Notifications
Clear all
Topic starter
18/08/2026 2:13 pm
TL;DR: Verizon’s 2025 DBIR shows exploitation of vulnerabilities became the most common initial access vector at 31%, while credential abuse fell to 13% and only 26% of KEV-listed vulnerabilities were fully remediated, signalling a slower defender response than attacker pacing, according to Kusari. The governance lesson is that exposure visibility, reachability-based prioritisation, and continuous remediation now matter more than scan counts alone.
NHIMG editorial — based on content published by Kusari covering Verizon DBIR trends and the shift to vulnerability exploitation
By the numbers:
- Verizon found that exploitation of vulnerabilities is now the most common initial access vector for breaches at 31% of the dataset.
- Credential abuse dropped to 13%, down from 22% the year before, according to Verizon’s analysis.
- Only 26% of the vulnerabilities on CISA’s Known Exploited Vulnerabilities list were fully remediated by organisations last year.
Questions worth separating out
Q: What fails when vulnerability remediation is slower than AI-assisted exploitation?
A: Patch-first security fails when exploit generation outpaces validation, change control, and deployment.
Q: Why does software visibility matter more when initial access comes from vulnerabilities?
A: Because teams cannot fix or defend what they cannot identify.
Q: How do security teams know whether vulnerability assessment is actually working?
A: Teams should look for short triage cycles, high-confidence findings, and a clear link between scan results and remediation action.
Practitioner guidance
- Build source-to-runtime exposure visibility Track direct and transitive dependencies, container images, and deployed artefacts in one inventory so teams can answer where a vulnerable component exists before remediation starts.
- Prioritise by exploitability and reachability Replace CVE counts as the main queue driver with a model that scores whether the issue is reachable, internet-exposed, or already in KEV, then route only those items into urgent remediation.
- Measure remediation as a time-based control Set explicit targets for time to close KEV-listed issues and track drift by application owner, because long-tail closure windows are where exploitation wins.
What's in the full article
Kusari's full analysis covers the operational detail this post intentionally leaves for the source:
- How Kusari maps the AI-accelerated vulnerability storm to a specific remediation playbook
- The source article's reachability-based prioritisation logic for deciding which flaws to fix first
- Why Kusari argues for a living dependency graph across the full software estate
- The vendor's framing of autonomous remediation and how it changes response timelines
👉 Read Kusari's analysis of the DBIR shift from credential abuse to vulnerability exploitation →
Vulnerability exploitation now leads breach entry. Are your controls ready?
Explore further
18/08/2026 3:05 pm
Identity is no longer the only front-door problem, but it remains central to what happens after entry. The report shows that exploitable software flaws now lead initial access, yet identity controls still determine whether the compromise stays local or turns into broad enterprise access. That makes IAM and PAM a downstream containment layer, not the sole entry defence. Practitioners should treat identity governance and software exposure management as linked control planes.
A question worth separating out:
Q: How should organisations connect vulnerability management to identity and access controls?
A: Treat identity controls as containment for when software prevention fails. Strong PAM, service account governance, and segmentation limit how far an attacker can move after initial exploitation. That does not replace patching, but it reduces the blast radius and gives security teams a second line of defence when a flaw is already in the wild.
👉 Read our full editorial: Vulnerability exploitation overtakes credentials as the new entry point
