Topic starter
22/06/2026 10:05 am
TL;DR: The 2026 Verizon DBIR shows known vulnerabilities drove 31% of breaches, credential abuse appeared in 39% of attack chains, ransomware remained at 48%, and AI use is extending the same identity risks across human, machine, and AI accounts, according to Delinea. The breach pattern is familiar: attackers still win when organisations lose control of authentication, authorisation, and third-party access.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “2026 Verizon DBIR: Why cybersecurity fundamentals still matter”.
By the numbers:
- 31% of breaches were tied to known vulnerabilities, overtaking credential abuse as the leading initial access vector.
- 39% of breaches involved credential abuse in the attack chain.
- 48% of all breaches were ransomware-related.
Key questions
A: Controls tend to be bypassed, delayed, or used inconsistently when they create too much friction.
Q: Why do known vulnerabilities still cause major breaches?
A: Known vulnerabilities still drive major breaches because attackers exploit the gaps organisations already understand but have not remediated fast enough.
Q: What are the signs that a third-party access breach is in progress?
A: Common warning signs include logins from suspicious IP addresses, repeated 401 and 403 responses, abnormal authentication patterns in vendor logs, and outbound connections to known malicious domains.
Practitioner guidance
- Re-rank remediation by identity exposure paths Prioritise the vulnerabilities that expose privileged authentication paths, federation endpoints, and externally reachable management planes before lower-impact issues.
- Consolidate authentication and authorisation governance Review where login success, permission scope, and session duration are managed by different teams, then unify those controls for human, machine, and AI identities.
- Tighten third-party access lifecycles Inventory external accounts, require proof of current business need, and revoke access when a partner no longer needs a cloud resource or privileged integration.
Bottom line: The article argues that modern breach patterns still depend on failures in identity control, even when the initial entry point is a vulnerability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:50 am
Identity controls are still the deciding variable because breach paths remain permission-shaped, not technology-shaped. The DBIR data Delinea highlights shows that known vulnerabilities and credential abuse are still the most reliable ways into environments, which means the breach outcome is often determined by how well identities are constrained after entry. This is true across human logins, machine credentials, and AI accounts. Practitioners should treat identity control quality as the boundary between intrusion and incident.
A few things that frame the scale:
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: 2026 Verizon DBIR shows identity controls still decide breach outcomes