Notifications
Clear all
Topic starter
10/07/2026 9:23 pm
TL;DR: The 2026 Verizon DBIR analysed more than 22,000 breaches and found vulnerability exploitation at 31% of cases, overtaking credential abuse at 13%, while third-party breaches reached 48% and ransomware appeared in 48%, according to Verizon. The data reinforces that continuous patching, MFA coverage, vendor oversight, and credential monitoring matter more than periodic compliance checks.
NHIMG editorial — based on content published by Secureframe: 2026 Verizon DBIR Reveals New Attack Vectors + 8 Ways Organizations Can Protect Themselves
By the numbers:
- Exploitation of vulnerabilities climbed to 31% of breaches, up from 20% the prior year, a 55% increase.
- Breaches involving a third party jumped 60% year over year, now accounting for 48% of all breaches.
- The report found that the median time to fully patch a KEV vulnerability rose to 43 days.
Questions worth separating out
Q: What breaks when vulnerability exploitation becomes the main breach path?
A: When vulnerability exploitation overtakes credential abuse, the organisation can no longer rely on identity controls alone to stop initial access.
Q: Why do third-party cloud accounts increase identity risk?
A: Third-party cloud accounts increase identity risk because delegated access extends trust outside your direct control.
Q: How do security teams know whether patching is keeping up with real risk?
A: Patching is keeping up only when the most recently exploited vulnerabilities are being closed quickly and the backlog of exposed assets is shrinking.
Practitioner guidance
- Prioritise KEV-driven patch queues Use CISA KEV status and recent exploitation signals to rank remediation instead of relying on age, severity score, or batch schedules.
- Extend MFA checks to third-party cloud access Verify that vendors, MSPs, and SaaS administrators enforce MFA on every account that can reach your data or workloads.
- Add credential exposure monitoring to incident readiness Monitor breach dumps and credential intelligence feeds so leaked employee or admin credentials trigger investigation before reuse.
What's in the full article
Secureframe's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step vulnerability management priorities for KEV items, including what to remediate first when patch capacity is limited.
- Vendor-risk questions for MFA, service account rotation, and cloud permission hygiene that go beyond high-level governance.
- Practical guidance for help desk and collaboration-tool hardening to reduce voice, SMS, and messaging-based pretexting.
- Specific recommendations for shadow AI policy, credential monitoring, and backup testing in SMB and DIB environments.
👉 Read Secureframe's analysis of the 2026 Verizon DBIR threat trends →
Vulnerability exploitation is overtaking credentials. What should teams change?
Explore further
10/07/2026 9:46 pm
Vulnerability exploitation is now an identity governance problem as much as a patching problem. The report shows that entry is increasingly achieved before credential controls are even tested, which means identity teams can no longer assume login protection is the primary choke point. When unpatched systems become the first line of compromise, access reviews and MFA programmes are necessary but insufficient on their own. Practitioners should treat exposure management as part of identity risk governance.
A question worth separating out:
Q: Who is accountable when a vendor or help desk workflow is abused?
A: Accountability sits with the organisation that owns the access path and approves the workflow, even when a third party is involved. If a vendor account, help desk reset, or remote support process enables compromise, the control owner must show how identity proofing, logging, and approval steps were enforced. Shared responsibility does not remove accountability.
👉 Read our full editorial: 2026 Verizon DBIR shows vulnerability exploitation has overtaken credentials
