Vulnerability exploitation overtakes credentials: what pen test teams must adjust

At a glance

What this is: FireCompass analyses Verizon DBIR 2026 data and argues that vulnerability exploitation has overtaken credential abuse as the dominant initial access path.

Why it matters: For IAM, PAM, and NHI practitioners, the shift matters because access control is no longer the only front door, and exposed vulnerabilities now intersect with identity, secrets, and third-party trust paths.

By the numbers:

• Exploited vulnerabilities now account for 31% of breaches, up from 20% the year before.
• Credentials dropped from 22% to 13% as an initial access vector in the latest DBIR figures.
• Only 26% of CISA’s Known Exploited Vulnerabilities were fully remediated in 2025.
• The median remediation time for Known Exploited Vulnerabilities stretched from 32 days to 43 days.

👉 Read FireCompass's analysis of Verizon DBIR 2026 and pen testing implications

Context

Vulnerability exploitation is now outrunning credential abuse as an initial access path, which means the security gap is no longer limited to authentication controls. The primary problem is operational: organisations are slower at identifying, validating, and remediating exploited weaknesses than attackers are at using them, especially where exposed services and third-party trust paths intersect with identity.

For identity and access teams, that shift changes the boundary of responsibility. Service accounts, OAuth flows, API keys, and federated access may still be the mechanism attackers abuse after entry, but the initial foothold increasingly comes from a vulnerability that pen tests, scanning, and remediation workflows fail to cycle through fast enough.

Key questions

Q: What breaks when organisations rely on annual pentesting alone?

A: Annual testing leaves long periods where new deployments, identity changes, and exposed endpoints go unvalidated. In fast-moving environments, that creates an exploitable window between release and review, which is exactly the window automated attackers are designed to use.

Q: Why do exploited edge vulnerabilities often lead to identity compromise after initial access?

A: Because the first foothold rarely stays isolated. Once an attacker reaches a VPN, file transfer appliance, or perimeter service, they often encounter sessions, federated trust, service accounts, or API credentials that allow further movement. Identity controls matter here because the vulnerability is only the entry point; privilege and trust determine the blast radius.

Q: How do security teams know whether their vulnerability programme is keeping up?

A: Look for measurable reductions in time from disclosure to validated remediation, fewer exceptions on internet-facing assets, and faster containment when active exploitation appears. If emergency approvals, change verification, and access review are still manual bottlenecks, the programme is not operating at the speed the threat now demands.

Q: Should organisations prioritise patching internet-facing vulnerabilities over expanding credential controls?

A: Yes, when the initial access data shows exploitation outrunning credential abuse. Credential controls still matter, but a hardened login layer does little if a public edge service is already exploitable. The right sequencing is to reduce exposed KEVs first, then reinforce identity controls so a second-stage compromise does not become lateral movement.

Technical breakdown

Why vulnerable edge services are overtaking credential abuse

The article’s core mechanism is a shift in attacker economics. If credentials are harder to misuse because MFA, password managers, and identity-aware proxies raise friction, attackers move to the easier path: a known-exploited vulnerability on a VPN concentrator, file transfer appliance, or perimeter device. The weakness is not just exposure, but time. Once a CVE is publicly confirmed and exploitation begins, defenders are racing against a shrinking window while remediation queues, maintenance freezes, and ownership ambiguity slow the response.

Practical implication: treat internet-facing vulnerabilities as time-sensitive identity-adjacent risk, not just patch backlog.

Why static pen test cadences miss continuous exploitation

Traditional pen testing is episodic, while exploitation is continuous. An annual engagement cannot validate every KEV published after the last test, and scanners only confirm that a condition exists, not whether it can be chained into real compromise. That creates a structural blind spot: the organisation believes it has coverage, but the attack surface has already moved. Continuous validation matters because exploitability, not mere presence of a CVE, determines whether the issue is operationally relevant.

Practical implication: align offensive testing frequency with disclosure and exploitation cadence, not audit cycles.

How third-party trust and shadow AI expand the attack path

The article ties vulnerability exploitation to third-party access, service accounts, OAuth flows, and shadow AI. That matters because the modern attack path often begins outside the identity boundary and then crosses into it through federated trust, API access, or embedded credentials. The same is true for AI systems that expose tokens, back-end credentials, or data pipelines. From an identity standpoint, the control gap is not just who can log in, but what trusted machine or service path can be reached once a vulnerability is exploited.

Practical implication: test the trust junctions where third-party and machine identities connect to your environment.

Threat narrative

Attacker objective: The attacker’s objective is to convert a disclosed vulnerability into validated access that leads to production compromise before defenders remediate it.

1. Entry begins with exploitation of a publicly known vulnerability on an exposed edge service, such as a VPN concentrator or file transfer appliance.
2. Escalation follows when the foothold is chained into valid access, privileged session reuse, or trusted service paths that were not in scope for traditional testing.
3. Impact emerges through lateral movement, production data access, or domain compromise after the attacker proves the vulnerability is actionable in the live environment.

NHI Mgmt Group analysis

Vulnerability exploitation is now an identity problem as much as a patching problem. Once an attacker uses a vulnerable edge service to enter, the next question is which identities, sessions, tokens, and trust relationships remain reachable. That makes the boundary between vulnerability management and IAM much thinner than many programmes assume. The practical conclusion is that access governance must start where exploitability begins, not where authentication ends.

Continuous offensive validation is the only testing model that matches continuous exploitation. Annual or quarterly tests cannot keep pace with the volume and tempo of KEVs. Detection-response latency: the delay between disclosure, validation, and remediation is now a measurable governance risk, not an operational inconvenience. Organisations should treat this latency as a control failure in its own right, because attackers already do.

Third-party access and machine identities are the most exposed trust junctions after exploitation. The article’s strongest point is that the breach path increasingly crosses federated identity, service accounts, OAuth connections, and supplier-integrated systems. That is where NHI governance becomes decisive, because dormant keys and overprivileged service identities convert a vulnerability into a broad trust collapse. Practitioners should assume the attacker will look for the weakest machine-to-machine boundary.

Shadow AI expands the set of exploitable trust paths without changing the attacker playbook. AI agents, RAG pipelines, and internal LLM integrations introduce new secrets, new API dependencies, and new places where credentials can be exposed or reused. The risk is not that AI invents a new attack class, but that it multiplies the surfaces where existing exploitation works. Identity teams should therefore govern AI systems as part of the broader NHI estate.

What this signals

Detection-response latency will become a board-level exposure metric as exploit windows continue to shrink. Security teams should expect the discussion to move from patch counts to the time between KEV disclosure, exploit validation, and confirmed remediation. Aligning those timelines will matter more than simple vulnerability volume reporting.

Machine identities will increasingly absorb the blast radius of successful exploitation because service accounts, API keys, and automation tokens persist beyond the initial breach. The governance challenge is to reduce standing access before an attacker turns a single weakness into repeated trust reuse.

Identity teams should treat third-party connections, federated access, and AI-integrated workflows as part of the attack surface rather than adjacent systems. The next wave of breaches will not only exploit unpatched software, but also the machine-to-machine trust that those systems expose.

For practitioners

• Map exploited-vulnerability paths to identity dependencies Trace how exposed edge services connect to VPN access, SSO, service accounts, API keys, and administrative sessions so you can see where a vulnerability becomes an identity compromise. Prioritise the trust paths that can turn a foothold into privilege.
• Shift testing from calendar-based to KEV-triggered validation Run offensive validation whenever a relevant Known Exploited Vulnerability affects your stack, then confirm whether the issue can be chained into production access rather than only whether the CVE exists.
• Scope third-party trust junctions into pen tests Include OAuth flows, supplier portals, federated identity providers, partner SFTP, webhooks, and service accounts in scope so you can test how vendor trust meets your environment at runtime.
• Inventory machine identities that survive a single vulnerability breach Identify service accounts, API keys, and automation tokens that would still permit lateral movement after an initial foothold, then reduce standing access and shorten their usable lifetime.

Key takeaways

• The report’s main signal is a threat model shift, with exploitation now outpacing credential abuse as the most common entry path.
• Operational delay is the evidence that matters most, because KEV remediation is still too slow to stay ahead of active exploitation.
• Pen testing programs need to validate real exploit chains across identity, third-party trust, and machine access before attackers do.

Key terms

• Known Exploited Vulnerability: A Known Exploited Vulnerability is a flaw that has confirmed active exploitation in the wild and is tracked for urgent remediation. In governance terms, KEV status turns patching from a general hygiene task into a time-bound operational obligation.
• Detection-Response Latency: The elapsed time between identifying a security issue and executing a bounded, auditable fix. In data security programmes, long latency means exposure persists after discovery, which undermines the value of detection and weakens compliance evidence.
• Trust Junction: A trust junction is the point where external or third-party access meets an internal environment, such as an OAuth flow, federation link, service account, or partner portal. These junctions are high-value because one failure can turn a limited foothold into broader access.
• Chained Attack: A chained attack is a multi-step abuse pattern where each individual prompt, response, or tool call appears acceptable, but the combined sequence is malicious. In agentic systems, the threat becomes visible only when the full session is analyzed, such as research, retrieval, and exfiltration occurring in one workflow.

What's in the full article

FireCompass's full blog covers the operational detail this post intentionally leaves for the source:

• The DBIR 2026 figures and how FireCompass mapped them to continuous offensive security priorities.
• Evidence-backed pen testing workflow examples for chaining vulnerabilities into real access paths.
• Third-party trust, OAuth, and service-account attack paths that implementation teams need to scope.
• Shadow AI and AI-agent testing considerations that extend beyond conventional web application testing.

👉 The full FireCompass post covers the breach patterns, exploit cadence, and continuous testing model in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader attack paths that modern breach analysis reveals.