Topic starter
01/08/2026 10:47 pm
TL;DR: Exploitation of vulnerabilities is now the top initial access vector in the 2026 Verizon DBIR, rising to 31% of breaches, according to Tonic, while third-party involvement reached 48% and only 26% of critical KEVs were fully remediated in 2025. The real control gap is not finding issues, but closing the handoff between discovery, ownership, and fix speed before attackers move.
Editorial analysis by NHI Mgmt Group, based on content published by Tonic: “The DBIR Just Said the Quiet Part Out Loud: Your Backlog is the Breach Path”.
By the numbers:
- Exploitation of vulnerabilities is now the top initial access vector for breaches at 31% of the 2026 DBIR dataset, while credential abuse fell to 13%.
- Only 26% of critical vulnerabilities in the CISA Known Exploited Vulnerabilities catalog were fully remediated by organizations in 2025.
- The median time to full resolution of CISA KEV vulnerabilities rose to 43 days.
Key questions
Q: What breaks when vulnerability reports have no clear ownership?
A: Reports sit in queues, duplicate work appears, and remediation is delayed while teams debate scope and responsibility.
Q: Why do hard-to-exploit vulnerabilities still create urgent risk?
A: Because exploitability labels were built for a world where human ingenuity and time were the main constraints.
Q: How should teams prioritise patching when everything is marked critical?
A: They should prioritise by exploitability, privilege adjacency, exposure, and business impact, not by severity labels alone.
Practitioner guidance
- Triage by exploitability and access path Rank vulnerabilities by whether they are known exploited, externally reachable, or connected to privileged and third-party access paths.
- Join vulnerability data to identity context Link vulnerability findings to service accounts, OAuth grants, API keys, and privileged workflows so remediation priority reflects blast radius, not just severity.
- Assign ownership before remediation starts Force every high-risk exposure to have a named technical owner and an accountable business owner before it enters the backlog.
Bottom line: Exploited vulnerabilities are now the leading entry path in the breach data, which makes patch latency a frontline security issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:55 pm
Remediation latency is now the decisive exposure variable: discovery still matters, but it no longer determines risk on its own. The control gap is the time between identifying a critical flaw and closing the path an attacker can actually use. In that gap, business ownership, change approval, and dependency mapping matter as much as the scanner output. Practitioners should treat remediation latency as a security metric, not an IT afterthought.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
- Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
A question worth separating out:
Q: How do third-party integrations change vulnerability remediation?
A: Third-party links can make remediation dependent on external owners, delegated access, and contract boundaries, so the fix path may not sit entirely inside your team. Security teams need to know which vendors, credentials, and integrations are part of the affected asset before they can close the exposure responsibly.
👉 Read our full editorial: Why vulnerability management is now a remediation race