2026 Verizon DBIR shows vulnerability exploitation has overtaken credentials

At a glance

What this is: Secureframe’s DBIR recap shows vulnerability exploitation has become the leading initial access vector, ahead of credential abuse, with third-party exposure and ransomware also remaining central breach drivers.

Why it matters: IAM, PAM, and NHI teams should treat patch latency, vendor access, and credential monitoring as linked governance problems because attackers are increasingly entering through exposed systems and partner environments, not just stolen passwords.

By the numbers:

• Exploitation of vulnerabilities climbed to 31% of breaches, up from 20% the prior year.
• Credential abuse fell to 13% of breaches.
• Third-party breaches reached 48% of all breaches, up from 30% two years earlier.
• Ransomware appeared in 48% of all breaches this year.

Context

The security gap here is not a lack of awareness, but a mismatch between how organisations govern access and how attackers actually get in. A control model built around passwords and periodic review misses the reality that unpatched internet-facing systems, third-party cloud accounts, and exposed service interfaces now create faster entry paths.

For IAM and NHI programmes, the important shift is that identity risk is no longer isolated from vulnerability management. When a vendor account, service credential, or workload identity sits behind a vulnerable system, the blast radius is determined by both patch latency and access scope.

The DBIR data also shows why point-in-time compliance checks are losing value: exposure can persist long enough for an attacker to move from initial access to impact before a quarterly review ever happens.

Key questions

Q: What breaks when organisations still treat credentials as the main entry risk?

A: They miss the larger failure mode: attackers can enter through unpatched systems, vendor tools, or exposed services before identity controls ever matter. That means MFA and password policy remain necessary but are no longer sufficient on their own. Teams need remediation and exposure monitoring that work at the same speed as exploitation, especially for internet-facing and third-party-connected assets.

Q: Why does broad third-party access increase breach risk in customer environments?

A: Broad access increases risk because every additional connection expands the attack surface and creates more paths into internal systems. If a third party has more permissions than needed, an attacker who compromises that access can move farther than necessary and reach sensitive systems or data. The risk is amplified when organisations cannot clearly see who has access and at what level.

Q: How should teams decide which security findings to fix first?

A: Prioritise findings that are both reachable and tied to active code paths. A raw alert list is not enough because many issues will never be exploitable in practice. The best triage model combines severity with code-path evidence, so engineering time goes to defects that can actually affect production risk.

Q: What should organisations do after a supplier-connected ransomware incident?

A: They should review every third-party identity that touched the affected environment, revoke anything not tied to an active need, and test whether critical workflows can survive the loss of that supplier path. The goal is to remove hidden dependencies before the next disruption exposes them again.

Technical breakdown

Why vulnerability exploitation now beats credential abuse

Initial access is the point where an attacker first gets inside the environment, and vulnerability exploitation now outpaces credential theft because exposed software often gives direct entry without needing a stolen username or password. The DBIR trend points to a shift from identity-only defenses to control failures at the application, VPN, and third-party tool layer. When patching lags behind exploitation, the attacker does not need to defeat authentication at all. That changes the risk model for both perimeter systems and integrated SaaS platforms.

Practical implication: Treat patch latency as an access-control problem, not just a remediation metric.

How third-party environments create identity exposure

Third-party risk becomes a governance issue when external systems hold credentials, tokens, or cloud access that can reach your data. The article shows that many breaches now come through insecure authentication and misconfigured vendor environments, which means your trust boundary extends into the vendor’s identity controls. For NHI programmes, this matters because service accounts, integration tokens, and delegated access often live longer and are reviewed less often than human accounts. If the vendor is compromised, the inherited access can become the fastest path to your assets.

Practical implication: Inventory vendor-held credentials and require the same lifecycle control you expect internally.

Why KEV triage now needs exploit timing

Known Exploited Vulnerabilities, or KEVs, are the subset of flaws with confirmed active use in the wild, and the report shows that remediation speed is too slow relative to the attack window. The article notes that vulnerability backlogs are growing while the median time to patch a KEV rose, which means organisations are still managing by queue rather than by exposure. The key technical point is prioritisation: recently exploited flaws carry a much higher likelihood of being weaponised again than dormant issues. That makes exploit recency a better control signal than severity alone.

Practical implication: Prioritise recently exploited flaws first and tie them to remediation deadlines.

Threat narrative

Attacker objective: The attacker wants rapid foothold acquisition through exposed software so they can convert access into ransomware, theft, or deeper compromise before defenders close the gap.

1. Entry occurs through an unpatched vulnerability in a VPN, web application, or third-party tool rather than through stolen credentials.
2. Escalation follows when the attacker leverages the exposed system to reach internal resources or vendor-linked access paths.
3. Impact lands as ransomware, data theft, or broader breach activity once the attacker has a foothold and sufficient reach.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Vulnerability exposure has become an access-governance problem, not just a patching problem. When exploitation overtakes credential abuse, the control question shifts from who can log in to what can be reached before remediation closes the door. That means security teams need to govern exposure windows with the same seriousness they apply to privileged access. Practitioners should treat exploitability, not just authentication strength, as a first-class access risk.

Third-party access now behaves like delegated identity risk. The article’s third-party findings matter because vendor environments often contain service credentials, cloud entitlements, and authentication paths that are outside the buyer’s direct control. In identity terms, this is an offboarding and governance challenge as much as a supplier-risk problem. The practical conclusion is that vendor access must be measured, time-bounded, and continuously validated.

Patch backlog plus standing privilege creates a compound failure mode. Secureframe’s summary shows that attackers do not need both a stolen credential and a vulnerability; either one can become the starting point when access remains broad and remediation is slow. This is a strong example of governance debt accumulating across IAM, PAM, and vulnerability management. The result is that continuous control monitoring matters more than annual assurance cycles.

KEV triage is the right named concept for this shift. The article makes clear that remediation capacity is finite, so the issue is not whether to patch everything instantly, but which exploitable exposures to close first. The best programmes prioritise actively exploited flaws, then link those priorities to identity scope and vendor reach. Practitioners should operationalise KEV triage as a control, not a meeting agenda.

Identity security is now inseparable from supply-chain exposure. Third-party breach rates near half of all incidents show that organisations are inheriting other people’s authentication failures and cloud misconfigurations. That has direct implications for NHI governance because machine credentials are often the quietest part of the shared attack surface. Teams should assume that delegated access is part of the breach perimeter unless proven otherwise.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

KEV triage is becoming a control discipline. Security teams should stop treating exploited vulnerabilities as a generic backlog and start managing them as time-sensitive access paths. The right response is to collapse patching, reachability, and vendor dependency data into one prioritisation queue, then act on the exposures that are already in active use.

Third-party exposure is now part of identity governance. When a vendor account or integration token can reach your systems, that access should be governed like any other privileged pathway. This is where NHI controls and supplier-risk reviews overlap: both need lifecycle ownership, not just contract language.

Patch velocity is no longer separate from resilience. The organisations that absorb this shift will be the ones that can see drift continuously and close it before attackers convert exposure into compromise. Annual assurance still has a role, but operational security now depends on closing the gap between detection and remediation.

For practitioners

• Prioritise KEV-driven remediation Build your vulnerability queue around actively exploited flaws first, not just severity scores, and set deadlines for internet-facing assets and vendor-connected systems.
• Enforce MFA across third-party cloud access Require MFA on every vendor account, integration console, and admin path that can reach your data, then verify the setting through continuous checks.
• Map service credentials to vendor exposure Identify service accounts, API keys, and tokens held by third parties, then track where those credentials can authenticate and what data they can reach.
• Shorten the review cycle for privileged access Move privileged account and workload access review from periodic certification to continuous monitoring so exposure is reduced before attackers can exploit it.
• Test recovery against ransomware and supply-chain entry Run exercises that start from a vulnerable external system or compromised vendor account, then validate containment, restoration, and dependency isolation.

Key takeaways

• Vulnerability exploitation has overtaken credential abuse as the leading breach entry point, which changes where security teams should focus limited defensive effort.
• Third-party environments are now a major part of the attack surface, and delegated access must be governed with the same discipline as internal privileged access.
• The strongest response is continuous exposure control, combining exploit-priority patching, vendor access oversight, and faster remediation cycles.

Key terms

• Known Exploited Vulnerability: A Known Exploited Vulnerability is a flaw that has confirmed active exploitation in the wild and is tracked for urgent remediation. In governance terms, KEV status turns patching from a general hygiene task into a time-bound operational obligation.
• Third Party Risk: Third party risk is the chance that an outside organization, supplier, contractor, or service provider will create harm for your business. It includes security, privacy, operational, legal, and compliance exposure caused by access to data, systems, or processes. In identity terms, it often arises from shared credentials, integrations, and delegated trust.
• Credential Monitoring: Credential monitoring is the continuous checking of usernames, passwords, tokens, cookies, and similar secrets for signs of exposure or reuse by attackers. In practice, it turns credential compromise into an actionable identity event rather than a hidden assumption about trust.
• Exposure Window: The period in which a credential, session, or privilege grant can be exploited before it is revoked or expires. Shorter windows help, but they do not solve the deeper question of whether the access remains justified for the full time it is active.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect workload access, secret governance, and identity lifecycle decisions to real operational risk.