Verizon DBIR shows privilege paths matter more than patching

At a glance

What this is: XM Cyber’s analysis of the 2026 Verizon DBIR shows that initial access shifted to vulnerability exploitation, but the more decisive exposure sits in the privilege paths attackers use after entry.

Why it matters: IAM, PAM, and NHI teams need to focus on permissions and trust relationships, because patching alone does not stop a foothold from becoming administrative reach.

Context

The core governance problem is not just how attackers get in, but how far they can move once they do. Attack paths created by permissions, nested groups, misconfigurations, and trust relationships can turn a low-privilege foothold into high-value access without another exploit.

In the 2026 Verizon DBIR analysis, the access model itself becomes part of the risk surface. For identity teams, that shifts attention from only remediating vulnerabilities to understanding which accounts, groups, and delegation patterns create the shortest route to privileged access.

That is why privilege management, not patching alone, becomes the control with the most practical leverage in environments where exposure paths are already embedded in the operating model.

Key questions

Q: What breaks when organisations focus only on patching after initial access?

A: Patch-only remediation closes some entry points, but it leaves permissions, group nesting, and trust relationships intact. That means an attacker who already has a foothold can still escalate through existing identity paths. The practical failure is not just incomplete remediation. It is a false sense of containment while the access model remains exploitable.

Q: Why do privilege paths create so much escalation risk in breach environments?

A: Privilege paths matter because they determine whether low-level access can inherit broader rights without another exploit. When configurations, delegation, and nested groups are poorly controlled, an attacker can move from foothold to admin through the identity structure itself. That is why escalation risk often sits in access topology, not in the original vulnerability.

Q: What are the signs that privilege control is failing in a managed environment?

A: Common warning signs include administrators using elevated accounts for everyday tasks, shared passwords across privileged accounts, and local administrator passwords repeated across many machines. Another strong indicator is frequent privileged logons outside controlled admin channels. If security teams cannot explain who used elevated access, when it was used, and for what purpose, privilege governance is failing.

Q: How should IAM teams decide whether to prioritise patching or access cleanup?

A: If the environment has many open escalation paths, access cleanup should be prioritised alongside patching because it reduces blast radius after entry. Patching remains essential for stopping exploitation, but it does not address inherited privilege, misconfiguration, or account reachability. The right sequencing is to remove the easiest paths to admin while resolving the highest-risk vulnerabilities.

Technical breakdown

Why attack graphs change the way exposure is measured

Attack graphs model how users, groups, permissions, and trust relationships connect inside an environment. Instead of treating access as isolated entitlements, the graph shows whether a low-privilege account can reach an administrative one through existing paths. That matters because exposure is not just a count of vulnerable assets. It is the availability of a route from foothold to outcome. In the DBIR analysis, Verizon used graph-based modelling to show that some organisations have disproportionately open paths, which means the problem is structural, not only transactional. The technical shift is from asking whether a system is patched to asking whether the identity topology makes escalation easy.

Practical implication: map privilege paths, not just account inventories, when you assess escalation risk.

Why patching covers only part of the escalation surface

The DBIR analysis separates initial access from privilege escalation. Vulnerabilities may help an attacker enter, but the report shows most escalation events do not depend on another vulnerability. Instead, escalation is often driven by passwords, configurations, and permissions already present in the environment. That means patching removes only one route into the estate, while the more durable risk sits in identity and configuration relationships that remain exploitable after the first foothold. This is the key architectural issue: remediation teams can be highly efficient at closing software flaws and still leave the privilege model intact. The result is a mismatch between remediation effort and actual attacker pathing.

Practical implication: treat privilege escalation as an identity and configuration problem, not a patch-only problem.

Why privilege management is the highest-leverage control

Privilege management has the strongest effect when it reduces the number of reachable high-value nodes after a compromise. In attack-graph terms, the goal is to break common choke points such as over-permissioned service accounts, nested group membership, and weak delegation. Those nodes matter because one change can collapse many routes at once. The article’s central finding is not that patching is irrelevant. It is that permissions and configurations govern the blast radius once the door is open. For IAM and PAM teams, the technical question becomes which identities, groups, and trust paths create the shortest escalation chains to admin-level access.

Practical implication: prioritise the identities and delegation paths that collapse the most privilege routes when fixed.

Threat narrative

Attacker objective: The attacker’s objective is to convert a low-privilege foothold into administrative access without needing repeated exploitation.

1. Initial access begins with exploitation of a vulnerability, which gets the attacker past the first control boundary.
2. Escalation then follows existing permissions, configurations, and trust relationships rather than another software flaw.
3. Impact occurs when low-level access can reach a key administrative account and expose the crown jewels.

Breaches seen in the wild

• Codefinger S3 ransomware 2025: Codefinger used victims' compromised AWS keys to re-encrypt S3 buckets with SSE-C, set 7-day deletion and demanded ransom for the key.
• Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Privilege paths are now the control plane that matters most. The article’s strongest signal is that the attacker’s route after entry determines real exposure more than the initial exploit itself. Patching remains necessary, but it only addresses a slice of the problem. The field needs to treat permissions topology as a first-class governance object, because that is where reachability to privileged accounts is created or blocked.

Attack graphs expose the mismatch between remediation effort and actual risk. Most programmes still invest their operational energy in vulnerability response because that workflow is visible, measurable, and familiar. The DBIR data shows that this leaves the escalation surface under-governed, especially where configurations and nested access paths do the real work. The implication is that identity security teams should measure exposure by reachable privilege, not by vulnerability counts alone.

Privilege management is the decisive choke point in identity security. The report’s 65% figure for privilege management versus 10% for patches shows where the leverage sits. That does not make vulnerability management obsolete. It does mean that organisations that ignore access topology are optimising the wrong layer of defence. The practitioner conclusion is simple: fix the shortest routes to admin before chasing the longest list of patches.

Permissions hygiene must be treated as attack-path reduction, not housekeeping. Over-permissioned service accounts, nested groups, and misconfigured delegations are not administrative clutter. They are operational routes an attacker can traverse after a foothold. That is why identity governance, PAM, and cloud permission reviews belong in the same risk conversation as patching. The field should stop separating exploit remediation from privilege containment.

The new question is not whether attackers can get in, but how much they can inherit when they do. The DBIR analysis shifts the centre of gravity from perimeter prevention to post-entry containment. Organisations that can shorten or sever escalation paths will reduce breach impact even when initial access succeeds. The practical conclusion is that identity architecture now defines resilience as much as vulnerability management does.

From our research library:

• The 2026 Verizon DBIR found that exploitation of software vulnerabilities became the leading initial access vector in confirmed breaches, accounting for 31% of incidents.

What this signals

Privilege path reduction is becoming a core resilience metric. IAM and PAM programmes should measure how many low-privilege footholds can reach administrative accounts, not just how many accounts are patched or scanned. That is the operational shift the DBIR data points to: exposure is increasingly about reachable privilege, not isolated defects.

Permissions topology now sits beside vulnerability management in the security stack. Organisations that keep treating access reviews as quarterly housekeeping will continue to miss the routes attackers actually use. The programme implication is to align identity governance with attack-path analysis so that risk reduction targets the shortest escalation chains first.

For practitioners

• Map attack paths to administrative reach Model users, groups, service accounts, and trust relationships to identify which footholds can reach key administrative accounts with the fewest hops.
• Rebalance remediation toward privilege controls Shift part of the remediation backlog from patch-only work to over-permissioned identities, nested groups, and delegation paths that create escalation chains.
• Review service accounts for hidden escalation routes Check service accounts, shared roles, and delegated privileges for paths that let low-level access inherit rights far beyond the original task.
• Use choke points to collapse multiple paths Prioritise fixes that remove common nodes in the graph, because one permission change can close many escalation routes at once.

Key takeaways

• The article shows that vulnerability exploitation may get attackers through the door, but the deeper risk is the identity structure that lets them keep moving.
• The DBIR analysis points to a major imbalance between patching effort and the controls that actually reduce escalation paths inside the environment.
• Teams should focus on privilege management, permissions cleanup, and attack-path reduction if they want to shrink breach impact after initial access.

Key terms

• Attack graph analysis: Attack graph analysis maps how an attacker could move through connected weaknesses to reach a target asset. It shifts prioritisation away from isolated findings and toward reachable paths, helping teams focus remediation on exposures that change real adversary options.
• Privilege path: A privilege path is the route an identity uses to move from ordinary access to sensitive systems, data, or administrative functions. It can involve accounts, tokens, roles, or delegated permissions, and it often determines whether a vulnerability becomes a real incident.
• Escalation Surface: The escalation surface is the set of identity, configuration, and permission conditions that allow an attacker to gain greater access after initial entry. It is broader than the vulnerability surface because it includes inherited rights, group nesting, and trust pathways.
• Attack Path Reduction: Attack path reduction is the practice of removing the specific combinations of identity, privilege, and infrastructure that let an attacker move from initial access to business impact. It focuses on reachable compromise routes rather than isolated vulnerabilities or theoretical risk.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.