Opinion: Microsoft’s AI Risk Report Overlooks Legacy Software Exposure

Summary

The opinion argues that Microsoft’s 2026 Digital Defense Report overlooks legacy software and vendor-concentration risks, citing CISA vulnerability figures, VA software decisions, and prior government compromises to call for stronger product security.

Key points

• The article says Microsoft’s 2026 Digital Defense Report highlights government agencies’ exposure to cyber threats but gives insufficient attention to legacy software risk.
• Citing CISA figures, it says Microsoft products account for nearly 16% of known exploited vulnerabilities in 2026 and nearly 23% from November 2021 to October 2026, compared with Cisco’s 7% and 6%.
• The article says the VA ended its Data Loss Prevention program in 2023 after bundling tools into a sole-source Microsoft license; the move reportedly put 18 million veterans’ records at risk of leakage. The VA is now seeking alternatives.
• It cites two compromises of Microsoft products by Chinese state-backed actors since 2023, including access to emails at over two dozen US agencies in one incident and at least seven agencies in another in July 2025.
• The article says Russian state-backed actors exploited Microsoft security weaknesses at least three times since 2020, and that US officials and advisory bodies considered breaches preventable.
• The author argues software vendors should prioritize security before release and be more transparent about their security processes as AI increases threat capabilities.

Vendors

Countries

Industries