Identity attacks still match exploitation in Verizon’s 2026 DBIR

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Push Security's report: In Verizon's 2026 DBIR, vulnerability exploitation now edges past identity at initial access, but credential abuse still dominates the broader breach chain.

Why it matters: Identity and IAM teams cannot treat the report as a sign that credential risk is fading, because the same identities still drive lateral movement, privilege escalation and persistence after entry.

Context

Verizon's 2026 DBIR is best read as a warning about converging attack pressure, not a simple shift away from identity. The report's headline vector is vulnerability exploitation, but the broader dataset still shows identity as a durable control problem across initial access and post-compromise activity.

For IAM, PAM and NHI programmes, the important question is not which vector wins a single ranking. It is how often credentials, sessions, OAuth grants and third-party access are still appearing as the mechanism that lets attackers move from entry to sustained access. That is the programme-level problem this report exposes.

Key questions

Q: Where does identity control fail when attackers move beyond initial access?

A: It fails when teams stop measuring identity only at the login event. Once an attacker has a session, token or reused credential, the same identity artefact can support privilege escalation, lateral movement and persistence. Effective governance has to cover credential lifetime, session state and delegated access after first entry, not just authentication at the edge.

Q: Why do vulnerabilities now matter as much as identity controls in breach prevention?

A: Because attackers increasingly start with application weaknesses, then move into identity, privilege, and data access once they are inside. Identity controls still matter, but they no longer represent the only or even primary first line of defence. A mature programme has to reduce both exploitability in code and abuse potential in identities.

Q: What are the signs that credential theft is driving a broader breach?

A: Common signs include unusual access to systems beyond the initial entry point, unexpected use of trusted accounts, and activity that looks normal at the authentication layer but abnormal in scope or timing. A separate warning sign is delayed detection, because credential abuse often lets attackers operate for long periods while appearing to be legitimate users.

Q: How should teams handle third-party access that outlives the original need?

A: They should treat it as a governance failure, not a supplier footnote. When MFA is missing, permissions are excessive or access is left in place after a relationship changes, the result is durable exposure. The fix is strict lifecycle control, ongoing attestation and revocation tied to actual business need.

Technical breakdown

Why initial access rankings can understate identity risk

Initial access taxonomies compress different attack behaviours into broad labels, which can make identity risk look smaller than it is. In this report, phishing, credential abuse and pretexting are separated, even though practitioners often experience them as variants of the same credential-harvesting problem. That means a clean comparison between vulnerability exploitation and identity vectors can hide the shared objective: obtaining a valid session, token or login path. When categories shift, the headline mix shifts too, but the underlying operational burden on defenders often does not.

Practical implication: evaluate identity exposure across the full attack chain, not only by first-access category.

How credential abuse persists after the front door

Credential abuse is not just an initial access technique. Once an attacker has a usable account, token or session, the same credential can support discovery, privilege escalation, lateral movement and persistence. That is why the report's broader breach-chain view matters more than the initial-access chart alone. The control failure is often lifecycle-based: credentials outlive their intended scope, sessions remain valid too long, or third-party access is not revoked when trust changes. In NHI terms, the problem is not only leak detection, but the persistence of usable identity material after compromise or operational change.

Practical implication: manage credential lifecycle and scope as ongoing controls, not one-time provisioning tasks.

What the browser and third-party surface add to identity attacks

The browser has become a control plane for identity activity because it is where users authenticate, approve OAuth consent, reuse sessions and encounter social engineering. Third-party access compounds that problem when vendors or integrators retain credentials, MFA gaps or overbroad permissions for months. In practice, this creates a layered identity surface that spans human login, service access and delegated third-party trust. A report like this matters because it shows defenders cannot rely on email security or perimeter controls alone when identity actions are happening in browser sessions and federated access paths.

Practical implication: extend visibility to browser sessions and third-party identities, not just endpoint and email telemetry.

Threat narrative

Attacker objective: The attacker aims to turn a single entry point into durable access that can be reused for movement, persistence and downstream impact.

1. Initial access often begins through either vulnerability exploitation or credential-harvesting activity that yields a valid login, session or token.
2. Once the attacker has usable identity material, credential abuse supports privilege escalation, discovery and lateral movement inside the environment.
3. Persistence follows when access paths remain valid, especially where third-party accounts, tokens or weak lifecycle controls are left in place.
4. The objective is sustained access that can support ransomware, data theft or further compromise across the environment.

Breaches seen in the wild

• Snowflake breach: Snowflake breach compromised Ticketmaster, Santander and others via cloud credential abuse.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity did not recede in this dataset, it merely lost the headline race. The report shows vulnerability exploitation at 31% of initial access, but identity-related vectors still total 32% once phishing, credential abuse and pretexting are considered together. That means identity remains structurally tied to breach entry, even when another vector edges ahead in the ranking. The practitioner conclusion is simple: do not downgrade identity controls because the top line changed.

Credential abuse across the breach chain is the more important signal than credential abuse at the door. The report's broader finding that credential abuse appears in 39% of all breaches means login compromise remains a multi-stage enabler, not a single event. This is where IAM, PAM and NHI governance converge: the same identity artefacts that grant access can also preserve attacker presence after first contact. The practitioner conclusion is to govern credential lifecycle as a breach-chain control, not a hygiene task.

Browser-mediated identity activity is the new governance blind spot. The article's discussion of phishing channels, OAuth consent flows, browser-based session theft and third-party access shows that identity now lives in the session layer as much as in the directory. That changes the control boundary for identity security programmes because the thing being abused is often an authenticated browser state, not just a username and password. The practitioner conclusion is to treat browser telemetry as identity telemetry.

Third-party identity hygiene is a lifecycle problem, not a vendor-management problem. The report's third-party findings point to missing MFA, weak password practices and slow remediation of permission issues as durable exposure sources. That is not just a supplier oversight issue, it is an access governance issue that spans onboarding, assurance and offboarding. The practitioner conclusion is to fold third-party identity into the same control model used for internal privileged access.

Identity control failure now looks additive, not substitutive. Vulnerability management pressure is real, but it does not replace identity risk. Instead, attackers are using whichever path is easiest at a given moment, then falling back on credentials, sessions and delegated access to finish the job. The practitioner conclusion is that mature programmes need both patch governance and identity governance, with neither allowed to stand in for the other.

From our research library:

• The 2026 Verizon DBIR found that exploitation of software vulnerabilities became the leading initial access vector in confirmed breaches, accounting for 31% of incidents.

What this signals

Identity security is now a breach-chain discipline, not a front-door discipline. The practical consequence of this DBIR is that teams must measure where credentials, sessions and delegated access show up after entry, because that is where attackers convert access into persistence. Browser-layer visibility, third-party attestation and lifecycle revocation become core controls, not specialist add-ons.

Credential abuse remains the most durable identity pattern even when it is no longer the top initial vector. That matters because programmes that optimise only for first-access ranking can miss the more damaging reality of reused tokens, stale sessions and lingering third-party trust. The right response is to align identity telemetry with the full compromise path, from initial login through post-compromise reuse.

For practitioners

• Prioritise breach-chain identity telemetry Track where credentials, sessions, OAuth grants and reused logins appear after first access, not only where they are entered. Correlate identity events across browser, directory and third-party access paths so credential abuse is visible beyond the initial login moment.
• Shorten the lifetime of usable access Review how long tokens, service credentials and third-party permissions remain valid after the original business need has passed. Align expiration, revocation and reauthorisation with actual access patterns so stolen or stale identity material has less opportunity to persist.
• Separate social engineering channels by control type Do not treat phishing, pretexting and baiting as one undifferentiated awareness problem. Map each channel to the control that can actually see it, including browser-layer inspection for credential-harvesting flows that bypass email security.
• Audit third-party MFA and permission hygiene Identify vendors and integrators with missing MFA, weak password practices or lingering permissions, then review whether their access is still justified. Use the same lifecycle discipline for third-party identities that you apply to privileged internal accounts.
• Build browser visibility into identity operations Instrument the browser session as an identity control point because it is where sessions are created, OAuth consent is granted and many credential attacks succeed. Use that visibility to detect credential reuse, suspicious redirects and unauthorized AI or SaaS access.

Key takeaways

• Verizon's 2026 DBIR does not show identity risk disappearing, it shows identity and vulnerability exploitation running in parallel as competing access paths.
• The stronger signal is across the breach chain, where credential abuse keeps showing up as a recurring mechanism for movement, persistence and follow-on impact.
• Identity programmes should focus on session control, lifecycle revocation and third-party access hygiene because those controls shape what happens after first access.

Key terms

• Credential Abuse: Credential abuse is the use of valid secrets or accounts by an unauthorised party or for unauthorised purposes. In practice, it often looks like normal authentication unless teams correlate context, privilege, and behaviour. It is one of the most persistent ways identity failures become breaches.
• Initial Access Vector: An initial access vector is the first mechanism an attacker uses to enter a target environment. In this context it often includes exploited vulnerabilities or valid credentials, and it matters because every later stage depends on how the attacker gets in.
• Third-Party Identity: An identity issued to a partner, vendor, contractor, or external service that can access internal systems. These identities often sit outside normal employee governance and can become persistent trust paths if they are not reviewed, expired, and revoked on schedule.
• Browser-Layer Identity Control: The use of browser telemetry and policy to govern identity events that happen inside the session, such as login, consent, extension activity, and data movement. It treats the browser as part of the identity stack, not just a rendering surface.

Deepen your knowledge

Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.