Topic starter
18/08/2026 2:13 pm
TL;DR: Exploitation of vulnerabilities became the top initial access vector in Verizon’s 2025 DBIR, Kusari reports, at 31% while credential abuse fell to 13%. Vulnerability response now has to move faster than attacker use of exposed systems and KEV-listed flaws.
Editorial analysis by NHI Mgmt Group, based on content published by Kusari: “For the first time in 19 years, vulnerabilities are the DBIR's top attack vector”.
By the numbers:
- Vulnerability exploitation became the most common initial access vector at 31% of breaches, according to Kusari.
- Credential abuse dropped to 13%, according to Kusari.
Key questions
Q: Why does slow remediation increase the chance of a cyber incident becoming a breach?
A: Slow remediation leaves known weaknesses exposed long enough for attackers to find and abuse them.
Q: What are the signs that vulnerability management is not working well enough in an enterprise?
A: Common warning signs include long remediation cycles, weak visibility into where vulnerabilities exist, and inconsistent prioritisation of high-risk findings.
Q: What breaks when vulnerability exploitation becomes the main breach path?
A: When vulnerability exploitation overtakes credential abuse, the organisation can no longer rely on identity controls alone to stop initial access.
Practitioner guidance
- Map reachable exposure across the full dependency tree Inventory top-level and transitive dependencies so teams can answer whether a vulnerable component is actually reachable from exposed services.
- Prioritise remediation by exploitability Use exploit signals, reachability, and internet exposure to rank issues ahead of raw CVE counts or scan age.
- Shorten the close-out cycle for KEV-listed issues Set tighter service-level targets for known exploited vulnerabilities so findings move from discovery to verified closure faster than the current 43-day median.
Bottom line: The article's core point is that attackers now more often enter through exploitable software weaknesses than stolen credentials.
Glossary terms: Initial Access, Reachability analysis, Transitive Dependency, Known Exploited Vulnerability
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:05 pm
Vulnerability-led intrusion is now a governance problem, not just a patching problem. When exploitable flaws become the leading entry vector, the security question moves upstream into software inventory, dependency knowledge, and closure speed. That affects identity programmes because an exposed application path can undermine otherwise well-governed credentials, sessions, and privileged access. Practitioners need to treat exposure management as part of access governance, not a separate hygiene function.
A few things that frame the scale:
- Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
A question worth separating out:
A: Start by assuming the compromised tooling may have exposed more than software. Identify every asset it monitored or managed, then validate patches, credentials, certificates, internet exposure, and unexpected configuration changes. Prioritise the attack surface that gives an attacker the easiest route back into the environment, because management platforms can become force multipliers for lateral movement and persistence.
👉 Read our full editorial: Vulnerability exploitation overtakes credentials as the new entry point