Summary
- Microsoft places the UK highest in Europe for observed nation state cyber event counts.
- The dataset covers activity from July 2025 to June 2026.
- The ranking is distinct from broader cyber activity, where Ukraine remains Europe’s most affected country in Microsoft’s data.
The United Kingdom recorded Europe’s highest number of observed nation state cyber events in Microsoft’s latest global threat dataset, according to the company’s 2026 Digital Defense Report.
Covering activity from July 2025 to June 2026, Microsoft’s regional nation state figures place the UK first in Europe, while the United States leads the Americas, Taiwan leads Asia Pacific, and Israel records the highest observed event count across the Middle East and Africa.
That measure is narrower than overall malicious cyber activity and should not be interpreted as showing the UK suffered more cyber threats of every kind than every other European country. Microsoft’s wider European activity ranking puts Ukraine first, the UK second, and Germany third.
Across operations associated with China, Iran, North Korea, and Russia, Microsoft says state sponsored activity is increasingly focused on maintaining trusted access to identities, systems, and digital ecosystems that can support intelligence gathering or subsequent operations.
Trusted access still dominates initial compromise
Although artificial intelligence is accelerating parts of the attack chain, familiar access routes remain prominent in Microsoft’s datasets, with user execution accounting for 30% of observed initial access in Defender Experts data and valid accounts representing a further 20%.
Compromised identities can also support further credential theft once an attacker is inside, while legitimate access makes malicious actions harder to distinguish from normal activity than an obviously hostile exploit attempt.
Known software weaknesses remain similarly useful, which means sophisticated operators do not need a newly discovered vulnerability for every intrusion. Microsoft’s report describes a threat environment in which trusted identities, software, developer processes, and services can all become routes into high value environments.
AI is nevertheless changing the speed of that contest. Nearly 40,000 CVEs were published during the first half of 2026, according to Microsoft, while increasingly capable automation is compressing parts of vulnerability discovery and exploitation from days towards much shorter periods.
The UK’s position in Microsoft’s nation state ranking reflects activity visible through the company’s own security ecosystem rather than a complete census of every operation targeting the country. Incidents seen only by intelligence agencies, other technology suppliers, or individual organisations will sit outside that telemetry.
Even within that limitation, the regional figures show sustained state interest in UK government, research, infrastructure, industry, and other high value targets, while Microsoft’s wider findings indicate that long term access frequently remains more useful to state operators than immediate disruption.
