2026 Verizon DBIR shows identity controls still decide breach outcomes

At a glance

What this is: This is Delinea’s readout on the 2026 Verizon DBIR, arguing that breach outcomes still hinge on identity controls rather than novel attack classes.

Why it matters: It matters because IAM, PAM, NHI, and emerging agentic AI programmes all face the same control failures when credentials, authorisation, and third-party access are not governed tightly.

By the numbers:

• 31% of breaches were tied to known vulnerabilities, overtaking credential abuse as the leading initial access vector.
• 39% of breaches involved credential abuse in the attack chain.
• 48% of all breaches were ransomware-related.
• 69% of ransomware victims did not pay.

Context

The 2026 Verizon DBIR is a useful reminder that the dominant breach patterns in modern environments are still being driven by basic control failures rather than entirely new attack classes. In this article, Delinea interprets the report through an identity lens, linking exploit activity, credential abuse, third-party exposure, ransomware, and Shadow AI back to the same governance problem: who or what can authenticate, act, and persist.

That framing matters for both human and non-human identity programmes. As AI systems, machine identities, and third-party access paths expand, the security question is no longer whether organisations have a policy for identity. It is whether those identities are inventoried, constrained, monitored, and revoked quickly enough to keep the attack surface from becoming an open breach path.

Key questions

Q: What breaks when organisations treat credential security as a user inconvenience instead of a core control?

A: Controls tend to be bypassed, delayed, or used inconsistently when they create too much friction. That weakens authentication assurance, leaves passwords and secrets exposed for longer, and increases the chance that a stolen credential becomes a full compromise. Usable security matters because the strongest control is the one people can sustain under normal business pressure.

Q: Why do known vulnerabilities still cause major breaches?

A: Known vulnerabilities still drive major breaches because attackers exploit the gaps organisations already understand but have not remediated fast enough. The issue is rarely discovery alone. It is the delay between knowing a weakness exists and reducing the access, privilege, or exposure that makes it exploitable.

Q: What are the signs that a third-party access breach is in progress?

A: Common warning signs include logins from suspicious IP addresses, repeated 401 and 403 responses, abnormal authentication patterns in vendor logs, and outbound connections to known malicious domains. Security teams should correlate these signals with access history and data movement. A single anomaly may be noise, but several together often indicate credential abuse or active exfiltration.

Q: How should organisations govern AI agents alongside human identity and device access?

A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.

Technical breakdown

Why vulnerability exploitation now outranks credential abuse

The DBIR shift in initial access is less about attackers abandoning identities and more about them exploiting the easiest exposed entry point first. Known vulnerabilities are attractive because they often bypass authentication entirely, while credential abuse remains available when those vulnerabilities are closed or noisy. For identity teams, the important point is that vulnerability management and identity governance now intersect more tightly: when public-facing systems are unpatched, the attacker never needs to fight the access control layer. Once inside, identity controls still determine whether the intrusion becomes a contained event or a breach.

Practical implication: tie vulnerability prioritisation to identity exposure paths, especially systems that expose privileged or federated access.

How credential abuse moves from entry vector to breach chain

Credential abuse is not just an initial login problem. The DBIR’s 39% figure shows that valid credentials continue to support movement, privilege use, and operational persistence after the first foothold. That is why controls around authentication and authorisation matter together: one confirms the actor, the other limits what that actor can do. In NHI environments, the same pattern appears when service accounts, tokens, or third-party credentials remain valid longer than the business relationship that justified them. The abuse is effective because access still looks legitimate to the system.

Practical implication: treat credential issuance, scope, and revocation as one control surface instead of separate security tasks.

Why AI identities inherit the same trust assumptions

Delinea’s article makes an important governance point: AI does not create a new class of breach logic, it extends existing identity exposure to a new actor type. AI accounts, agents, and other machine-bound identities still depend on credentials, permissions, and logging, so they inherit the same failure modes as human and workload identities. The difference is that AI usage can expand faster than review cycles or manual governance can keep pace. That makes stale assumptions about static ownership, fixed scope, and slow-change access especially risky once AI systems start acting as routine business participants.

Practical implication: classify AI identities inside the same lifecycle and privilege governance model used for other non-human identities.

NHI Mgmt Group analysis

Identity controls are still the deciding variable because breach paths remain permission-shaped, not technology-shaped. The DBIR data Delinea highlights shows that known vulnerabilities and credential abuse are still the most reliable ways into environments, which means the breach outcome is often determined by how well identities are constrained after entry. This is true across human logins, machine credentials, and AI accounts. Practitioners should treat identity control quality as the boundary between intrusion and incident.

Shadow AI turns an old governance problem into a faster one. Delinea’s discussion of AI use and non-corporate access shows that new identity types rarely introduce new logic, but they do compress the time available for oversight. The governance assumption that review cycles can catch misuse after the fact is weaker when the actor is a machine or agent with near-instant access. The field needs to recognise that identity sprawl now includes AI-driven access paths, not just accounts and tokens.

Third-party access remains a lifecycle problem disguised as a trust problem. The article’s emphasis on third-party MFA gaps is really about incomplete ownership and slow remediation windows. When external access is not fully inventoried, revoked, and revalidated, the partner environment becomes part of the organisation’s own breach surface. That is not a vendor issue in the abstract; it is an identity lifecycle failure. Practitioners should govern third-party access as if every external credential were inside the perimeter.

Attackers are exploiting identity trust debt, not just weak passwords or misconfigurations. Repeated use of the same access paths year after year shows that organisations accumulate unresolved trust assumptions around authentication, authorisation, and persistence. Once that debt exists, AI simply lowers the cost of exploiting it, whether the path is phishing, pretexting, purchased credentials, or token abuse. The practical implication is that identity governance must be measured by how much exploitable trust remains, not by how many policies exist.

Identity fundamentals now cover the full actor spectrum, including autonomous systems. The article’s conclusion is stronger than a call for better controls: it says the same identity security model must extend to human, machine, and AI identities. That means lifecycle governance, privilege limitation, and monitoring must be built for all three, even though their operating patterns differ. Practitioners who still separate these domains are managing one breach pattern with three disconnected programmes.

From our research library:

• Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.

What this signals

Identity blast radius: Breach reduction now depends on how far a valid credential can travel after the first login, not just on whether the login was prevented. When AI use, third-party access, and machine accounts are all in play, the relevant control question is how much damage a single trust decision can create before it is revoked or contained.

As organisations add more automation and more AI-adjacent access, the weakest point is often lifecycle governance rather than detection. If access reviews, offboarding, and privilege scope are still designed around slow-moving human roles, they will miss the faster patterns created by machine and AI identities.

The practical signal for security leaders is clear: identity programmes need to be measured by how quickly they shrink standing trust across humans, workloads, and AI systems. That is where breach outcomes are being decided now.

For practitioners

• Re-rank remediation by identity exposure paths Prioritise the vulnerabilities that expose privileged authentication paths, federation endpoints, and externally reachable management planes before lower-impact issues.
• Consolidate authentication and authorisation governance Review where login success, permission scope, and session duration are managed by different teams, then unify those controls for human, machine, and AI identities.
• Tighten third-party access lifecycles Inventory external accounts, require proof of current business need, and revoke access when a partner no longer needs a cloud resource or privileged integration.
• Bring AI identities into the same control model Assign ownership, scope, logging, and revocation rules to AI accounts and agents using the same lifecycle discipline applied to other non-human identities.

Key takeaways

• The article argues that modern breach patterns still depend on failures in identity control, even when the initial entry point is a vulnerability.
• Its strongest evidence is that credential abuse remains embedded in 39% of breaches, while ransomware still accounts for 48% of cases.
• Security teams should govern human, machine, and AI access as one lifecycle problem so that valid access does not become enduring attack surface.

Key terms

• Credential Abuse: Credential abuse is the use of valid secrets or accounts by an unauthorised party or for unauthorised purposes. In practice, it often looks like normal authentication unless teams correlate context, privilege, and behaviour. It is one of the most persistent ways identity failures become breaches.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Third-party identity exposure: Third-party identity exposure is the risk that external suppliers, contractors, partners, or their systems can access an organization through identities that are not directly controlled by the organization. It includes shared accounts, delegated access, tokens, and integrations. The exposure increases when identity lifecycle, privilege, and monitoring are weak.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.