Verizon DBIR 2026 shows credential abuse is down but not out

At a glance

What this is: This analysis of Verizon DBIR 2026 says vulnerabilities overtook credential abuse as the top initial access vector, but credential misuse still appears in 39% of breaches overall.

Why it matters: IAM, NHI and customer identity teams need to treat this as a governance shift, not a reprieve, because access scope, token expiry and partner authentication still shape breach outcomes.

By the numbers:

• Exploitation of vulnerabilities reached 31% of breaches as the first known initial access vector, up from 20% in 2025.
• Credential abuse fell to 13% as a first initial access vector, but it still appeared in 39% of breaches when counted anywhere in the breach progression.
• Third-party involvement grew to 48% of breaches, up 60% year over year.
• The median time to full remediation for critical vulnerabilities rose to 43 days.

Context

The security gap here is not that credentials stopped mattering. It is that initial access and post-entry abuse no longer tell the same story, which makes one-time access metrics a poor proxy for identity risk.

For identity governance teams, this is a customer, partner and non-human identity problem at once. The article argues that the real control surface has moved to authentication strength, token lifetime, least privilege and the ability to revoke delegated access cleanly.

The article also links this shift to shadow AI and third-party access patterns, where ungoverned accounts and scoped tokens create exposure that conventional perimeter thinking does not capture.

Key questions

Q: What breaks when credential abuse is no longer the first step in a breach?

A: Security teams can over-focus on initial access and miss the identity abuse that actually drives persistence and exfiltration. When attackers enter through a vulnerability or pretext, they often still rely on stolen credentials, OAuth tokens, or service accounts to move laterally. The result is a false sense of progress if only login controls improve.

Q: Why do third-party access failures keep showing up in breach investigations?

A: Because partner access often inherits weak MFA, poor rotation and overly broad permissions, then remains active long after the business need changes. Once a token or account is shared across tenants, it becomes part of your attack surface even if the initial mistake happened outside your organisation.

Q: How should security teams govern OAuth tokens as non-human identities?

A: Security teams should assign ownership, expiry, and revocation rules to OAuth tokens just as they would for service accounts or API keys. That means tracking where tokens are issued, what scopes they hold, how long they remain valid, and when they are rotated or revoked after suspicious use.

Q: What is the difference between patching exposure and identity remediation?

A: Patching reduces the chance that an external service becomes the first foothold, while identity remediation reduces how much authority an attacker can use after entry. Both matter, but they solve different failure modes. Organisations need to run them as separate control loops with separate ownership.

Technical breakdown

Why vulnerability exploitation overtook credential abuse at the entry stage

The DBIR’s initial access figures describe the first visible foothold, not the full attack lifecycle. When patching lags, exploited vulnerabilities become an easier entry path than credential theft, especially where exposed services, internet-facing applications or stale systems remain unremediated. That does not reduce identity risk. It simply means attackers are choosing the cheapest front door first and then still reaching for credentials, tokens or permissions once inside. For IAM and NHI programmes, the operational mistake is reading entry-vector drift as a control win. It is really a sign that remediation velocity and access governance are failing in different parts of the chain.

Practical implication: Treat initial access change as a signal to tighten remediation and delegated-access controls together, not separately.

How credential abuse remains the dominant post-entry pattern

Credential abuse is broader than password theft. It includes stolen usernames and passwords, OAuth tokens, API keys, session material and other secrets that let an attacker act as an authorised identity. That is why it can fall as an initial access vector while remaining common elsewhere in the breach chain. Once an attacker has any foothold, identity reuse, standing privilege and weak revocation become force multipliers. The practical problem is that many programmes still measure only whether a secret was exposed, not whether it remained valid long enough to be abused across multiple systems or tenants.

Practical implication: Map credential and token controls to the full attack progression, including revocation, expiry and privilege scope.

Why third-party and shadow AI access create the same governance problem

Third-party access and shadow AI both weaken the organisation’s ability to prove who or what is acting, under whose authority, and with what scope. In partner scenarios, stolen OAuth tokens and disabled MFA turn delegated trust into breach fuel. In shadow AI scenarios, personal accounts and unscoped access remove observability from identity governance entirely. The common failure is not technology choice, but unmanaged delegation. Whether the subject is a vendor, a customer or an AI-driven account, the governance model breaks when access is allowed to outlive the context in which it was granted.

Practical implication: Inventory delegated identities, bound their scopes and make revocation a routine governance action rather than an exception.

Threat narrative

Attacker objective: The attacker aims to convert one foothold into durable authorised access that can be used for data theft, privilege abuse or partner compromise.

1. Entry occurs through exploited vulnerabilities, which the DBIR shows became the leading first known initial access vector at 31% of breaches.
2. Once inside, attackers abuse credentials, tokens or other secrets because access pathways still exist after the first foothold.
3. Impact follows when delegated access remains valid long enough for exfiltration, privilege use or downstream compromise across partner and cloud environments.

Breaches seen in the wild

• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.
• LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential abuse did not stop being the central identity risk just because it stopped being the first initial access vector. The DBIR’s methodology change matters, but it does not erase the underlying pattern: attackers still rely on stolen credentials, tokens and delegated access after they get in. Identity programmes that focus on first-step compromise miss the larger breach condition, which is that valid access often survives long enough to be reused. The practitioner conclusion is simple: measure where credentials travel and how long they remain usable, not just where they were first exposed.

Third-party access without lifecycle offboarding is the governance failure the 2026 DBIR keeps exposing. The article points to missing MFA, poor credential rotation and weak least privilege as recurring causes in partner-related breaches. That is not a collection of isolated mistakes; it is a lifecycle problem in which delegated trust outlives the business context that created it. The implication is that partner identity governance must be treated as an access lifecycle, not a one-time integration task.

Token governance has become the practical boundary of modern identity security. Passwords, OAuth tokens and other secrets behave differently, but they all fail when scope, expiry and revocation are treated as optional details. The article’s focus on scoped tokens and revocation shows why blast radius now depends more on token governance than on pure authentication strength. The practitioner conclusion is that access must be designed to die on schedule or on demand.

Shadow AI is already a non-human identity governance problem, not a future agentic one. The article shows employees using AI through personal accounts and unscoped access, which removes those interactions from ordinary audit and control paths. That is the same structural issue identity teams face with unmanaged service accounts: authority exists, but governance does not. The implication is that agentic identity will inherit today’s shadow access failures unless organisations first fix inventory, authority binding and observability.

Identity blast radius is now the better metric than login success. The most important question is no longer whether a credential was stolen, but how much authority it carried across customers, partners, clouds and AI-enabled workflows. The DBIR findings show that breach paths often cross organisational boundaries long after the initial entry event. The practitioner conclusion is to reduce the amount of reusable authority each identity can carry.

From our research library:

• Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Identity blast radius now matters more than first access alone. If a breach can begin through exploitation but still depend on stolen credentials later, then the control objective shifts from stopping every entry to shrinking the authority each identity can carry. That means tighter scoping, shorter lifetimes and cleaner revocation for both human and non-human access.

Shadow AI is the early warning signal for agentic identity sprawl. The same governance failure appears when employees use personal AI accounts and when service identities outlive the task they were meant to perform. Organisations that cannot inventory delegated access today will struggle to govern autonomous access tomorrow.

According to the State of Secrets Sprawl 2026, AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers. That reinforces the DBIR’s core message: the problem is not just breach entry, but the volume and persistence of exposed authority after the first event.

For practitioners

• Audit the full credential path, not just the first compromise Track where passwords, OAuth tokens, API keys and session material remain usable after initial exposure, then retire the identities that still have standing authority across systems or tenants.
• Put hard expiry on delegated access Require every partner token, service credential and machine-issued secret to expire by design, with revocation tied to business context rather than manual exception handling.
• Re-check third-party MFA and least privilege Validate that partner-facing accounts cannot operate with disabled MFA, broad admin rights or unmanaged scoping, especially where cloud and SaaS access is externally administered.
• Separate patching from identity remediation Treat vulnerability remediation backlog and credential hygiene as connected but distinct workstreams so that a drop in one risk does not hide persistent exposure in the other.
• Create an inventory for shadow AI access Identify AI use through personal accounts, unmanaged tools and unscoped permissions so those interactions can be brought under auditable identity governance.

Key takeaways

• The DBIR shows that entry tactics are changing, but identity abuse remains embedded throughout the breach lifecycle.
• Third-party access, weak MFA and poor token governance keep turning delegated trust into a persistent breach condition.
• The most effective response is to reduce reusable authority through tighter scoping, expiry and revocation rather than relying on initial access controls alone.

Key terms

• Credential Abuse: Credential abuse is the use of valid secrets or accounts by an unauthorised party or for unauthorised purposes. In practice, it often looks like normal authentication unless teams correlate context, privilege, and behaviour. It is one of the most persistent ways identity failures become breaches.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Token governance: Token governance is the control of credential lifecycle, scope, and runtime use for non-human identities. It combines inventory, issuance policy, behavioral monitoring, and revocation so that access remains limited, visible, and accountable across dynamic environments.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.