Notifications
Clear all
Topic starter
09/06/2026 11:47 pm
TL;DR: Verizon's 2026 DBIR reports more than 22,000 confirmed breaches across 145 countries and shows vulnerability exploitation at 31% of initial access, but identity-related vectors still total 32% when phishing and adjusted credential abuse are combined, according to Verizon. The more urgent lesson is that identity abuse remains a full-breach-chain problem, not a declining front-door problem.
NHIMG editorial — based on content published by Push Security: analysis of Verizon's 2026 Data Breach Investigations Report and its implications for identity security
By the numbers:
- Vulnerability exploitation accounted for 31% of initial access in 2026, up from 20% the year before.
- Identity-related initial access reaches 32% on an apples-to-apples basis when phishing and adjusted credential abuse are combined.
- Credential abuse appears in 39% of all breaches across the full breach chain, not just at first access.
Questions worth separating out
Q: How should security teams respond when credential abuse appears across the whole breach chain?
A: They should treat credential abuse as a lifecycle problem, not just an authentication failure.
Q: Why do browser-based attacks create problems for IAM programmes?
A: Browser-based attacks shift identity risk into the place where users authenticate, approve access, and interact with connected apps.
Q: When should organisations prioritise credential rotation over more detection rules?
A: They should prioritise rotation when stolen secrets, long-lived tokens, or vendor credentials can remain valid long enough to be reused.
Practitioner guidance
- Map identity events across the breach chain Correlate login, token issuance, consent grants, privilege changes, and session reuse so you can see how a single identity artefact behaves after first access.
- Instrument browser-layer telemetry Capture browser session context, extension activity, and consent flow history because email controls alone cannot explain browser-based credential harvesting or AI tool exposure.
- Shorten credential exposure windows Prioritise rotation and revocation for API keys, OAuth tokens, and shared credentials that can survive beyond their intended use and later power lateral movement.
What's in the full analysis
Push Security's full analysis covers the operational detail this post intentionally leaves for the source:
- Browser-level detection patterns for ClickFix, session hijacking, and AI tool abuse that explain how identity compromise starts outside email.
- Workflow breakdowns for spotting credential reuse, SSO gaps, and OAuth consent abuse across real sessions.
- Examples of browser telemetry that can support data loss investigations without relying on inbox-centric controls.
- Operational detail on how the vendor maps attack activity into the browser layer for detection and response.
👉 Read Push Security's analysis of the 2026 DBIR identity and browser risk findings →
Verizon DBIR 2026: what identity teams should take from the data?
Explore further
10/06/2026 2:16 am
Identity security has not weakened in the DBIR data, it has converged with vulnerability exploitation. The report's apples-to-apples comparison shows identity-related initial access at 32% versus 31% for vulnerability exploitation, which means the market is not moving away from identity risk. It is showing that identity and exploit paths are now equally material in the breach entry mix. For practitioners, that makes identity governance a parallel control plane, not a secondary one.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- 45% of organisations cite lack of credential rotation as the top cause of NHI-related attacks, ahead of inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
A question worth separating out:
Q: How do third-party identities change breach accountability?
A: Third-party identities extend accountability beyond internal users because external access often persists through shared apps, OAuth grants, and cloud permissions. The organisation that owns the data must still know who can act, where access lives, and whether offboarding actually removes it. Without that, vendor risk becomes a direct identity risk.
👉 Read our full editorial: Identity attacks still match exploitation in Verizon's 2026 DBIR
