Vulnerability exploitation overtakes credentials: what pen test teams must adjust

At a glance

What this is: FireCompass argues that the 2026 DBIR marks a shift away from credential abuse toward vulnerability exploitation as the dominant initial access path.

Why it matters: For IAM and security teams, the finding means access risk is no longer only about stolen credentials but also about how quickly exposed systems, third-party trust paths, and chained attack paths can be tested and contained.

Context

Vulnerability exploitation is now a governance problem, not just a patching problem. When attackers move through known flaws faster than remediation cycles close them, the control failure spans asset inventory, prioritisation, validation, and response. For identity and access programmes, that matters because many of these paths terminate in privileged sessions, service accounts, or federated trust relationships.

In FireCompass' reading of the Verizon DBIR 2026, the issue is that annual or calendar-based assurance models no longer match the pace of exploitation. The article frames the gap as a mismatch between continuous attacker activity and discrete testing, which is especially relevant where credentials, APIs, VPNs, and third-party access channels intersect.

Key questions

Q: What breaks when vulnerability testing is too infrequent to keep pace with changing attack techniques?

A: When testing is infrequent, teams can mistake a passing control check for real resilience. New exploit paths may remain untested, remediation priorities can drift, and alert noise can hide the vulnerabilities most likely to be weaponised. The result is a SOC that reacts efficiently to incidents but cannot confidently prove prevention is working.

Q: Why does slow remediation increase the chance of a cyber incident becoming a breach?

A: Slow remediation leaves known weaknesses exposed long enough for attackers to find and abuse them. The longer a vulnerability, misconfiguration, or insecure credential remains unresolved, the larger the window for compromise, data theft, and service disruption. Remediation reduces that exposure window, helping organizations contain risk before an attacker can turn a discovered issue into an operational incident.

Q: What do security teams get wrong about third-party access management?

A: They often focus on initial provisioning and underestimate the risk of stale access. The bigger failure is not granting access once, but failing to revoke it when the relationship ends or the business need changes. Without clear ownership and lifecycle triggers, third-party access quietly turns into standing privilege.

Q: How should teams respond when a vulnerability can be chained into production access?

A: They should prioritise the chain, not the individual finding. If a low-severity issue can lead to authentication bypass, privilege escalation, or data access when combined with other conditions, it becomes a high-priority exposure. The right response is to validate the full path and break the link that makes escalation possible.

Technical breakdown

Why exploitation now beats credential abuse

The article’s central mechanism is simple: attackers increasingly choose the path with the weakest remediation discipline, not the one with the most complex login flow. Credential abuse still matters, but MFA, password managers, and identity-aware proxies have raised the cost of that route. Vulnerability exploitation scales because exposed edge devices, VPN concentrators, and file transfer appliances often remain reachable long after public disclosure. That makes exploitability a time-based condition, not a point-in-time event. The practical consequence is that defense must measure exposure windows, not just control presence.

Practical implication: shorten the interval between disclosure, validation, and containment for externally reachable assets.

Why annual pen tests miss the real attack clock

A calendar-driven pen test assumes the relevant risk surface is stable long enough to be sampled later. The article shows that assumption breaking down. If new KEVs appear continuously and median remediation stretches into weeks, then last quarter’s scope is already stale for today’s exposure profile. That creates a structural blind spot: the attacker is testing your environment against this week’s vulnerabilities, while your assurance programme is testing against last season’s. The technical issue is not test depth alone, but cadence and revalidation.

Practical implication: treat validated exposure as a continuous control, not a periodic audit artifact.

Why third-party trust paths and chained access paths matter

The article highlights that many breaches now run through vendors, suppliers, or service providers, which turns trust termination points into exploit surfaces. In practical terms, the weak point is often not the third party itself but the interface where its trust meets your environment: federated identity, API keys, OAuth flows, SFTP access, or service accounts. Once an attacker enters through one of those paths, chained movement becomes the real concern because a low-friction foothold can lead to production data, administrative access, or broader domain impact. That is why surface-only scanning is insufficient.

Practical implication: test the trust boundary itself, including delegated access, service accounts, and federated sessions.

Threat narrative

Attacker objective: The attacker’s objective is to turn a publicly known flaw into reliable access that can be expanded into data theft, administrative control, or broader compromise.

1. Entry often begins with exploitation of a known vulnerability on an internet-facing device, appliance, or application that remains unpatched after disclosure.
2. Escalation occurs when the initial foothold is converted into usable access through weak privilege boundaries, exposed trust relationships, or reused credentials.
3. Impact follows when attackers pivot into adjacent systems, reach sensitive data, or establish a durable presence through chained attack paths.

Breaches seen in the wild

• New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.
• United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Continuous exploitability has become the real exposure metric: once a vulnerability is publicly exploitable, the control question is no longer whether it exists but how long it remains weaponisable in your environment. FireCompass' analysis of the DBIR points to a market-wide failure to treat remediation latency as a security variable. For IAM and NHI programmes, that same logic applies to service accounts, API keys, and federated trust paths when they terminate in exploitable systems. Practitioners should measure exposure windows, not just patch counts.

The annual pen test model is now out of sync with attacker behaviour: the article shows a world where exploitation, disclosure, and chaining happen continuously, while assurance still often happens quarterly or yearly. That creates a governance debt problem: the organisation believes it has validated risk, but only for a past state of the environment. Identity teams should read that as a warning that trust relationships and delegated access need continuous validation, not annual certification. Practitioners should re-baseline offensive testing around live exploit conditions.

Third-party access surface: is the named governance gap this article exposes. The breach path is no longer just direct compromise of the enterprise perimeter; it is the trust boundary where vendors, suppliers, federated identity, and service accounts intersect with internal systems. That boundary is often over-assumed to be safe because it is contractually trusted, not technically validated. Practitioners should bring delegated access, authentication strength, and privilege scope into the same control conversation as patching and external exposure.

Identity controls now have to follow attack paths, not organisational charts: the article makes clear that attackers do not care where responsibility sits if a weakly governed trust path leads to production. That means IAM and PAM teams must think in terms of exploitable paths from entry to privilege, especially where APIs, SSO, and service identities are involved. Practitioners should align control ownership to the trust path itself, not to a single team boundary.

Continuous offensive validation is becoming a baseline expectation: the article implicitly argues that scanners and one-off assessments are no longer enough when exploitable conditions change week by week. The field is moving toward evidence-backed testing that proves whether a vulnerability is reachable, chainable, and exploitable in context. For security leaders, that means shifting assurance investment from static coverage metrics to validated exposure outcomes. Practitioners should demand proof, not just findings.

From our research library:

• The 2026 Verizon DBIR found that exploitation of software vulnerabilities became the leading initial access vector in confirmed breaches, accounting for 31% of incidents.

What this signals

Continuous exploitability is the new assurance baseline: the article shows why organisations can no longer rely on static test windows when vulnerabilities, disclosures, and weaponisation move on different clocks. That is especially relevant for teams running IAM, PAM, and NHI programmes, because exposed systems often become the launch point for credential theft, service account abuse, or delegated access misuse.

Third-party trust boundaries need technical proof, not policy assumptions: vendor access, federated sessions, and API-linked service identities should be treated as live attack paths until they are tested in context. For practitioners, the practical shift is to validate where external trust actually terminates and whether that termination point can be escalated or chained.

Attack-path validation is becoming more important than isolated vulnerability scoring: a single CVE number matters less than whether it can be used to reach production data or administrative control. Security programmes that can prove reachability and blast radius will make better prioritisation decisions than those that only track scan output.

For practitioners

• Rebaseline pen test cadence to exploit windows Move from annual or biannual engagements to continuous validation for internet-facing assets, especially where new KEVs could create immediate exposure. Prioritise tests that confirm exploitability in your own environment rather than generic vulnerability presence.
• Test third-party trust paths explicitly Include federated identity flows, VPN dependencies, SaaS admin interfaces, API keys, SFTP endpoints, and contractor access in scope. The goal is to verify where a vendor or supplier can actually reach, not just where policy says they should.
• Track remediation against KEV exposure Measure how many confirmed exploited vulnerabilities remain open, how long they stay open, and which business services they affect. Use that data to drive prioritisation for external assets, appliances, and known internet-facing services.
• Validate chained attack paths, not isolated findings Require offensive testing that shows whether one foothold can lead to privilege escalation, lateral movement, or sensitive data access. A single vulnerability score is not enough if the attacker can chain it into production impact.

Key takeaways

• The article shows a structural shift in breach entry, with vulnerability exploitation overtaking credentials as the leading initial access path.
• Slow remediation and continuous disclosure are widening the window in which known exploitable vulnerabilities remain usable to attackers.
• Security teams need assurance that tests prove exploitability, trust-boundary reach, and chained impact rather than simply listing findings.

Key terms

• Continuous Offensive Validation: Repeated offensive testing that tracks environment change and rechecks exposures rather than relying on a single assessment date. It is most useful when paired with ownership, retesting, and closure measurement.
• Known Exploited Vulnerability: A Known Exploited Vulnerability is a flaw that has confirmed active exploitation in the wild and is tracked for urgent remediation. In governance terms, KEV status turns patching from a general hygiene task into a time-bound operational obligation.
• Attack path: A sequence of identities, permissions, systems, and data stores that an attacker can traverse after obtaining trusted access. In practice, attack paths matter more than single accounts because they show how a low-risk identity can become a route to high-value exposure.
• Third-party trust boundary: A third-party trust boundary is the point where an organisation relies on an external party to communicate, authenticate, or initiate business actions. It is not static. In practice, it changes as contacts, domains, workflows, and privileges change, which is why it must be continuously governed.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is built for practitioners who need to connect identity controls to the wider security programme.