Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector for First Time in 19 Years

Overview

Verizon’s 2026 Data Breach Investigations Report, published May 19, has upended a two-decade pattern in how attackers gain their initial foothold. For the first time in the report’s 19-year history, exploitation of software vulnerabilities has surpassed stolen credentials as the leading cause of breaches, accounting for 31% of all confirmed incidents — more than double the 13% share held by credential abuse, according to Verizon’s announcement. The shift arrives as organizations are simultaneously patching more slowly and facing a larger pile of known-exploitable flaws, a combination the report describes as a structural mismatch that threat actors are increasingly exploiting with AI assistance.

The 2026 edition analyzed 31,000 security incidents from November 1, 2024 through October 31, 2025, of which more than 22,000 were confirmed breaches — nearly double the 12,195 confirmed breaches reported in the prior year’s dataset, SecurityWeek notes. The data was aggregated from law enforcement agencies, forensic firms, cyber insurers, and Verizon’s own Threat Research Advisory Center across 145 countries, per the official DBIR report page.

The Patching Gap

The headline finding is inseparable from a worsening remediation crisis. The median time for organizations to fully patch a vulnerability climbed to 43 days in 2025, up from 32 days the year before — an increase of nearly two weeks, Help Net Security reports. At the same time, the volume of critical flaws requiring patching was 50% higher in median cases compared to the prior year, according to SecurityWeek.

The most concrete measure of the gap comes from Verizon’s survey of 13,000 organizations on their handling of CISA’s Known Exploited Vulnerabilities catalog — a curated list of flaws with confirmed active exploitation. Only 26% of KEV entries were fully remediated last year, down from 38% the year before, Help Net Security reports. The number of vulnerabilities added to the KEV catalog itself grew 50% year-over-year, Push Security’s analysis of the report notes, widening the gap between what organizations need to patch and what they are actually patching.

One category of device stands out as the sharpest acceleration. Edge devices — firewalls, VPN concentrators, and similar network perimeter equipment — were present in 22% of exploitation-based breaches, up from just 3% the prior year, according to Push Security. These devices are difficult to patch without service interruption, often run long-term without firmware updates, and sit at network boundaries that make them attractive initial-access targets.

Credential Theft Is Down as an Entry Point, Not as a Technique

The demotion of credential abuse from the top position requires a caveat the DBIR itself emphasizes: stolen credentials remain deeply embedded in breach chains even when they are not the initial foothold. Credential abuse appears at some point in 39% of all confirmed breaches — making it what Push Security’s review describes as the single most pervasive technique in the dataset, per Push Security. The shift is specifically in how attackers get in the door first, not in whether they use credentials at all.

The credential-to-ransomware pipeline has become a quantifiable threat: half of all ransomware victims in the dataset had experienced a credential theft or infostealer event in the 95 days before the ransomware deployment, Help Net Security reports. Push Security’s analysis of Initial Access Broker logs found that 54% of devices appearing in those logs had an infostealer installed, and an average of 2,362 breached corporate credentials surfaced per month across tracked infostealer markets.

Verizon’s report also documents a shift in the social engineering landscape. Mobile-centric phishing and vishing attacks now carry a 40% higher success rate than traditional email-based phishing, Verizon states. The median click rate for voice phishing was 2% compared to 1.4% for email, Push Security reports. Meanwhile, 41% of social engineering attempts now use non-email vectors — a significant departure from the historically email-dominated landscape, per Push Security’s analysis.

The ClickFix technique — which tricks users into manually executing malicious commands through fake browser prompts — has emerged as a notable social engineering variant. CrowdStrike documented a 563% increase in ClickFix lures, and Microsoft identified the technique in 47% of observed attacks in its own telemetry, according to Push Security.

Ransomware: More Frequent, Smaller Payments

Ransomware appeared in 48% of confirmed breaches, up from 44% the prior year, SecurityWeek reports. Against that rising frequency, the financial trajectory is running in the opposite direction: the median ransom payment dropped below $140,000, and only 31% of victims paid, SecurityWeek notes. The 69% non-payment rate reflects both improved resilience through backup and recovery investments and, in some cases, legal and regulatory pressure against paying designated threat actors, Help Net Security reports.

Post-compromise tradecraft is also evolving. Remote Monitoring and Management tool abuse surged 240% as attackers increasingly prefer legitimate administrative software over purpose-built malware — likely because RMM tools blend into normal enterprise traffic and evade signature-based detection. Correspondingly, traditional backdoor and command-and-control malware usage fell 27%, per Push Security’s analysis of the DBIR data.

Third-Party Exposure Surges 60%

Breaches involving a third party — suppliers, vendors, contractors, and managed-service providers — jumped 60% year-over-year and now account for 48% of all confirmed breaches, up from 30% the prior year, SecurityWeek and Help Net Security both report. The report’s data on third-party remediation suggests why: only 23% of third-party organizations fully resolved missing or improperly secured multi-factor authentication when findings were raised, SecurityWeek reports. Weak password and permission misconfigurations took a median of eight months to fix across half of identified findings, Help Net Security and Push Security both note.

The manufacturing sector shows a particularly concentrated version of the wider trends. System intrusion, social engineering, and basic web application attacks accounted for 91% of confirmed manufacturing breaches, with 87% financially motivated and 95% attributable to external actors, Industrial Cyber reports. Vulnerability exploitation was the leading initial access vector in manufacturing at 38%, above the global average, and ransomware appeared in 61% of malware-related manufacturing breaches.

AI: Accelerating Attacks, Leaking from the Inside

AI appears in the 2026 DBIR as both an offensive accelerant and an internal governance problem. On the offensive side, Verizon finds that threat actors used AI assistance across a median of 15 documented ATT&CK techniques per actor, with some actors leveraging it across 40 to 50 techniques, SecurityWeek reports. Verizon states that AI is “accelerating attack timelines from months to mere hours,” per its press release. Of AI-assisted initial access attempts, 32% specifically targeted vulnerability exploitation and 44% were phishing-related, Push Security notes.

Inside organizations, the shadow AI problem has grown substantially. The share of employees who are regular AI tool users reached 45%, up from 15% the prior year — a threefold increase. Of those users, 67% are accessing AI platforms from corporate devices using non-corporate accounts, bypassing enterprise data-loss prevention controls, SecurityWeek reports. More than 15% of users had unauthorized AI browser extensions installed. Source code was the leading category of data being submitted to unauthorized AI platforms, Push Security reports. Shadow AI has become one of the most common non-malicious insider data-leakage actions recorded in enterprise DLP datasets.

AI bot traffic on the broader internet grew at 21% month-over-month during the report period, while human-led traffic remained essentially flat at 0.3% growth, according to Verizon’s press release.

Regional Variation

The shift toward vulnerability exploitation as the primary breach vector is a global phenomenon but is more pronounced outside North America. In EMEA, exploitation accounted for 47% of initial access across 8,245 incidents and 6,060 confirmed breaches. In Asia-Pacific, it accounted for 42% across 5,229 incidents and 2,855 confirmed breaches. Latin America and the Caribbean recorded 44% exploitation-led access across 813 incidents and 718 confirmed breaches. North America contributed 12,371 incidents and 8,426 confirmed disclosures, with exploitation at 30% — slightly below the global 31% average, Industrial Cyber reports.

What We Don’t Know

The DBIR covers incidents reported through October 2025, meaning events from the final months before publication — including the wave of NGINX Rift exploitation and the May 2026 Cisco SD-WAN zero-days — are not reflected. The report’s confirmed-breach count nearly doubling year-over-year may partly reflect expanded reporting participation and data-sharing arrangements rather than a true doubling of incidents. Verizon has not publicly released the full methodology weighting for how incidents from different contributor types are counted.

Analysis

The 2026 DBIR’s central finding is less about a sudden shift in attacker behavior than about a long-running gap that has become statistically decisive. Vulnerability exploitation was already climbing as a breach vector; the 2026 edition captures the year it crossed 30% and overtook a credential-theft pipeline that had dominated the report since its inception. The numbers on patching — 43-day median time, 26% KEV remediation rate, 50% growth in the KEV catalog itself — describe a defense that is moving in the wrong direction precisely when offensive tooling is accelerating.

“While the velocity of cyber threats — driven by AI and faster vulnerability exploitation — is increasing, the foundational principles of security and strong risk management remain the most effective defense,” said Daniel Lawson, senior vice president for global solutions at Verizon Business, in the company’s announcement.

The rise of edge device exploitation from 3% to 22% of exploitation breaches in a single year is the sharpest inflection point in the report and corresponds to a well-documented pattern of state-linked and financially motivated actors burning through unpatched firewall and VPN vulnerabilities before vendors can respond. For defenders, the practical implication is that perimeter device firmware — often deprioritized in patching workflows because of its operational complexity — has become the highest-priority vulnerability class in the current threat environment.