TL;DR: The 2026 Verizon DBIR shows ransomware in 48% of breaches, third-party breaches at 48%, vulnerability exploitation at 32%, and credential abuse in 39%, while AI is helping attackers scale familiar techniques faster across 793 tracked threat actors, according to Senserva. Point-in-time compliance is losing relevance as breach reality moves faster than review cycles.
At a glance
What this is: This analysis says the 2026 Verizon DBIR shows breach patterns widening across ransomware, third-party exposure, vulnerability exploitation, credential abuse, and AI-assisted attacker scaling.
Why it matters: It matters because compliance and assurance teams can no longer rely on static evidence alone when breach drivers are changing faster than assessment cycles.
By the numbers:
- 48% of all breaches now involve ransomware.
- Third-party breaches reached 48% of all breaches in the dataset.
- Exploitation of vulnerabilities rose from 16% to 32% as an initial access vector.
- Credential abuse still appears in 39% of breaches across the full attack chain.
Context
The primary issue in this DBIR analysis is not simply rising breach volume. It is the widening gap between documented compliance and the technical state that attackers actually encounter, especially where identity, configuration, and third-party exposure change after an assessment closes.
For compliance and security assurance teams, the practical question is whether a control exists on paper or is continuously true in the environment. The report argues that AI is accelerating attacker tradecraft, which makes stale evidence, self-attestation, and point-in-time reviews increasingly unreliable.
That shift is especially relevant where vulnerability remediation, MFA enforcement, and cloud permissions are managed through periodic review rather than continuous validation. The article frames that condition as a governance problem, not just a detection problem.
Key questions
A: They should validate controls with live technical evidence, not just documents or questionnaires. The key test is whether identity settings, cloud permissions, and remediation status still match the approved posture when measured in production. If the environment can drift between audits, the programme must measure drift continuously and treat mismatches as control failures.
Q: Why do third-party breaches keep increasing even when vendors have attestations and questionnaires?
A: Because attestations describe a point in time, while breach paths depend on the current state of access, privilege, and configuration. If the vendor can reach your environment, the real question is whether authentication, permissions, and enforcement are still correct today. Questionnaires help with governance, but they do not prove current exposure.
Q: What are the signs that cloud compliance evidence is out of date?
A: The clearest signs are unresolved MFA gaps, stale permission assignments, delayed remediation of known vulnerabilities, and assessment results that do not match live configuration scans. When the documented posture is clean but the technical state keeps changing, the programme has lost evidentiary value.
Q: Should organisations prioritise continuous technical visibility over periodic compliance reviews?
A: Yes, when the objective is to understand real exposure. Periodic reviews still matter for governance, but they are not enough when attackers move faster than assessment cycles. Continuous visibility gives teams the current state needed to decide whether a control actually exists, rather than whether it existed last quarter.
Technical breakdown
Why point-in-time assurance fails against drifting cloud posture
Point-in-time assurance assumes the security state observed during a review remains representative long enough to be meaningful. In cloud environments, permissions, MFA settings, and configuration drift can change minutes after an assessment ends, especially when multiple teams and third parties administer the same estate. That makes documentation a lagging indicator, not a control. The technical failure is not that evidence is absent, but that the evidence window is too narrow to reflect continuous exposure. Practical implication: measure live configuration and identity state, not just whether a control was signed off during the last review.
Practical implication: move from periodic attestation to continuous technical validation of cloud and identity posture.
How AI changes attacker throughput without changing the underlying attack chain
The article’s core point is that AI is not necessarily inventing new attack techniques, but it is compressing the time and skill needed to execute known ones. That means phishing, reconnaissance, exploitation planning, and cleanup can happen faster and at larger scale, with more variation in tactics across the same campaign. For defenders, the technical change is throughput: more attempts, more adaptation, and less time between a weakness appearing and being targeted. Practical implication: detection and remediation processes must assume shorter attacker dwell times and faster iteration across familiar ATT&CK patterns.
Practical implication: tune detection and response for speed, not just technique coverage.
Why third-party access is now an identity governance problem, not only a vendor risk problem
The report ties third-party breach growth to insecure authentication, excessive privilege, and misconfiguration. That combination means the real exposure often sits inside delegated access paths, service integrations, and externally managed admin relationships rather than only in the vendor contract. Once a third party can reach your environment, their credentials, permission scope, and enforcement state become part of your identity boundary. Practical implication: vendor assurance must include live access evidence, privilege scope, and enforcement checks inside the connected environment, not just questionnaires and certifications.
Practical implication: govern third-party access as part of IAM and privilege control, not only procurement review.
NHI Mgmt Group analysis
Point-in-time assurance is no longer a reliable proxy for breach exposure: The DBIR shows that assessment artifacts can lag the environment they claim to describe. When vulnerability remediation takes months and identity settings drift continuously, a passed review only proves the state at the moment of inspection. The practitioner conclusion is that continuous technical evidence now matters more than periodic assurance theatre.
AI has become an attacker throughput multiplier, not a separate threat class: The important shift is operational, not conceptual. AI is helping adversaries move faster through research, technique selection, and campaign variation, which means existing controls face compressed response windows. The practitioner conclusion is that security programmes must be judged by how quickly they detect and correct drift, not by whether they can describe the drift after the fact.
Third-party breach growth is really delegated identity growth: The DBIR’s third-party numbers point to a wider governance failure around external access paths. In practice, the issue is not just vendor trust but whether external credentials, admin rights, and permission misconfigurations are continuously governed inside the environment. The practitioner conclusion is that vendor risk and identity governance can no longer be separated at the operational layer.
Continuous visibility is the control model compliance has been missing: The article makes clear that questionnaires, static attestations, and delayed remediation are not built for environments where exposure changes faster than review cycles. That creates an identity blast radius problem across human admins, third-party accounts, and cloud permissions. The practitioner conclusion is to treat live posture as the control plane, not the audit appendix.
Compliance maturity now depends on whether controls are measurable in motion: Runtime governance gap: assurance programmes designed around stable evidence are failing because the thing they certify is not stable. The article shows that the gap is not lack of policy but lack of continuous proof that policy still matches reality. The practitioner conclusion is that governance teams need evidence that survives operational drift, not just documentation that predates it.
From our research library:
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
What this signals
Runtime governance gap: compliance programmes are increasingly being measured against a moving target. When identity settings, cloud permissions, and third-party access can drift between reviews, the meaningful control is continuous evidence, not static approval.
Security teams should expect more cases where the documentation is accurate for the day it was signed but false for the day the attacker arrives. That means assurance workflows need to treat live posture as the source of truth and use drift as an operational signal, not an audit surprise.
For practitioners
- Implement continuous configuration validation Track MFA status, permission changes, and cloud policy drift continuously instead of waiting for the next assessment cycle. Use live evidence from the environment as the basis for assurance, especially where admin settings can change after a review is complete.
- Rework third-party access reviews Validate vendor and partner access with the same rigor used for internal privileged accounts, including scope, enforcement state, and current connectivity into your environment. Treat externally managed access as part of your identity boundary.
- Shorten remediation loops for known weaknesses Prioritise weak passwords, misconfigurations, and known-exploited vulnerabilities with time-bound ownership and closure checks. Long remediation cycles create an exposure window that compliance paperwork does not reduce.
- Test assurance with technical evidence Compare questionnaire responses and attestations against actual configuration data from identity, endpoint, and cloud control planes. If the two do not match, treat the assessment as incomplete rather than approved.
Key takeaways
- The article frames compliance failure as a measurement problem as much as a control problem, because posture can drift after the review that certified it.
- The strongest evidence in the DBIR is not a single breach statistic but the combination of faster attacker tradecraft, slower remediation, and wider third-party exposure.
- Teams that want meaningful assurance need continuous technical visibility into identity, cloud configuration, and vendor access, or they will keep certifying states that no longer exist.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OV-01 — Oversight of Risk Management Strategy | The article is about whether compliance evidence still reflects operational reality. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article repeatedly ties breach risk to permissions, MFA, and access drift. | |
| Recommendation — Align assurance reviews to live operational evidence instead of static attestations. Continuously validate permissions and authentications against approved access boundaries. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Credential abuse and exploit-driven access are central to the breach patterns discussed. |
| Recommendation — Map breach indicators to credential access and lateral movement to prioritise detections. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article highlights account state drift, disabled MFA, and mismanaged admin access. |
| Recommendation — Review account lifecycle and privileged access controls for continuous enforcement, not periodic sign-off. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | The article links breach exposure to weak or inconsistent enforcement of authentication controls. |
| Recommendation — Audit authentication enforcement paths and revoke any access that does not require strong verification. | ||
Key terms
- Compliance Drift: Compliance drift is the gap between what a policy says, what the procedure requires, and what the organisation actually does. It usually appears when ownership is unclear, version control is weak, or evidence is collected too late to prove control operation.
- Continuous visibility: The ability to observe control operation, exceptions, and remediation as they happen across systems. In identity and governance programmes, continuous visibility means teams can trace who approved what, what changed, and whether the control actually executed without waiting for a later review cycle.
- Third-Party Access Governance: Third-party access governance is the control set that tracks, approves, reviews, and revokes access granted to external vendors and partners. It becomes an identity problem when suppliers operate through shared credentials, delegated workflows, or persistent machine access that outlives the business need.
- Assurance evidence: The reports, logs, certifications, and operational artefacts that show an identity control is working as intended. For practitioners, assurance evidence matters because audits and customer reviews depend on demonstrable control performance, not policy statements alone.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 8, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org