72,000 documented Common Vulnerabilities and Exposures (CVE). Furthermore, AI agents themselves are emerging as a new attack vector: July 2026 marked the first documentation of a fully autonomous ransomware and extortion attack, dubbed JADEPUFFER. Among cloud tenants targeted around AI environments, roughly 39% targeted OpenAI and Azure OpenAI services, while 31% targeted custom AI agents.
"State-sponsored Iranian actors have conducted extensive campaigns against Israel and other Middle Eastern adversaries while significantly scaling operations against the United States and American interests," the report notes, highlighting the convergence of cyber operations, military objectives, and influence campaigns.
Ransomware and Sectoral Targeting
Microsoft linked regional conflicts to a growing shift toward disruptive and destructive operations, including data wiping and attacks directed at Operational Technology (OT). The company also continues to observe long-term persistence efforts by Iranian actors aimed at espionage and future disruption capabilities. The report indicates a 21% increase in ransomware incidents targeting Israel compared to the previous year, rising from 19 to 23 cases, reflecting a hybrid warfare strategy.
Iranian cyber activity focused heavily on high-value intelligence and strategic sectors: research and academia accounted for 28% of measured targets, information technology constituted 12%, transportation 11%, government bodies 8%, and research institutes and NGOs 8%. Threat actors continue to exploit known vulnerabilities, weak authentication mechanisms, and internet-exposed systems for initial access.
National Cyber Directorate Response
Commenting on the report, Yossi Karadi, head of the Israel National Cyber Directorate, stated: "The State of Israel is engaged in an intensive cyber campaign and stands at the forefront of global threats. As the national cyber defense organization, our mission is to minimize the impact of attacks, prevent harm to citizens and essential services, and enable the country to continue functioning under continuous threat."
"While you might not see missiles in the air in cyberspace, there is no ceasefire. The campaign operates 24/7, and defense requires constant vigilance, recognizing that absolute resilience does not exist. The growing use of artificial intelligence accelerates the pace and scale of attacks, transforming the battlefield," Karadi added.
