Topic starter
02/08/2026 11:35 am
TL;DR: Known exploitable flaws are drawing more initial access than stolen credentials, Veracode says, with exploitation at 31% and credential abuse at 13%. Application security now hinges on shrinking exposure windows, because slow remediation leaves reachable flaws usable long after discovery.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “What the 2026 Verizon DBIR Reveals About the State of Application Security”.
By the numbers:
- Exploitation of vulnerabilities rose to 31% of initial access vectors in the 2026 Verizon DBIR.
- Credential abuse fell to 13% of initial access vectors in the 2026 Verizon DBIR.
- Only 26% of critical vulnerabilities in CISA’s KEV catalog were fully remediated by organizations in 2025.
Key questions
Q: Why do unresolved code flaws increase breach risk even when IAM is strong?
A: Strong IAM limits credential abuse, but it does not remove application defects that create their own footholds.
Q: What are the signs that vulnerability management is not working well enough in an enterprise?
A: Common warning signs include long remediation cycles, weak visibility into where vulnerabilities exist, and inconsistent prioritisation of high-risk findings.
Q: What breaks when application vulnerabilities are not remediated quickly?
A: Attackers gain more time to move from a small code weakness to data theft, privilege abuse or service disruption.
Practitioner guidance
- Rebalance AppSec and IAM priorities Shift governance focus toward unpatched code paths, reachable services, and fix-age rather than relying on credential controls as the main breach-prevention layer.
- Track remediation by exposure window Measure how long critical flaws remain exploitable after discovery, and use that metric in executive reporting instead of counting findings alone.
- Create a KEV triage path Route Known Exploited Vulnerabilities into an accelerated ownership process so critical issues are assigned, verified, and closed without waiting for normal backlog cycles.
Bottom line: The report shows a structural shift in attack economics, with exploitable application flaws becoming a more attractive route than stolen credentials.
Glossary terms: Fix-window drift, Known Exploited Vulnerability, Exposure Window, Application-layer risk
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:49 pm
Application vulnerability exposure has become a governance problem, not just a code-quality problem. The report shows that exploitation is now displacing credential abuse as the leading access path, which means security teams can no longer treat AppSec as a secondary control layer. If the organisation cannot reduce exposure before release or shortly after discovery, the vulnerability itself becomes the standing access condition. Practitioners should treat fix velocity as a governance outcome, not a developer productivity metric.
A few things that frame the scale:
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: How should security teams respond when known exploitable flaws keep recurring?
A: Teams should treat recurring exploitable flaws as a governance and prioritisation problem, not just a scanning problem. The right response is to tighten ownership, force faster remediation for KEV-listed issues, and block release paths that repeatedly reintroduce the same weakness. The objective is to shorten the period in which a known flaw can be used operationally.
👉 Read our full editorial: Verizon DBIR 2026 shows vulnerability exploitation is overtaking credential abuse