Topic starter
22/06/2026 10:05 am
TL;DR: Breach outcomes in the 2026 Verizon DBIR still hinge on identity control failures, with known vulnerabilities, credential abuse and ransomware patterns reinforcing that point, according to Delinea. Identity governance has to cover authentication, authorisation and third-party access as one lifecycle problem.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “2026 Verizon DBIR: Why cybersecurity fundamentals still matter”.
By the numbers:
- 31% of breaches were tied to known vulnerabilities, overtaking credential abuse as the leading initial access vector.
- 39% of breaches involved credential abuse in the attack chain.
- 48% of all breaches were ransomware-related.
Key questions
Q: Why do known vulnerabilities still cause major breaches?
A: Known vulnerabilities still drive major breaches because attackers exploit the gaps organisations already understand but have not remediated fast enough.
Q: What are the signs that a third-party access breach is in progress?
A: Common warning signs include logins from suspicious IP addresses, repeated 401 and 403 responses, abnormal authentication patterns in vendor logs, and outbound connections to known malicious domains.
A: Controls tend to be bypassed, delayed, or used inconsistently when they create too much friction.
Practitioner guidance
- Re-rank remediation by identity exposure paths Prioritise the vulnerabilities that expose privileged authentication paths, federation endpoints, and externally reachable management planes before lower-impact issues.
- Consolidate authentication and authorisation governance Review where login success, permission scope, and session duration are managed by different teams, then unify those controls for human, machine, and AI identities.
- Tighten third-party access lifecycles Inventory external accounts, require proof of current business need, and revoke access when a partner no longer needs a cloud resource or privileged integration.
Bottom line: The article argues that modern breach patterns still depend on failures in identity control, even when the initial entry point is a vulnerability.
Glossary terms: Credential Abuse, Identity Blast Radius, Third-party identity exposure, Shadow AI
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 22 hours ago by NHI Mgmt Group
22/06/2026 10:50 am
Identity controls are still the deciding variable because breach paths remain permission-shaped, not technology-shaped. The DBIR data Delinea highlights shows that known vulnerabilities and credential abuse are still the most reliable ways into environments, which means the breach outcome is often determined by how well identities are constrained after entry. This is true across human logins, machine credentials, and AI accounts. Practitioners should treat identity control quality as the boundary between intrusion and incident.
A few things that frame the scale:
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: DBIR 2026 shows identity controls still drive breach outcomes
This post was modified 22 hours ago by NHI Mgmt Group