Notifications
Clear all
Topic starter
02/08/2026 11:35 am
TL;DR: The 2026 Verizon DBIR says exploitation of vulnerabilities rose to 31% of initial access vectors while credential abuse fell to 13%, and only 26% of critical KEV flaws were fully remediated in 2025, according to Veracode’s summary of the report. The signal for practitioners is that remediation speed, not awareness, is now the limiting control.
NHIMG editorial — based on content published by Veracode: What the 2026 Verizon DBIR Reveals About the State of Application Security
By the numbers:
- exploitation of vulnerabilities has risen to 31% of initial access vectors
- credential abuse is now down to 13%
- only 26% of critical vulnerabilities were fully remediated by organizations in 2025
Questions worth separating out
Q: What fails when vulnerability remediation is slower than AI-assisted exploitation?
A: Patch-first security fails when exploit generation outpaces validation, change control, and deployment.
Q: Why do vulnerabilities now matter as much as identity controls in breach prevention?
A: Because attackers increasingly start with application weaknesses, then move into identity, privilege, and data access once they are inside.
Q: How do security teams know whether Teams remediation is working?
A: They should measure dwell time, removal latency, and the percentage of malicious messages removed before any user interaction.
Practitioner guidance
- Prioritise exploitable vulnerabilities over raw backlog size Build a remediation queue that weights internet exposure, exploit evidence, and business criticality so teams close the defects most likely to become active attack paths first.
- Shorten the time a critical flaw remains reachable Set service-level objectives for critical flaws that are measured in days, not weeks, and assign clear ownership for approvals, testing, and deployment so remediation does not stall in handoffs.
- Map application paths to reachable identities and secrets Identify which applications can access service accounts, API keys, tokens, or elevated cloud roles, then treat those paths as combined AppSec and IAM risk surfaces rather than separate control domains.
What's in the full report
Veracode's full article covers the operational detail this post intentionally leaves for the source:
- A deeper walkthrough of the 2026 Verizon DBIR findings on application-layer risk and breach vector shifts
- The full remediation analysis behind the 26% critical vulnerability fix rate and 43-day median resolution time
- Context on code flaw survival analysis and how GenAI may change vulnerability discovery volume
- Veracode's commentary on what security and development teams should do next with the report's findings
👉 Read Veracode's analysis of the 2026 Verizon DBIR and application security trends →
Application security risk is shifting fast. Are your controls keeping up?
Explore further
02/08/2026 12:49 pm
Application exploitation has become a governance problem, not just a coding problem. When the leading breach vector shifts to vulnerabilities, the organisation’s weakness is no longer limited to a specific line of code. It includes prioritisation, ownership, change capacity, and cross-functional accountability. AppSec teams should treat exploitability as an enterprise risk metric, not a developer-only issue.
A question worth separating out:
Q: Should organisations rebalance investment from identity controls to application security?
A: They should rebalance, not replace. Identity controls are still necessary, especially where attackers pivot from application flaws into tokens, sessions, and privileged accounts. But if vulnerabilities are the main entry point, the programme needs more investment in detection, prioritisation, and rapid remediation across the application layer.
👉 Read our full editorial: Verizon DBIR 2026 shows vulnerability exploitation is overtaking credential abuse
