Topic starter
19/08/2026 3:42 pm
TL;DR: The 2026 Verizon DBIR shows vulnerability exploitation has overtaken stolen credentials as the top initial access vector at 31% of confirmed breaches, while median time to patch has climbed 34% year over year, according to Cycode’s analysis. Product security now has to prioritise exploitability, exposure paths, and remediation speed over raw findings volume.
Editorial analysis by NHI Mgmt Group, based on content published by Cycode: “What the 2026 Verizon DBIR Means for Product Security in the AI Era (5 Takeaways)”.
By the numbers:
- Vulnerability exploitation accounted for 31% of all confirmed breaches, up from 20% last year.
- Third-party involvement now accounts for nearly half, 48%, of all breaches.
- Median time-to-patch increased 34% year over year, from 32 days to 43 days.
Key questions
Q: What breaks when vulnerability scanning is used without runtime reachability analysis?
A: Without runtime reachability, teams treat every CVE as equally urgent, even when the vulnerable code is never loaded or executed in production.
Q: Why do third-party code and AI tools increase product security risk so quickly?
A: They extend trust across dependencies that security teams do not fully own.
Q: How can security teams tell whether an identity is actually overexposed?
A: Look for identities whose permitted path reaches regulated or customer data through multiple systems, even when the direct role assignment seems modest.
Practitioner guidance
- Prioritise remediation by exploitability Rank vulnerabilities by reachability, exposed attack path, and production adjacency, then fix the issues that can be turned into initial access first.
- Unify code, pipeline, identity, and runtime risk views Correlate software supply chain findings with identities, secrets, cloud assets, and runtime exposure so one control plane can show the full attack path.
- Inventory AI-assisted development inputs Track where AI-generated code, copilot suggestions, and external model outputs enter the delivery process, then define what can reach production.
Bottom line: The report’s core message is that exploitability, not vulnerability discovery, now sets the pace for product security decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:20 pm
Exploitability is now the governing variable in product security: scanner coverage is no longer a meaningful proxy for risk reduction. The article shows that the hard part has shifted to deciding which vulnerabilities are reachable, weaponisable, and worth fixing first. That means remediation programmes must be built around exposure context, not findings volume. Practitioners should treat exploitability as the control objective.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk. Require architectural review, test coverage, static analysis, and approval before merge. Then bind the agent and the build pipeline to least privilege, short-lived credentials, and complete audit logging so implementation speed does not outrun control.
👉 Read our full editorial: Verizon DBIR 2026 shows exploitability now drives product security