Topic starter
06/09/2026 9:34 am
TL;DR: Verizon's DBIR 2026 shows exploited vulnerabilities rising to 31% of breaches while credentials fell to 13%, and only 26% of CISA Known Exploited Vulnerabilities were fully remediated in 2025, according to FireCompass' analysis. Annual pen testing is increasingly misaligned with a threat model defined by continuous exploitation, third-party trust paths, and chained attack paths.
Editorial analysis by NHI Mgmt Group, based on content published by FireCompass: “Verizon DBIR 2026: The Year Vulnerability Exploitation Beat Credentials. What It Means for Your Pen Testing Program”.
Key questions
A: When testing is infrequent, teams can mistake a passing control check for real resilience.
Q: Why does slow remediation increase the chance of a cyber incident becoming a breach?
A: Slow remediation leaves known weaknesses exposed long enough for attackers to find and abuse them.
Q: What do security teams get wrong about third-party access management?
A: They often focus on initial provisioning and underestimate the risk of stale access.
Practitioner guidance
- Rebaseline pen test cadence to exploit windows Move from annual or biannual engagements to continuous validation for internet-facing assets, especially where new KEVs could create immediate exposure.
- Test third-party trust paths explicitly Include federated identity flows, VPN dependencies, SaaS admin interfaces, API keys, SFTP endpoints, and contractor access in scope.
- Track remediation against KEV exposure Measure how many confirmed exploited vulnerabilities remain open, how long they stay open, and which business services they affect.
Bottom line: The article shows a structural shift in breach entry, with vulnerability exploitation overtaking credentials as the leading initial access path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 9:34 am
Continuous exploitability has become the real exposure metric: once a vulnerability is publicly exploitable, the control question is no longer whether it exists but how long it remains weaponisable in your environment. FireCompass' analysis of the DBIR points to a market-wide failure to treat remediation latency as a security variable. For IAM and NHI programmes, that same logic applies to service accounts, API keys, and federated trust paths when they terminate in exploitable systems. Practitioners should measure exposure windows, not just patch counts.
A few things that frame the scale:
- The 2026 Verizon DBIR found that exploitation of software vulnerabilities became the leading initial access vector in confirmed breaches, accounting for 31% of incidents.
A question worth separating out:
Q: How should teams respond when a vulnerability can be chained into production access?
A: They should prioritise the chain, not the individual finding. If a low-severity issue can lead to authentication bypass, privilege escalation, or data access when combined with other conditions, it becomes a high-priority exposure. The right response is to validate the full path and break the link that makes escalation possible.
👉 Read our full editorial: Vulnerability exploitation overtakes credentials: what pen test teams must adjust