Verizon DBIR 2025 signals a reset in breach and identity risk

At a glance

What this is: This is ColorTokens’ analysis of four 2025 Verizon DBIR findings, highlighting third-party exposure, zero-day edge vulnerability exploitation, GenAI data leakage, and phishing-reporting behaviour.

Why it matters: It matters because the article shows how breach prevention, identity governance, and operational resilience now intersect across supplier access, human identity, and unsanctioned AI use.

By the numbers:

• According to Verizon, third-party involvement was a factor in 30% of all breaches this year, up from approximately 15% in the previous year.
• The report found that exploitation of vulnerabilities accounted for 20% of all breaches, overtaking phishing at 15%.
• Of employees accessing GenAI on corporate devices, 72% were using a personal email for their account, and another 17% used a corporate email not integrated with company authentication systems.
• Even with ongoing training, the median click rate on phishing simulations remains at 1.5%.

👉 Read ColorTokens’ analysis of the four DBIR findings shaping breach readiness

Context

Verizon’s 2025 DBIR is being used here as a lens on breach resilience, not as a publication review. The core security problem is that modern breaches increasingly bypass the traditional perimeter through suppliers, exposed edge systems, and unmanaged human behaviour, while identity controls remain fragmented across those same environments.

That matters to IAM, PAM, and NHI programmes because the same governance gap shows up in multiple forms: external trust chains, employee authentication choices, and access paths that are created faster than they can be reviewed. For security teams, the question is no longer only who can log in, but which identities, tools, and intermediaries are now shaping the attack surface.

Key questions

Q: What breaks when third-party access is not reviewed continuously?

A: The break is that access stays active long after the business relationship, vendor task, or application purpose has changed. Without continuous review, teams rely on outdated certifications that do not reflect live permissions. The result is uncontrolled delegated access, especially across SaaS and OAuth-connected systems.

Q: Why do exposed edge systems demand a different remediation model?

A: Because the attack window can be effectively zero once a critical flaw is public. Internet-facing systems such as VPNs and gateways are reachable immediately, so defenders need compensating controls, fast isolation, and pre-staged change plans. Calendar-based patching alone is too slow for this exposure class, especially when the asset is part of identity or remote access infrastructure.

Q: How can organisations prove their AI controls are actually working?

A: Look for evidence that policy decisions are logged, sensitive prompts are being redacted or blocked when required, and approved AI interactions are traceable by identity and business context. Effective programmes produce audit-ready records, not just policy text. If the control cannot explain what happened in a session, it is not operational enough.

Q: Who is accountable when AI-accelerated phishing leads to an identity breach?

A: Accountability should sit with the teams that own identity governance, privileged access, and incident containment, not only with security awareness programmes. AI makes phishing faster, but it is the organisation's access design that determines how far stolen credentials can go. If access is broad and durable, governance gaps become breach multipliers.

Technical breakdown

Third-party breach paths and inherited trust

Third-party breaches often succeed because an organisation inherits access, software dependencies, or operational trust without inheriting equivalent control. Once a supplier becomes part of the delivery chain, its compromise can behave like an internal event, especially when credentials, API links, or support pathways already exist. In identity terms, this is a trust propagation problem: the organisation extends confidence to another party’s controls, but the attacker only needs one weak link to cross that boundary. The DBIR’s shift in third-party involvement reflects that reality, not just vendor concentration.

Practical implication: map supplier access paths, shared credentials, and delegated accounts as part of your IAM and third-party risk review.

Why edge devices compress the patch window

Edge devices such as VPNs and internet-facing gateways are exposed by design, so vulnerabilities in them behave differently from internal flaws. Attackers can exploit them directly, and once a critical issue is public, the time available to patch may be effectively zero. That makes calendar-based remediation too slow for the exposure class. From a control perspective, this is a resilience and prioritisation problem as much as a vulnerability management problem, because exposed services need compensating controls, segmentation, and rapid disablement paths when patching cannot keep pace.

Practical implication: treat internet-facing identity and access infrastructure as emergency-remediation assets with compensating controls already pre-approved.

Sanctioned AI use and the identity boundary

The GenAI leakage issue in the DBIR is not only a data-governance problem. It is also an identity problem because employees are routinely creating accounts outside corporate authentication systems, often with personal email addresses, then moving company data into those external services. That breaks visibility, policy enforcement, and auditability. In practice, the organisation loses control over who the true administrative owner is, which security policy applies, and whether the data path can be revoked. The boundary between human identity governance and data security is now much thinner than many programmes assume.

Practical implication: require sanctioned AI access through enterprise identity, logging, and data controls instead of allowing ad hoc account creation.

Threat narrative

Attacker objective: The objective is to turn trusted access paths, exposed services, or unmanaged user behaviour into breach reach, data exposure, and operational disruption.

1. Entry began through trusted third-party relationships, exposed edge devices, or employee use of unsanctioned GenAI platforms outside corporate identity systems.
2. Escalation occurred when attackers or data flows exploited inherited trust, vulnerable internet-facing systems, or external accounts that security teams could not govern centrally.
3. Impact followed as breaches spread through supplier chains, critical systems were compromised, or sensitive company data was leaked into unmanaged external services.

NHI Mgmt Group analysis

Third-party exposure has become an identity problem, not just a supplier-risk problem. When 30% of breaches involve third parties, the practical issue is no longer whether a vendor is trusted, but whether delegated access, support pathways, and shared credentials are governed as part of the identity fabric. IAM, PAM, and NHI teams should treat external trust as an extension of their own control plane, because attackers do.

Edge vulnerability exploitation exposes the limits of calendar-based remediation. The DBIR’s zero-day timing point for critical edge flaws shows that exposed systems now demand containment-first design, not patch-first optimism. This aligns with NIST SP 800-53 and Zero Trust thinking, where segmentation and rapid restriction matter when remediation windows collapse. Practitioners should assume that some internet-facing assets will be attacked before normal change cycles can close the gap.

Sanctioned AI access is now a human identity governance issue. The article’s GenAI leakage findings reveal a broader pattern: employees will create external accounts if the enterprise does not provide usable, governed alternatives. That means identity teams need enterprise authentication, policy enforcement, and visibility around AI tools as much as around SaaS apps. The governance lesson is clear: shadow AI grows fastest where identity controls stop at the login page.

Detection is not the same as resilience. The reporting-versus-clicking paradox in the DBIR is useful because it separates awareness from containment. A workforce can improve reporting rates while still leaving the organisation exposed if identity, segmentation, and response workflows are slow. Security leaders should measure whether human signals reduce dwell time and containment cost, not just whether awareness metrics improve.

Resilience is becoming a control architecture, not a slogan. The article’s broad conclusion is that perimeter thinking no longer matches the mix of supplier trust, exposed systems, and human-led data leakage now shaping breach outcomes. For identity programmes, that means governance has to span the life cycle of access, the origin of trust, and the revocation path for both human and non-human identities. The practitioners who win are the ones who operationalise that end to end.

What this signals

Secret sprawl and unmanaged access are converging problems. When supplier links, edge systems, and AI services all become part of the operational attack surface, access governance has to extend beyond classic human IAM. The practical signal for practitioners is that revocation speed, account ownership, and account provenance now matter as much as authentication strength.

Security programmes need a control model that assumes exposure before remediation. That is the lesson behind the DBIR’s zero-day edge finding and the rise in externally driven incidents. Teams should align their response playbooks with containment-first patterns, using segmentation and rapid restriction as default actions rather than exceptional ones.

The identity boundary is also moving into AI adoption, where enterprise authentication and policy enforcement become the difference between governed use and shadow AI. If organisations cannot see who owns the account, what data moved, and how access can be removed, they do not have a usable control surface.

For practitioners

• Map third-party trust chains Inventory every external relationship that can authenticate, exchange data, or open support access into production. Include delegated accounts, API connections, service portals, and emergency support permissions, then assign ownership for review and revocation.
• Prioritise exposed edge systems Classify VPNs, gateways, and other internet-facing control points as high-urgency remediation assets. Pair patching with compensating controls such as segmentation, temporary restriction, and pre-approved isolation steps when exploit timing is measured in hours, not days.
• Bring AI usage under enterprise identity Require corporate authentication for sanctioned GenAI services and block high-risk account creation patterns, especially personal email sign-ups on unmanaged platforms. Tie policy to logging, data classification, and revocation so AI use remains visible and reversible.
• Use phishing training as a reporting control Measure awareness programmes by reporting speed and triage quality, not only by reduced clicking. Integrate reporting channels with SOC workflows so simulated and real phishing alerts become faster containment signals.

Key takeaways

• Third-party links, exposed edge systems, and unmanaged AI accounts now shape breach outcomes as much as traditional perimeter threats.
• The evidence in the DBIR points to a world where 30% third-party involvement, 20% vulnerability exploitation, and 72% off-policy AI account use all reinforce the same governance gap.
• Security teams should respond by treating trust chains, revocation speed, and enterprise identity visibility as core resilience controls rather than adjacent hygiene tasks.

Key terms

• Third-Party Breach: A third-party breach occurs when an external supplier, partner, or service provider is compromised and that compromise affects the buying organisation. In practice, the risk often travels through shared access, integrations, or data exchange rather than through the target’s own perimeter.
• Edge device exposure window: The edge device exposure window is the period between disclosure of a flaw in an internet-facing system and the point at which defenders can safely contain it. For VPNs, gateways, and similar services, that window can be extremely short, so segmentation, restriction, and emergency response paths become part of the control model.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Containment-Led Resilience: A security posture that assumes prevention will fail often enough that limiting spread becomes the decisive control. It combines segmentation, least privilege, and response isolation so a compromised system cannot easily become a broader incident.

What's in the full article

ColorTokens' full post covers the operational detail this analysis intentionally leaves for the source:

• The vendor’s full breakdown of the four DBIR findings and how each one affects breach readiness planning.
• Specific examples of how microsegmentation and breach containment are positioned for edge and supply chain resilience.
• The article’s full discussion of why reporting behaviour matters operationally, not just as an awareness metric.
• ColorTokens’ own mitigation framing for organisations trying to reduce lateral movement when prevention fails.

👉 ColorTokens’ full post expands on containment strategy, lateral movement reduction, and the implications for 2026 planning.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives identity and security practitioners a practical foundation for governing access, trust, and lifecycle risk across modern environments.