For years, the standard advice in cyber security started with passwords: make them longer, make them unique, turn on two-step login. That advice still holds. But the latest large-scale breach data suggests the front door attackers prefer has changed.
Verizon’s 2026 Data Breach Investigations Report (DBIR), now in its 19th edition, found that vulnerability exploitation, at 31%, overtook credential abuse, at 13%, as the top initial access vector. In plain terms, more breaches now begin with attackers using a flaw in software than with them logging in using stolen credentials. techrepublic
This article walks through what that shift means, why organizations keep falling behind on fixes, what the report says about AI and ransomware, and what practical steps make sense whether you run a small business, an IT team, or just your own devices.
What the report is, and why it carries weight
The DBIR is one of the longest-running annual studies of real breaches, built from incident data supplied by contributing organizations. This edition analyzed more than 31,000 security incidents. A contributor’s summary says over 22,000 of those were confirmed data breaches. tecknexusbrandefense
A note on reading it: the report is a snapshot of what its contributors see, not a census of every attack. Secondary write-ups also differ slightly on details such as how many countries and partner organizations are involved, so for exact figures the safest source is Verizon’s own report at verizon.com/business/resources/reports/dbir/.
The headline: exploits overtake credentials
One summary notes that 31% of breaches in the study began with an exploited vulnerability, up from 20% in the prior edition. That is a big jump in a single year. gblock
Why would attackers favor this route? A stolen password usually gets a criminal into one account, and many accounts now have a second factor in the way. A flaw in an internet-facing system, such as a VPN appliance, firewall, or file-transfer tool, can open the whole network at once, with no user involved. If a fix exists but hasn’t been installed, the attacker simply needs to find the unpatched system, which automated scanning makes cheap.
This doesn’t mean credentials are safe. It means attackers have more than one lever, and they are pulling the one that scales best.
The real problem is the repair backlog
Finding out that vulnerabilities matter is the easy part. Fixing them quickly is hard.
The report points to a widening remediation gap, and one analysis of the data says organizations in the study closed only 26% of the critical vulnerabilities affecting their environments within the year, down from 38% in the prior report. Those are vulnerabilities from a public list of flaws known to be exploited in real attacks, the CISA Known Exploited Vulnerabilities (KEV) catalog. This figure comes from a single secondary source, so verify it against the original report before quoting it. gblock
Anyone who has managed IT understands why. Patching can break a business application. Systems run around the clock and have no convenient downtime window. Older equipment can’t be updated at all. Many organizations don’t have a complete list of what they own, so they can’t patch what they can’t see. The DBIR’s own recommendations lean on asset visibility, multifactor authentication, patch management, security awareness training, third-party risk, and incident response readiness. None of those are glamorous, and that is rather the point. techrepublic
The AI problem is partly an internal one
Discussion of AI in cyber security tends to focus on attackers using it to write better phishing emails or find flaws faster. The DBIR treats that as a theme, but one of its most practical findings is about employees.
The report found that employees were uploading source code, technical documents, and other sensitive data into external AI platforms, raising the risk of data leakage and intellectual property exposure. A contributor’s summary breaks down what was sent most often: source code (28%), structured data (14%), and documents (13%). techrepublicbrandefense
Most of this is almost certainly well-intentioned: a developer pasting code to debug it, an analyst summarizing a spreadsheet. But the data has left the organization’s control. The fix is less about banning tools than about giving people approved ones, writing a clear rule about what can’t be pasted into any outside service, and making that rule easy to follow.
Ransomware hasn’t gone away, but victims are saying no more often
Ransomware remains a major threat in the report. One summary quotes Verizon’s own colorful description of it as ubiquitous and stubbornly popular, and notes that 69% of victim organizations refused the demand outright, up from 64%. gblock
That is encouraging if it reflects better backups and incident planning, but it isn’t a reason to relax. Refusing to pay is much easier when you can restore your systems quickly, and that depends on backups you have actually tested. It also leaves the other half of modern ransomware, the threat to publish stolen data, unresolved.
People are still part of the picture
It would be a mistake to read all this as “forget about phishing.” The report is clear that human-centric attack vectors remain deeply embedded in the breach landscape, with phishing, social engineering, and compromised credentials still featuring prominently. One contributor’s summary puts social engineering at 16%, the third most common breach pattern. tecknexusbrandefense
The practical reading is that defense has to cover both: software that is current, and people who are hard to trick.
What to do about it
The steps differ by situation, but the logic is the same: shrink the number of exposed, outdated things.
If you run a small business or a small IT team:
- Make a list of everything that faces the internet. Firewalls, VPNs, routers, remote-access tools, website plugins, and cloud accounts. You can’t protect what isn’t on the list.
- Patch the exposed items first. Prioritize anything that appears in CISA’s Known Exploited Vulnerabilities catalog, because those flaws are being used in real attacks right now.
- Turn on automatic updates wherever it’s safe to do so, and set a fixed routine for the things that need manual care.
- Replace end-of-life equipment. A device that no longer receives security updates is a standing risk.
- Keep multifactor authentication on everything that supports it, since credentials are still the second most common route in.
- Test your backups. Keep at least one copy disconnected from the main network, and practice restoring from it.
- Write a short AI-use rule. Say which tools are approved and what categories of data must never be pasted into them.
If you’re an individual: keep your phone, computer, browser, and home router updating automatically; replace a router that the manufacturer has stopped supporting; and use a password manager and multifactor authentication on your email and banking accounts.
Who should pay the most attention
Organizations with remote-access infrastructure, older operational equipment, or a lot of third-party software have the most exposure. Manufacturing is one example: one summary of the report says malware was present in 75% of manufacturing breaches. rankiteo
Individuals and very small teams face the same underlying risk on a smaller scale, and for them the answer is mostly automatic updates and sensible account protection rather than elaborate tooling.
A fair reading of the limits
Two cautions are worth keeping in mind. First, a breach report only counts what is reported and investigated, so it tilts toward larger organizations and those with incident-response resources. Second, the shift from credentials to exploits is a trend in one dataset, not a law of nature. A different year, or a different dataset, could weigh the two differently. Treat the report as a strong signal about where to look, not a complete map.
Frequently Asked Questions
Are passwords still important for cyber security?
Yes. Credential abuse is still a significant way into systems, and the report treats it as a continuing risk. What has changed is that it is no longer the single most common starting point, so strong passwords or passkeys and multifactor authentication need to sit alongside timely patching, not replace it.
What does “vulnerability exploitation” mean?
It means an attacker takes advantage of a flaw in software or hardware, such as a bug in a firewall or a web application, to gain access or run malicious code. Often the flaw is already known and a fix is available; the attack succeeds because the fix hasn’t been installed.
What is the CISA Known Exploited Vulnerabilities catalog?
It is a public list, maintained by the US Cybersecurity and Infrastructure Security Agency, of vulnerabilities that are confirmed to be used in real attacks. It’s a practical way to decide what to patch first, since these flaws are not just theoretical. You can find it on cisa.gov.
Should I ban AI tools at work?
A blanket ban often pushes usage out of sight. A more workable approach is to provide approved tools, define what data must never be shared with outside services, and explain the reasoning so the rule is followed.
Should a company pay a ransomware demand?
That depends on circumstances and is best decided with legal and incident-response advice before an attack happens. The report notes that most victims in its data refused to pay, and that being able to restore from tested backups is what makes that choice realistic.
Where can I read the original report?
Verizon publishes the DBIR, including an executive summary, at verizon.com/business/resources/reports/dbir/.