DBIR 2026 shows identity trust is now an attack surface

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's research: Verizon's DBIR 2026 shows that third-party compromise, vulnerability exploitation, and contextual social engineering are converging into a single identity trust problem.

Why it matters: IAM, NHI, PAM, and security teams need to treat vendor trust, SaaS integrations, and remediation lag as linked parts of the same exposure model, not separate programmes.

By the numbers:

• Third-party compromise appeared in 48% of breaches, a 60% year-over-year increase.
• Vulnerability exploitation accounted for 31% of breaches and overtook credential abuse at 13%.
• Only 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38% the year before.
• The human element was involved in 62% of breaches.

Context

Identity trust is no longer limited to direct authentication events or internal users. In this DBIR 2026 analysis, third-party access, SaaS integrations, and workflow-based social engineering sit alongside vulnerability exploitation as different entry paths into the same governance gap: organisations do not control every identity, relationship, or remediation window that attackers can exploit.

For IAM and NHI teams, the practical shift is that vendor trust, access scope, and response speed now need to be judged together. The article’s central point is not that one attack method replaced another, but that attackers are blending exposed infrastructure, trusted relationships, and behavioural pretexting in ways that make traditional control silos look incomplete.

Key questions

Q: What fails when organisations treat third-party access as low risk?

A: They lose control of the trust boundary. Third-party identities can inherit broad access through OAuth, SaaS integrations, or contractor permissions, and a single compromise can cascade into multiple environments. The failure is not only technical; it is governance drift, where delegated access outlives the business relationship that justified it.

Q: Why does vulnerability exploitation increase identity risk instead of replacing it?

A: Because exploited services often become the bridge to credentials, tokens, and session reuse. A breach may start as an infrastructure issue, but attackers usually need identity abuse to move laterally, persist, or access data. In modern environments, vulnerability management and IAM are coupled controls, not separate lines of defence.

Q: What are the signs that workflow-based social engineering is succeeding?

A: Look for subtle changes in communication patterns, request timing, approval routing, and the reuse of familiar threads or relationships. The attacker often avoids obvious malware or links and instead blends into legitimate business context. Behavioural anomalies are more useful than static indicators when the attack lives inside a normal process.

Q: What should security teams do when a vendor may already be compromised?

A: Security teams should assume the vendor access path is at risk and act quickly to reduce exposure. Restrict or suspend access, review logs for unusual activity, validate what data the vendor could reach, and assess whether the compromise touched regulated or sensitive information. Then rotate credentials, tighten permissions, and recheck controls before restoring trust.

Technical breakdown

Why third-party access becomes a trust multiplier

Third-party compromise expands the effective perimeter because the attacker does not need to break the primary organisation first. If a vendor, SaaS platform, contractor account, or OAuth integration is trusted into the environment, its access paths inherit downstream value. The governance problem is not only authentication but delegated authority: once a partner identity is accepted, its permissions can extend across multiple tenants, workflows, or data flows. That makes vendor lifecycle, scope control, and revocation discipline central to identity security, especially where integrations are numerous and loosely inventoried.

Practical implication: Map and govern third-party identities as first-class access paths, not as indirect exceptions.

How vulnerability exploitation and identity abuse combine

The report shows that vulnerability exploitation has become a leading initial access method, but credential abuse still appears throughout many breaches. That combination matters because initial footholds and identity misuse often belong to the same intrusion chain. Attackers may enter through an exposed service, then use stolen credentials, tokens, or over-permissioned accounts to move laterally and persist. In practice, the boundary between infrastructure security and identity security is artificial when compromised systems can be used to steal or activate trusted access.

Practical implication: Tie vulnerability management to identity containment so exposed services cannot become credential collection points.

Why contextual pretexting weakens indicator-based detection

Pretexting is effective because the surrounding workflow can be legitimate even when the message or request is malicious. If an attacker operates inside an established business thread, a known vendor relationship, or a normal payment or support process, static indicators such as links or attachments may not appear. Detection has to shift toward behaviour, timing, and relationship anomalies. That does not mean ignoring technical indicators, but it does mean that identity-aware monitoring must understand what normal communication and approval patterns look like before it can recognise abuse.

Practical implication: Tune detection and response to workflow anomalies, not just malicious payloads.

Threat narrative

Attacker objective: The attacker wants to turn trusted access into scalable lateral reach across partner ecosystems, then steal data or establish persistence with less resistance.

1. Entry often begins through exposed infrastructure, a compromised vendor account, or a trusted SaaS integration that already has legitimate access into the environment.
2. Attackers then abuse that trusted access to harvest credentials, tokens, or session-linked permissions that support movement across connected systems.
3. With identity trust already established, they escalate by operating inside normal workflows, using the trusted channel to avoid obvious alarms while expanding access.
4. The impact is broader than one account or one tenant, because a single third-party compromise can cascade into multiple connected organisations and data paths.

Breaches seen in the wild

• Canvas Instructure Data Breach: ShinyHunters exploits Canvas LMS platform to expose millions of student records via third-party NHI credential abuse.
• Snowflake breach: Snowflake breach compromised Ticketmaster, Santander and others via cloud credential abuse.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Third-party trust is now an identity control, not a vendor-management footnote: The DBIR’s third-party figures show that attackers are exploiting the trust relationship itself, not just the partner’s environment. Once access is delegated through SaaS, OAuth, or contractor pathways, the organisation inherits the partner’s identity hygiene as part of its own attack surface. Practitioners should treat third-party identity scope as a governed security boundary.

Identity and vulnerability management have become inseparable: The shift to 31% vulnerability exploitation does not reduce the importance of identity governance; it changes where identity risk enters the chain. Exposed systems become footholds for token theft, session abuse, and permission escalation, which means remediation lag directly expands identity exposure. The implication is that vulnerability response and access governance now share the same blast radius.

Trusted workflow abuse: Pretexting inside normal business threads is a control bypass because it preserves the shape of legitimate work while changing the intent. That is why behavioural anomalies matter more than isolated indicators when attackers operate through existing relationships. The control failure is not a missing signature, but a governance model that assumes a trusted workflow remains trustworthy once a trusted identity is present.

The human element remains the deciding context for machine-readable controls: The fact that 62% of breaches still involved people means that identity governance cannot be reduced to credential state alone. Attackers exploit judgement, timing, and approval paths as much as they exploit tokens or passwords. For practitioners, the field-level lesson is that identity trust is a socio-technical boundary, not a purely technical one.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• The 2026 Verizon DBIR found that exploitation of software vulnerabilities became the leading initial access vector in confirmed breaches, accounting for 31% of incidents.
• Read next: Identity Threat Detection and Response (ITDR) Guide

What this signals

Third-party identity sprawl is now an exposure model: When access is distributed across vendors, SaaS integrations, and workflow approvals, the effective control boundary moves outside the core organisation. Security teams should expect partner identity governance to show up in incident response, not just procurement or legal review. OWASP Non-Human Identity Top 10 remains relevant where delegated service identities and OAuth grants are part of the same trust chain.

Identity trust debt: Organisations accumulate trust debt when delegated access, long-lived approvals, and slow revocation leave more standing authority than the business can explain. The exposure grows each time a vendor relationship, API grant, or workflow exception is added without a matching retirement path. That is a governance problem before it becomes an incident problem.

For practitioners

• Inventory third-party identity pathways Build and maintain a current map of vendor accounts, SaaS integrations, OAuth grants, contractor identities, and shared service access that can reach production data or workflows.
• Tie vulnerability response to identity containment When a vulnerable internet-facing service is identified, assess whether it can expose credentials, session tokens, or delegated access before normal remediation closes the gap.
• Review workflow trust points Examine approval chains, finance workflows, help desk processes, and vendor communication paths for places where a trusted thread can be reused to request action or access.
• Raise the bar for third-party offboarding Require explicit revocation of OAuth grants, API access, and dormant partner accounts when a vendor relationship changes, ends, or loses business justification.

Key takeaways

• Third-party compromise and vulnerability exploitation now overlap with identity governance, which means the attack surface is defined by trust relationships as much as by technology stacks.
• The evidence points to a widening exposure window, with remediation lag leaving known exploited vulnerabilities available for abuse longer than many control programmes assume.
• Practitioners need to manage delegated access, workflow trust, and remediation speed as one operating model rather than three disconnected controls.

Key terms

• Third-Party Identity: An identity issued to a partner, vendor, contractor, or external service that can access internal systems. These identities often sit outside normal employee governance and can become persistent trust paths if they are not reviewed, expired, and revoked on schedule.
• Metadata Trust Boundary: A metadata trust boundary is the line between tool content that can be safely consumed and tool content that must be validated before use. For agentic systems, descriptions, examples, and schemas are security-relevant inputs because they can influence decisions and trigger actions with real-world impact.
• Workflow Pretexting: Workflow pretexting is social engineering that hides inside legitimate business processes, conversation threads, or approval chains. Instead of relying on obvious malicious content, the attacker exploits trust in the process and in the identities already present in it.
• Exposure Window: The period in which a credential, session, or privilege grant can be exploited before it is revoked or expires. Shorter windows help, but they do not solve the deeper question of whether the access remains justified for the full time it is active.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.