Verizon DBIR 2026 shows identity is still the breach engine

At a glance

What this is: This is an analysis of Verizon's 2026 DBIR, which shows identity remains central to breach chains, ransomware timing, and recovery cost.

Why it matters: It matters because IAM, PAM, and NHI programmes now influence both initial access and how fast an organisation can recover after ransomware or tenant compromise.

By the numbers:

• The 2026 DBIR analyzed over 22,000 confirmed breaches across 145 countries.
• Credential abuse remained the single most pervasive technique at 39% across full breach chains.
• Ransomware hit 48% of breaches in the 2026 DBIR.
• Third-party breaches jumped 60% year over year in the 2026 DBIR.

Context

Verizon's 2026 Data Breach Investigations Report puts identity security back at the centre of breach analysis. The report shows that credential abuse remains deeply embedded in attack chains, while ransomware recovery outcomes now depend heavily on whether identity infrastructure and backups survive the incident.

For IAM teams, the important shift is that identity is no longer only an access problem. It is also a resilience problem, because compromised credentials, misconfigured MFA, and damaged tenant controls can determine how quickly the business restores authentication and contains blast radius.

The article frames this through a programme lens: the organisations that treat identity as recoverable infrastructure fare better than those that treat it as static configuration.

Key questions

Q: What breaks when identity visibility is missing during a ransomware attack?

A: Containment becomes guesswork. Security teams cannot tell which accounts are active, what they can reach, or which privileged paths they unlock, so they often default to broad shutdowns or partial revocation that leaves access open elsewhere. The result is longer outages, more manual work, and higher risk that attackers keep moving while teams investigate.

Q: Why do compromised credentials so often lead to broader access after initial login?

A: Compromised credentials often become a foothold because attackers inherit the targeted user’s trust, network reach, and authentication context. From there, they can enroll new MFA devices, pivot through VPN or remote access paths, and search for higher privileges. Once inside, weak segmentation and overbroad permissions turn one account compromise into a wider breach opportunity.

Q: How can organisations prove that identity controls support resilience?

A: By showing that access governance still holds during disruption, that audit trails are complete, and that recovery processes restore control quickly. If those outputs exist, compliance stops being abstract and becomes evidence of operational stability.

Q: Should security teams treat NHIs and human admin accounts under the same recovery plan?

A: Yes, because the recovery dependency is the same even if the actor type differs. Service accounts, API keys, OAuth links, and human admins all sit inside the authentication path. A recovery plan that ignores NHIs leaves part of the tenant unrecoverable when a breach hits.

Technical breakdown

Credential abuse across the full breach chain

Credential abuse is often discussed as an initial access issue, but the DBIR framing shows it persists across the whole attack sequence. That matters because stolen logins, tokens, and infostealer-farmed credentials can support persistence, privilege escalation, and lateral movement long after the first login. In identity terms, the attacker does not need to stay noisy if the account already carries enough authority to move. The technical point is that credential compromise becomes an attack substrate, not a single event. That is why detection at first use is less valuable than control over credential issuance, scope, and reuse.

Practical implication: monitor credential use as a lifecycle problem, not just an authentication event.

Why third-party identity hygiene breaks cloud trust

The report's third-party breach findings point to a familiar failure mode: trust extended to external accounts and integrations outlives the controls around them. If MFA is disabled, misconfigured, or left unresolved for months, the issue is not only exposure. It is persistent delegated access with weak assurance, especially where admin accounts, service relationships, or cloud tenants are involved. For NHI and human identity programmes alike, the technical risk is that offboarding, policy drift, and configuration debt create a long window in which a trusted identity remains exploitable. That is a governance failure as much as a control failure.

Practical implication: treat third-party identities and cloud admin accounts as governed lifecycles with continuous assurance, not one-time approvals.

Backup integrity determines whether identity recovery is survivable

When ransomware reaches identity infrastructure, recovery depends on whether identity state can be restored cleanly. Configurations, policies, admin assignments, and federated trust settings are part of that state. If backups are compromised, corrupted, or absent, the organisation cannot simply restore files and resume operations because authentication itself may remain broken. That is why identity resilience is different from ordinary data backup. The recovery target is not only data durability but the ability to re-establish trusted access without rebuilding the tenant from memory. The report's recovery comparison is a reminder that identity is often the dependency that everything else waits on.

Practical implication: back up IAM configuration as recoverable infrastructure and test restore paths before an incident forces the issue.

Threat narrative

Attacker objective: The objective is to turn identity access into durable operational control, then use that control to accelerate ransomware impact and raise recovery cost.

1. Entry begins with credential compromise or infostealer collection, which gives attackers a legitimate-looking foothold instead of a noisy exploit path.
2. Escalation follows when stolen identities are used to weaken MFA, alter IAM settings, or reach privileged functions inside the tenant.
3. Impact arrives when ransomware or broader intrusion uses that access to disrupt authentication, block recovery, or increase extortion leverage.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
• Snowflake breach: Snowflake breach compromised Ticketmaster, Santander and others via cloud credential abuse.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential abuse is now a breach-chain property, not just an access vector. The DBIR's 39% figure should be read as evidence that stolen credentials continue to matter after initial entry, not only at the door. That changes the governance problem for IAM teams because the same identity can support persistence, lateral movement, and recovery disruption. The implication is that credential lifecycle control has become a cross-stage control, not a point-in-time check.

Identity recovery is a resilience discipline, not a backup checkbox. When ransomware reaches IAM state, restore speed depends on whether trust configuration, admin assignments, and policy state were preserved in a recoverable form. This is where conventional backup thinking fails because the business depends on authentication before it can depend on applications. The implication is that identity infrastructure must be treated as a tier-one recovery dependency under NIST-CSF recovery thinking and NIST 800-53 configuration and access control expectations.

Third-party access without lifecycle offboarding creates a standing trust debt. The DBIR's third-party findings reinforce a pattern where external accounts, cloud admin access, and misconfigured MFA remain exploitable long after the original business need has changed. That debt is especially visible in NHI environments, where service access is often easier to grant than to retire. The implication is that governance has to follow delegated access continuously, not only at onboarding.

Backup integrity is the identity control that changes ransomware economics. The 8x recovery cost gap shows that resilience is not abstract governance language but a financial variable with measurable operational effect. If identity state is recoverable, attackers lose leverage faster and restoration becomes bounded. If it is not, the incident expands into a prolonged authentication outage. Practitioners should therefore evaluate IAM backup and restore capability as part of resilience, not infrastructure housekeeping.

Identity governance now spans humans, NHIs, and recovery state. This report makes clear that access governance cannot stop at user provisioning or periodic review. Service accounts, cloud admin accounts, OAuth links, and tenant settings all sit in the same blast radius once compromise begins. The implication is that identity architecture, privilege management, and recovery design now have to be planned together, because the attacker will use whichever layer fails first.

From our research library:

• Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
• Read next: NHI Lifecycle Management Guide

What this signals

Identity resilience has become a recovery control, not a comfort metric. The DBIR pattern shows that organisations lose time and money when they treat IAM as static configuration instead of recoverable infrastructure. If the tenant cannot be restored cleanly, authentication becomes the bottleneck that governs every other recovery task.

Ephemeral access does not remove identity debt when backup state is weak. A privileged session that is compromised or misconfigured can still leave behind policy drift, altered federation settings, and damaged trust relationships. The programme question is no longer whether identity was breached, but whether the identity layer can be returned to a known-good state before the business outage expands.

For practitioners

• Audit identity recovery dependencies Map which IAM tenants, policy objects, admin roles, and federation settings must be restored before business systems can authenticate again.
• Tighten third-party and admin MFA hygiene Find cloud and external identities with missing or disabled MFA, then track remediation as a closure programme rather than a one-off ticket queue.
• Treat infostealer exposure as a ransomware precursor Correlate stolen credential telemetry with privileged identity assets so the response starts before an attacker reaches tenant-wide control.
• Validate immutable backups for identity state Test whether identity configurations can be restored without rebuilding policies, assignments, and integrations from scratch.
• Inventory non-human identities in recovery planning Include service accounts, API keys, and OAuth-linked identities in the same resilience plan used for human admin access.

Key takeaways

• Credential abuse remains a major breach-chain problem because it carries attackers beyond initial access into persistence and escalation.
• The report ties ransomware recovery outcomes to identity and backup integrity, showing that recovery cost changes sharply when authentication state cannot be restored cleanly.
• Identity teams should govern recovery, third-party access, and credential lifecycle together because the same failure can affect access, containment, and restoration at once.

Key terms

• Identity resilience: Identity resilience is the ability to keep authentication, authorisation, and recovery functions operating when identity systems are attacked or degraded. In practice it means trusted access can be restored without reintroducing compromised state, and with enough evidence to prove the restored identity plane is clean.
• Credential Abuse: Credential abuse is the use of valid secrets or accounts by an unauthorised party or for unauthorised purposes. In practice, it often looks like normal authentication unless teams correlate context, privilege, and behaviour. It is one of the most persistent ways identity failures become breaches.
• Third-Party Identity: An identity issued to a partner, vendor, contractor, or external service that can access internal systems. These identities often sit outside normal employee governance and can become persistent trust paths if they are not reviewed, expired, and revoked on schedule.
• Backup Integrity: Backup integrity is the assurance that a backup can be restored successfully and contains the expected data. It is not enough to create copies. Organisations must verify that backups are complete, usable, and recoverable before they depend on them for resilience, continuity, or incident recovery.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.