2026 DBIR shows credential abuse and AI risk still drive breaches

At a glance

What this is: NHI Mgmt Group's analysis, drawing on 1Password's blog post: Breach patterns continue to reward basic control failures in the 2026 Verizon DBIR, with vulnerability exploitation rising to the top entry point and credential abuse still appearing throughout the attack chain.

Why it matters: IAM, PAM, and NHI teams should read this as a warning that identity controls, third-party access, and credential lifecycle discipline remain breach shapers even when initial access shifts elsewhere.

By the numbers:

• The 2026 DBIR analyzes more than 31,000 incidents, including more than 22,000 confirmed breaches across 145 countries.
• Only 26% of critical vulnerabilities in the CISA Known Exploited Vulnerabilities catalog were fully remediated in 2025.
• Median time to full remediation rose to 43 days, up from 32 days the year before.
• Breachs involving third parties rose to 48% of total breaches, a 60% increase from the prior dataset.

Context

The 2026 Verizon DBIR is fundamentally a governance story about which controls fail first under real attack pressure. In practice, that means patching, credential hygiene, third-party access, and account lifecycle discipline continue to matter more than the shifting headlines around attacker tooling.

For identity programmes, the report reinforces a familiar but uncomfortable point: initial access may change, but privilege abuse and weak credential management still determine how far attackers can move. That keeps NHI governance, access review quality, and vendor offboarding squarely inside the breach conversation.

The article also frames AI as a multiplier, not a replacement, for existing control gaps. Shadow AI, service and machine accounts, and exposed secrets all increase the number of places where identity governance can fail if ownership and review are weak.

Key questions

Q: What breaks when vulnerability exploitation becomes the main breach path?

A: When vulnerability exploitation overtakes credential abuse, the organisation can no longer rely on identity controls alone to stop initial access. The weak point is often an exposed VPN, web app, or third-party tool that bypasses login defences entirely. Security teams need exposure management, rapid patch prioritisation, and asset visibility to close that gap before attackers use it.

Q: Why do service accounts and other non-human identities increase breach impact?

A: Service accounts and other non-human identities increase breach impact because they often carry broad, persistent access and bypass interactive controls like MFA. When those identities are not tightly scoped, rotated, and retired, attackers can reuse them to move quietly across systems, pipelines, and cloud environments. The issue is not the token alone, but the authority attached to it.

Q: What do teams get wrong about credential abuse detection?

A: Many teams focus on the moment of theft and miss the later replay activity. Detection should look for unusual login velocity, impossible travel, credential stuffing patterns, and access after known exposure events. If monitoring only watches for phishing or malware, it can miss the stage where access is actually exploited.

Q: How should organisations respond when trusted access becomes the attack path?

A: Organisations should tighten the scope of every credential, prioritise attack-path analysis for crown-jewel systems, and unify governance across human, machine, and delegated identities. The key question is not who logged in. It is what the identity could do once trust was inherited, because that determines the true containment boundary.

Technical breakdown

Why vulnerability exploitation is now the leading entry point

Vulnerability exploitation becomes the leading initial access vector when patch latency, exposed services, and poor asset visibility line up. In breach terms, this is less about a single flaw than about the organisation's inability to collapse exposure quickly enough before attackers weaponise it. The DBIR's remediation numbers suggest that the control problem is not discovery alone but governed closure. For identity teams, this matters because the first exploit often creates the conditions for credential capture, service account abuse, or downstream access expansion. The practical question is whether patch workflows are aligned with business-critical exposure windows, not whether a scanner can find the issue.

Practical implication: tie vulnerability triage to identity-bearing systems first, especially internet-facing services, SaaS connectors, and privileged access paths.

How credential abuse persists across the full attack chain

Credential abuse should be understood as an attack-chain behaviour, not just a login problem. Even when stolen passwords are no longer the first observed entry point, they still support privilege escalation, lateral movement, and persistence after initial compromise. That is why breach statistics often show credentials as the connective tissue that turns one foothold into multi-system impact. For NHI governance, this includes service accounts, OAuth tokens, shared admin credentials, and other secrets that outlive the session or owner that created them. The technical issue is standing trust: once a credential exists, its blast radius depends on scope, reuse, and revocation discipline.

Practical implication: treat credential governance as attack-path control, not just authentication hygiene, and remove standing trust wherever possible.

Why third-party access becomes part of the internal perimeter

Third-party environments blur the boundary between internal and external control ownership. When vendors, contractors, SaaS integrations, and service accounts inherit access without tight lifecycle governance, attackers do not need to breach the organisation directly to reach sensitive systems. The DBIR's emphasis on missing MFA, weak passwords, poor rotation, and excessive permissions shows how often the weak link is an access relationship rather than a technology stack. In NHI terms, the problem is not merely that third parties exist, but that their identities are often granted broader and longer-lived access than the business can actually justify. That makes offboarding and scope reduction core security controls.

Practical implication: map third-party identities to explicit owners, rotation rules, and offboarding triggers before allowing them to touch production.

Threat narrative

Attacker objective: The attacker aims to turn a single exposure or stolen credential into broader access across systems, vendors, or cloud services.

1. Entry occurs through vulnerable internet-facing systems or exposed services, with the 2026 DBIR identifying vulnerability exploitation as the leading initial access vector.
2. Credential access or abuse follows when attackers capture or reuse passwords, tokens, or other secrets that provide broader system reach than the original entry point.
3. Escalation happens when standing permissions, third-party access, or reused credentials let the attacker move beyond the first compromised account.
4. Impact is reached when the attacker turns that access into breach scale, whether through data theft, ransomware, or wider compromise across connected systems.

Breaches seen in the wild

• Okta support system breach 2023: A support service account credential saved in a personal Google profile let attackers take HAR files and hijack five Okta customers' sessions.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Basic identity controls remain the breach boundary, even when the first move is a vulnerability exploit. The 2026 DBIR shows that attackers are not choosing between exploit paths and identity paths so much as chaining them together. Once an exposed service is compromised, credential governance becomes the deciding factor in whether the incident stays local or expands. Practitioners should read this as a reminder that authentication scope and patch speed are two halves of the same containment problem.

Credential abuse is still the connective tissue of modern compromise. The fact that it appears in 39% of breaches across the full attack chain means defenders cannot treat stolen secrets as a solved problem just because initial access percentages move around. Reuse, standing privilege, and poor offboarding keep credentials reusable long after the first compromise. The practitioner lesson is to govern credentials as lifecycle assets, not static authentication artefacts.

Third-party identity is now part of the core attack surface, not a perimeter exception. The DBIR's third-party findings show that vendor, contractor, and SaaS access often inherit the weakest lifecycle discipline in the environment. That creates identity blast radius because external access is frequently broader, longer-lived, and less continuously reviewed than internal access. Security teams need to treat every externally owned identity as a production entitlement with an owner, scope, and expiry.

AI increases the number of identities that need governance before it increases the sophistication of attacks. The report's Shadow AI and service-account commentary points to a category shift: more machine, agent, and workflow identities are being used before governance models have caught up. That creates operational ambiguity around ownership, approval, and revocation, especially where AI services sit outside SSO or central inventory. The practitioner implication is to inventory the identity estate before the AI layer multiplies it.

Identity blast radius is the right lens for this year's breach data. The article's strongest signal is not any single statistic but the way exploit, credential, third-party, and AI risk all compound through access scope. That compounding effect is what makes NHI governance, PAM discipline, and account lifecycle controls inseparable in practice. Teams should judge controls by how much blast radius they actually reduce, not by whether they exist on paper.

From our research library:

• Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.

What this signals

Identity blast radius is becoming the more useful control metric than simple authentication success. When attackers can combine vulnerability exploitation with reused or overextended credentials, the question is not whether a login works but how far that login can travel. Programmes that still separate patching from access governance will continue to miss the point of modern breach chains.

Shadow AI widens the inventory problem before it creates a model-risk problem. If teams cannot see which AI services, service accounts, and machine identities exist, they cannot govern who owns them, what they can access, or how they are revoked. That makes identity inventory a prerequisite for any serious AI security posture, not an administrative extra.

For practitioners

• Reduce standing access on third-party identities Inventory vendors, contractors, and SaaS integrations that hold production access, then assign explicit owners and expiry rules to each entitlement. Remove dormant or overlapping accounts before the next access review cycle rather than waiting for a periodic recertification.
• Prioritise remediation on identity-bearing systems Give patch and vulnerability teams a priority list that starts with internet-facing systems, credential stores, and authentication endpoints. The goal is to close the entry path before attackers can convert it into credential abuse or privilege expansion.
• Rotate shared and delegated credentials on a fixed cadence Identify shared passwords, API keys, tokens, and service accounts that are reused across environments, then set rotation and revocation rules that match their blast radius. Where ownership is unclear, treat the credential as a security defect until it is assigned.
• Inventory AI tools and machine accounts together Build one register for corporate AI services, service accounts, and machine identities so unmanaged use does not hide behind departmental tooling. Include account owner, authentication method, data access, and deprovisioning path for each entry.
• Tighten offboarding for external access paths Make leaver workflows cover third-party accounts, API tokens, and SaaS permissions, not just human employees. Validate that access is actually removed from downstream systems, because the breach path often persists after the contract or project ends.

Key takeaways

• The DBIR points to a breach pattern where exploit paths, credentials, and third-party access amplify one another instead of operating as separate risks.
• The evidence is clear enough to prioritise action, with more than 31,000 incidents reviewed, 22,000 confirmed breaches analysed, and 48% of breaches involving third parties.
• Teams that want to reduce breach impact should focus on lifecycle control, tighter access scope, and faster remediation around identities that outlive the session or the contract.

Key terms

• Credential Abuse: Credential abuse is the use of valid secrets or accounts by an unauthorised party or for unauthorised purposes. In practice, it often looks like normal authentication unless teams correlate context, privilege, and behaviour. It is one of the most persistent ways identity failures become breaches.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Third-Party NHI: Third-Party NHI is a non-human identity owned or operated by an external organization, partner, contractor, or supplier. It includes service accounts, API keys, certificates, tokens, and automated agents that access systems outside the primary enterprise boundary. Governance must cover issuance, scope, monitoring, revocation, and contractual accountability.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.