The Verizon DBIR 2026 marks a real break in breach patterns: vulnerability exploitation is now the top entry point, behind 31% of breaches. Stolen credentials fell to 13%, while phishing accounted for 16%. The practical answer is blunt. If you still treat patching as back-office hygiene, you’re defending yesterday’s breach model.
Verizon DBIR 2026: the breach hierarchy changed
Verizon published its 19th annual Data Breach Investigations Report on May 19, 2026, using incidents recorded from November 1, 2024, through October 31, 2025. The dataset is unusually large: more than 31,000 security incidents and more than 22,000 confirmed breaches.
SecurityWeek reported that the prior DBIR contained 12,195 confirmed breaches, so the 2026 count is close to double year over year. Some of that may reflect reporting and partner coverage, but the directional signal is still hard to ignore.
The headline finding is simple. For the first time in the DBIR’s 19-year history, exploitation of software vulnerabilities overtook credential abuse as the leading breach entry point. Vulnerabilities accounted for 31% of breaches in 2026, while credential abuse accounted for 13% and phishing 16%.
That doesn’t mean passwords stopped mattering. It means attackers no longer need to wait for a user to slip when exposed software gives them a faster path. If your internet-facing systems are stale, identity controls may be protecting the wrong door.
| DBIR 2026 breach factor | 2026 figure | What it means for defenders |
|---|---|---|
| Vulnerability exploitation | 31% of breaches | Top initial access route; patch latency is now a board-level risk. |
| Phishing | 16% of breaches | Still a major entry point, especially on mobile and collaboration channels. |
| Credential abuse | 13% of breaches | No longer number one in the DBIR, but still material and often combined with other tactics. |
| Human element | 62% of breaches | People remain involved through errors, social engineering, credential use, and operational delays. |
| Third-party involvement | 48% of breaches | Supplier exposure and partner access are nearly half the problem. |
| Ransomware involvement | 48% of confirmed breaches | Extortion remains tied to initial access, especially exposed systems and weak recovery. |
Why vulnerabilities overtook stolen passwords
A stolen password is useful, but a known flaw in a widely deployed product can be better. It scales. Once a proof-of-concept, scanner, or working exploit is available, attackers can search thousands of targets instead of tricking one employee at a time.
The Verizon DBIR 2026 says threat actors are using AI to accelerate exploitation of known vulnerabilities, shrinking defensive windows from months to hours. Verizon also says generative AI is being used across attack stages, including spotting security gaps and writing malware.
Put the 2026 patching numbers next to that claim and the mismatch is ugly. Median time to fully patch vulnerabilities increased to 43 days, up from 32 days. Meanwhile, Verizon recorded about 527.3 million vulnerability instances in 2025, compared with about 68.7 million in 2022.
Here’s the concrete calculation most summaries skip: 527.3 million is roughly 7.7 times the 2022 figure. If your remediation team improved by 20% during that period, it could still be losing ground badly because the volume of exposed findings grew far faster.
IBM X-Force reached a related conclusion from a different angle, finding that many attacks don’t need a login at all; the pattern is covered in this breakdown of why more vulnerabilities need no stolen credential. Different datasets, same uncomfortable message.
What is the top cause of data breaches in 2026?
According to the Verizon DBIR 2026, vulnerability exploitation is the top breach entry point in 2026, at 31% of breaches. Phishing follows at 16%, and credential abuse sits at 13%.
Be careful with the phrase “cause,” though. Breaches are rarely single-cause events. A vulnerable edge appliance may provide access, a weak service account may enable movement, and a human approval mistake may help the attacker cash out.
Verizon’s human-element figure proves the point: people were present in 62% of breaches. Social engineering represented 16% of breaches, and mobile-centric phishing or social attack simulations had a median success rate 40% higher than email. Mobile is not a side channel anymore.
Honestly, the old training-first response feels too thin now. Awareness helps, but it won’t patch a VPN gateway, retire an exposed admin panel, or fix a vendor system you don’t monitor.
How do hackers exploit vulnerabilities now?
Attackers usually don’t need a cinematic zero-day. The more common pattern is duller and more damaging: find an exposed asset, match it to a known vulnerability, test exploitability, then automate follow-up. Dull wins at scale.
The Verizon DBIR 2026 connects that process to generative AI. SC Media reported Verizon partnered with Anthropic to study 793 unique threat actors between March 2025 and February 2026. Anthropic rated 99% of observed threat actors as medium- or low-risk based on AI-use sophistication and frequency, while 1% were high- or critical-risk.
That may sound reassuring. It isn’t, entirely. Low-sophistication AI use can still make average attackers faster at reconnaissance, translation, phishing drafts, code modification, and vulnerability triage.
SC Media also reported that LLM-assisted initial access methods broke down as phishing 44%, vulnerability exploitation 32%, and credential abuse 21%. SecurityWeek reported that the median threat actor researched or used AI assistance in 15 documented techniques, with some using 40 or 50.
For a concrete case of speed and automation changing ransomware economics, see the analysis of JadePuffer and AI-led attack tempo. The details differ, but the operational lesson is the same: slow internal queues are becoming an attacker advantage.
The patching gap nobody can outsource away
The worst 2026 metric may not be the 31% entry-point figure. It may be remediation. Organizations fully remediated 26% of CISA Known Exploited Vulnerabilities, down from 38% the prior year, while median full remediation time rose from 32 to 43 days.
SC Media reported that 56% of KEV vulnerabilities were at least partially remediated in 2026. Completely unremediated KEV flaws rose from 12% to 16% year over year. Partial fixes are better than nothing, but they’re also where false comfort lives.
One pitfall rarely discussed is patch dependency. A team may patch the application but leave the vulnerable library in a container base image, a forgotten staging host, or a vendor-managed appliance. The ticket closes. The exposure remains.
Use the DBIR as a forcing function for a smaller, stricter routine:
- Rank internet-facing assets first, especially VPNs, firewalls, remote access, identity infrastructure, and management consoles.
- Separate CISA KEV items from ordinary CVSS-based backlog work, because known exploitation changes priority.
- Track full remediation, not just ticket closure, including containers, backups, images, and third-party instances.
- Measure exposure time in days, then set an exception process for anything still open after a fixed deadline.
- Test compensating controls, because segmentation and web application firewalls often decay after deployment.
Cloud and DevOps teams have a special burden here because assets appear and disappear quickly. If you’re choosing tooling, this overview of cloud security platforms for enterprise DevOps teams is a useful companion to the DBIR’s patch-management warning.
Third parties, ransomware, and the AI wrinkle
The Verizon DBIR 2026 says third-party involvement appeared in 48% of breaches, up 60% year over year. That is almost half of confirmed breaches touching a supplier, partner, service provider, software dependency, or external operational relationship.
Ransomware was also involved in 48% of confirmed breaches, up from 44% in the previous year. The median ransomware payment dropped below $140,000 in 2026, and 31% of ransomware victims paid. Lower median payment does not mean lower business damage.
There is a counter-argument: if fewer victims pay, maybe ransomware pressure is easing. I wouldn’t bet a recovery plan on that. Lower payments may reflect negotiation, insurance changes, smaller victims in the dataset, better backups, or attackers spreading activity across more targets.
AI adds another governance problem. Verizon stated that employee use of unapproved “shadow AI” tripled from 15% to 45%, and SecurityWeek reported that 67% of users accessed AI services from corporate devices using non-corporate accounts. Sensitive prompts, code snippets, logs, and credentials can leak into systems security teams don’t administer.
Attackers are also experimenting with agentic workflows. If you need a primer on how that risk moves beyond chatbots, read this explanation of AI agents being weaponized by hackers. The practical control is not a blanket ban; it’s visibility, approved tools, and hard limits on what data can be pasted or connected.
Companies building with model-context protocols have an added exposure point, because agent tools can bridge internal systems in surprising ways. The guidance on securing MCP servers fits neatly with the DBIR’s broader warning about third-party and AI-assisted attack paths.
What should you change after reading the DBIR?
The Verizon DBIR 2026 should move vulnerability management closer to incident response, not leave it buried in compliance. A monthly patch meeting is too slow when Verizon says defense windows are shrinking from months to hours.
Start with exposure, not inventory perfection. You need to know which systems are reachable from the internet, which handle authentication, which sit in third-party hands, and which have known exploited vulnerabilities attached to them. Perfect asset databases are rare. Useful ones are possible.
Security leaders should also stop treating phishing, credentials, and vulnerabilities as separate budget boxes. They combine in real attacks. A mobile phishing message can steal an MFA token, a vulnerable appliance can give initial access, and a reused admin credential can turn a foothold into ransomware.
For growing organizations, the sequence matters: first close obvious external exposure, then formalize identity controls, then mature detection and response. The balance changes with headcount and architecture, which is why this guide to how security priorities shift as organizations grow is a sensible next read.
My view: the winning metric for 2026 is not “number of vulnerabilities closed.” It’s “days of exploitable exposure on important systems.” That single shift changes the conversation from activity to risk.
FAQ
What is Verizon DBIR 2026?
The Verizon DBIR 2026 is Verizon’s 19th annual Data Breach Investigations Report, published on May 19, 2026. It analyzes incidents from November 1, 2024, through October 31, 2025.
What was the biggest DBIR 2026 finding?
The biggest finding was that vulnerability exploitation became the leading breach entry point for the first time in the report’s 19-year history. It accounted for 31% of breaches.
Are stolen passwords still a major breach risk?
Yes. Credential abuse accounted for 13% of breaches in 2026, so it remains significant even though it no longer ranked first. Strong MFA, password hygiene, and detection still matter.
How fast should companies patch known exploited vulnerabilities?
The DBIR shows why faster is better: median full remediation rose to 43 days in 2026 while attackers are using AI to compress exploitation windows. Known exploited vulnerabilities should be handled on an emergency track, especially on internet-facing systems.
Did ransomware decline in Verizon DBIR 2026?
No. Ransomware was involved in 48% of confirmed breaches in 2026, up from 44% the previous year. The median payment dropped below $140,000, but incident frequency remained severe.
EN 
FR 
ES