Topic starter
18/08/2026 2:13 pm
TL;DR: Verizon’s 2025 DBIR shows exploitation of vulnerabilities became the most common initial access vector at 31%, while credential abuse fell to 13% and only 26% of KEV-listed vulnerabilities were fully remediated, signalling a slower defender response than attacker pacing, according to Kusari. The governance lesson is that exposure visibility, reachability-based prioritisation, and continuous remediation now matter more than scan counts alone.
Editorial analysis by NHI Mgmt Group, based on content published by Kusari: “For the first time in 19 years, vulnerabilities are the DBIR's top attack vector”.
By the numbers:
- Vulnerability exploitation became the most common initial access vector at 31% of breaches, according to Kusari.
- Credential abuse dropped to 13%, according to Kusari.
Key questions
Q: What breaks when vulnerability exploitation becomes the main breach path?
A: When vulnerability exploitation overtakes credential abuse, the organisation can no longer rely on identity controls alone to stop initial access.
Q: Why does slow remediation increase the chance of a cyber incident becoming a breach?
A: Slow remediation leaves known weaknesses exposed long enough for attackers to find and abuse them.
Q: What are the signs that vulnerability management is not working well enough in an enterprise?
A: Common warning signs include long remediation cycles, weak visibility into where vulnerabilities exist, and inconsistent prioritisation of high-risk findings.
Practitioner guidance
- Map reachable exposure across the full dependency tree Inventory top-level and transitive dependencies so teams can answer whether a vulnerable component is actually reachable from exposed services.
- Prioritise remediation by exploitability Use exploit signals, reachability, and internet exposure to rank issues ahead of raw CVE counts or scan age.
- Shorten the close-out cycle for KEV-listed issues Set tighter service-level targets for known exploited vulnerabilities so findings move from discovery to verified closure faster than the current 43-day median.
Bottom line: The article's core point is that attackers now more often enter through exploitable software weaknesses than stolen credentials.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:05 pm
Vulnerability-led intrusion is now a governance problem, not just a patching problem. When exploitable flaws become the leading entry vector, the security question moves upstream into software inventory, dependency knowledge, and closure speed. That affects identity programmes because an exposed application path can undermine otherwise well-governed credentials, sessions, and privileged access. Practitioners need to treat exposure management as part of access governance, not a separate hygiene function.
A few things that frame the scale:
- Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
A question worth separating out:
A: Start by assuming the compromised tooling may have exposed more than software. Identify every asset it monitored or managed, then validate patches, credentials, certificates, internet exposure, and unexpected configuration changes. Prioritise the attack surface that gives an attacker the easiest route back into the environment, because management platforms can become force multipliers for lateral movement and persistence.
👉 Read our full editorial: Vulnerability exploitation overtakes credentials as the new entry point