Top 5 data breach causes in 2026 and the identity gaps behind them

At a glance

What this is: This is Zluri’s breakdown of the five most common breach causes in 2026, with the central finding that familiar failure modes still dominate because governance gaps remain unresolved.

Why it matters: It matters because IAM, PAM, and NHI programmes are still being measured by whether they close recurring access and configuration failures, not whether they have been broadly understood for years.

By the numbers:

• Data breaches cost organizations an average of $4.88 million globally in 2025.
• U.S. organizations absorb an even harder hit at $10.22 million per incident.
• Phishing was the initial attack vector in 16% of all 2025 data breaches.
• Credential abuse was the initial access vector in 22% of non-error, non-misuse breaches in 2025.

Context

Data breaches keep following the same failure patterns because the underlying governance gaps have not been closed. In identity terms, that means attackers still succeed when organisations leave authentication, entitlement scope, offboarding, and cloud exposure more loosely managed than the data they are trying to protect.

Zluri’s 2026 analysis treats phishing, weak credentials, unpatched systems, insider activity, and cloud misconfiguration as the recurring breach causes. The important signal for IAM, PAM, and NHI teams is not that these risks are new, but that they continue to align with preventable access and lifecycle failures.

The article also frames breach prevention as an execution problem rather than an awareness problem. That is consistent with identity security practice: most breach paths are enabled by controls that exist in policy but are incomplete in coverage, slow in enforcement, or absent at the moments they matter most.

Key questions

Q: What are the most common causes of data breaches in practice?

A: The most common breach causes are phishing, weak or reused credentials, unpatched systems, insider activity, and misconfigured cloud environments. They stay common because they exploit recurring governance gaps rather than novel exploits. Strong identity assurance, patch discipline, least privilege, and continuous visibility reduce their impact far more reliably than awareness alone.

Q: Why do stolen credentials remain such an effective attack path?

A: Stolen credentials work because many systems still treat a successful login as enough evidence of legitimacy. Once an attacker has valid access, they inherit the subject’s trust context and can often blend in with normal activity. That makes credential theft far more efficient than direct exploitation in many environments.

Q: What breaks when cloud permissions are misconfigured?

A: Misconfigured cloud permissions turn ordinary storage, sharing, or vendor access into direct exposure paths for sensitive data. The breakdown is not only technical. It is governance failure, because resources often lack clear ownership, review cadence, and remediation urgency. That leaves public exposure in place long enough for discovery and abuse.

Q: How should security teams reduce the blast radius of edge compromise?

A: Treat internet-facing gateways as entry points into identity risk, not isolated infrastructure assets. Segment administration, shorten the reach of privileged accounts, and test whether a compromised VPN or firewall can reach directory services, cloud consoles, or OT management paths. If it can, the blast radius is still too large.

Technical breakdown

Why phishing still bypasses identity controls

Phishing works because it targets the trust boundary before technical enforcement begins. Modern campaigns use impersonation, AI-generated content, adversary-in-the-middle interception, and help-desk manipulation to obtain credentials or session access that look legitimate to downstream systems. Once the user or service is tricked into presenting valid authentication, the attacker no longer needs to defeat the firewall; they operate through normal identity flows. This is why phishing-resistant MFA, out-of-band verification, and behavioural detection matter more than message filtering alone. The core weakness is not only the email itself, but the fact that identity assurance can be stolen at the point of use.

Practical implication: Treat phishing as an identity assurance failure, not just an email problem.

How weak and reused credentials become breach entry points

Weak, stolen, or reused credentials remain effective because authentication systems are often treated as proof of legitimacy rather than one signal among several. Credential stuffing, password spraying, and orphaned account abuse all exploit the same condition: an account exists with enough standing access to be useful, and enough persistence to be discovered after the original owner has moved on. In NHI environments, the parallel risk is long-lived secrets or tokens that never age out of use. The mechanism is simple, but the governance failure is structural: identity proofing, credential lifecycle, and entitlement scope are not being managed as a single control surface.

Practical implication: Reduce standing credential exposure by governing password reuse, account dormancy, and credential lifecycle together.

Why unpatched systems and cloud misconfiguration keep appearing together

Unpatched software and cloud misconfiguration often converge because both are inventory problems before they are remediation problems. If you cannot see every internet-facing asset, SaaS workload, storage location, or privileged system, you cannot patch or secure it on a reliable schedule. That creates a long tail of exposure where known vulnerabilities remain reachable and misconfigured resources stay public. In practice, attack success comes from the gap between a discovered weakness and enforced remediation. The operational issue is not simply patch velocity or configuration hygiene in isolation. It is whether the organisation can maintain authoritative asset visibility and attach control ownership to each exposed system.

Practical implication: Tie patching and cloud hardening to authoritative asset inventory and ownership.

Threat narrative

Attacker objective: The attacker’s objective is to obtain unauthorized access to sensitive data and convert a routine control gap into breach-scale operational, financial, or regulatory harm.

1. Entry often begins with phishing, credential abuse, or a misconfigured cloud resource that provides a foothold without requiring a novel exploit.
2. Escalation follows when the attacker leverages reused credentials, excessive privileges, or unpatched systems to move from initial access to broader control.
3. Impact occurs when data is accessed, exfiltrated, encrypted, or exposed through the compromised account, workload, or storage path.

NHI Mgmt Group analysis

Recurring breach causes are really recurring control failures. The article’s five categories are familiar because they map to the same unresolved governance problems: trust, lifecycle, patching, and exposure. That makes this less a threat-intelligence story than a programme-execution story. For practitioners, the real question is whether identity and cloud controls are enforced continuously enough to make these well-known paths materially harder to exploit.

Credential governance is the common denominator across human IAM and NHI risk. Phishing, reused passwords, orphaned accounts, and long-lived secrets all depend on the same assumption: an identity remains valid long enough to be used after its original context has changed. That assumption breaks when offboarding is weak, rotation is slow, or access reviews are too periodic to catch short-lived abuse. Practitioners should treat credential lifecycle as one control plane across users, service accounts, and tokens.

Cloud misconfiguration exposes identity drift as infrastructure drift. Misconfigured storage and third-party access problems are not separate from IAM. They show what happens when permissions, sharing links, and vendor access are allowed to outlive the business decision that created them. The governance implication is clear: entitlement review is no longer only about users. It has to include cloud resources, partner accounts, and every access path that can surface sensitive data.

Identity blast radius is now the decisive concept. The article repeatedly shows that the question is not whether a breach path exists, but how much damage the first compromised identity can reach. Least privilege, segmentation, and continuous review matter because they bound the blast radius after initial access. Practitioners should measure breach resistance by how much can be reached from a single compromised account, not by how many controls exist on paper.

AI changes the speed of familiar attacks, not the underlying failure mode. The article’s phishing discussion shows that generative AI and deepfake tactics make social engineering more scalable and believable, but they do not invent a new category of governance failure. The weakness remains insufficient verification at the moment of access. For identity leaders, that means AI should sharpen controls already designed for human trust abuse, not distract from them.

What this signals

Identity governance is the control layer that turns known breach causes into manageable risk. The article’s pattern is familiar because the failures sit at the boundary between authentication, entitlement scope, and access lifecycle. If teams want fewer breach pathways, they need to govern those boundaries as one programme rather than separate projects.

Cloud exposure and credential exposure are now the same governance problem in different forms. A public bucket, an over-shared SaaS tenant, or a reused password all create the same practical issue: an identity or resource remains reachable after its business justification has changed. That is why access reviews, inventory, and offboarding need to be treated as operational controls, not audit tasks.

AI-assisted phishing raises the standard for verification without changing the underlying security question. The question is still whether the organisation can prove that an access request is real, timely, and justified. The difference in 2026 is that the attacker’s message quality is better, so weak verification becomes easier to exploit.

For practitioners

• Harden phishing-resistant authentication Require FIDO2 or passkeys for privileged users and for any workflow that can reset access, approve payments, or expose sensitive data. Pair that with out-of-band verification for help-desk resets and high-risk requests.
• Shorten credential exposure windows Rotate and revoke long-lived passwords, API keys, and service tokens on a lifecycle schedule that matches their actual use, not a calendar convenience. Remove orphaned accounts as soon as ownership changes.
• Reduce privilege blast radius Review entitlements for users, service accounts, and cloud identities together so that one compromised login cannot reach broad data access. Enforce least privilege where standing access still exceeds job scope.
• Close cloud exposure gaps Inventory public storage, shadow SaaS, and third-party access paths, then attach a named owner and remediation SLA to each exposed resource. Misconfiguration remains a breach path only when nobody owns the fix.
• Operationalise access reviews Move recertification beyond quarterly checkbox exercises for high-risk access and instead trigger reviews when roles, vendors, or systems change. The goal is to catch access that is technically valid but no longer justified.

Key takeaways

• The article shows that most breaches still come from familiar control gaps, not exotic attack chains.
• Its evidence points to phishing, stolen credentials, patch lag, insider misuse, and cloud misconfiguration as repeatable breach drivers.
• The practical response is to govern identity lifecycle, entitlement scope, and cloud exposure as one control plane.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Credential Lifecycle: Credential lifecycle is the process of issuing, rotating, expiring, and revoking secrets, certificates, and tokens across their usable life. For non-human identities, lifecycle discipline is the core control that separates temporary access from persistent exposure.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Cloud misconfiguration: A security failure caused by incorrect permissions, exposure settings, or integration design in cloud services. It is often less about the cloud platform itself and more about access paths that were created quickly, left broad, and never fully revalidated against actual business need.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.