Notifications
Clear all
Topic starter
19/08/2026 3:42 pm
TL;DR: The 2026 Verizon DBIR shows vulnerability exploitation has overtaken stolen credentials as the top initial access vector at 31% of confirmed breaches, while median time to patch has climbed 34% year over year, according to Cycode’s analysis. Product security now has to prioritise exploitability, exposure paths, and remediation speed over raw findings volume.
NHIMG editorial — based on content published by Cycode: What the 2026 Verizon DBIR Means for Product Security in the AI Era (5 Takeaways)
By the numbers:
- The 2026 Verizon DBIR says vulnerability exploitation now accounts for 31% of all confirmed breaches, up from 20% last year.
- Median time to patch has increased from 32 days to 43 days, a 34% year-over-year rise.
- Third-party involvement now appears in 48% of breaches, a 60% increase over the prior reporting period.
Questions worth separating out
Q: How should security teams prioritise vulnerabilities when AI speeds up attack discovery?
A: They should prioritise by exploitable context, not by severity alone.
Q: Why do developer and non-human identities change product security risk?
A: Developer and non-human identities connect source code, pipelines, cloud consoles, and runtime systems into one compromise path.
Q: What breaks when identity governance is separated from data security?
A: Governance becomes blind to whether an approved identity can actually reach sensitive records.
Practitioner guidance
- Correlate exploitability across code and runtime Prioritise vulnerabilities only when you can link them to reachable services, active secrets, and privileged paths into production.
- Inventory machine identities inside delivery pipelines Map CI/CD service accounts, tokens, cloud roles, and AI tooling permissions together so you can see where non-human identities can write, approve, deploy, or exfiltrate.
- Apply lifecycle controls to developer access Set explicit expiry, rotation, and offboarding rules for developer credentials and pipeline tokens, especially where those identities can reach source control and cloud consoles.
What's in the full article
Cycode's full article covers the operational detail this post intentionally leaves for the source:
- A breakdown of the five DBIR takeaways as Cycode frames them for product security leaders.
- Cycode's view of how agentic development changes the software supply chain and risk correlation model.
- Examples of how AI-generated code and shadow AI create governance gaps in day-to-day development workflows.
- The vendor's framing of why identity compromise now functions as infrastructure compromise in modern delivery systems.
👉 Read Cycode's analysis of the 2026 Verizon DBIR for product security teams →
2026 DBIR takeaways: what exploitability means for product security?
Explore further
19/08/2026 4:20 pm
Exploitability is replacing vulnerability volume as the real security metric: The DBIR trend reinforces a market shift that security leaders should already be acting on. Organisations do not fail because they have no findings. They fail because they cannot distinguish exploitable exposure from static noise quickly enough to intervene. That makes correlation across code, cloud, identities, and runtime the decisive control pattern, especially where non-human identities can move from code to production.
A question worth separating out:
Q: Who is accountable when third-party code or AI tooling expands breach exposure?
A: Accountability sits with the owning product security and governance teams, because third-party involvement is now part of the software trust boundary. Organisations need clear ownership for dependency risk, AI tooling approval, and identity permissions across the delivery chain. If those controls are fragmented, no one can close the loop fast enough.
👉 Read our full editorial: Verizon DBIR 2026 shows exploitability now drives product security
