Topic starter
27/06/2026 1:39 pm
TL;DR: Third-party compromise appeared in 48% of breaches, vulnerability exploitation rose to 31% and surpassed credential abuse at 13%, and only 26% of known exploited vulnerabilities were remediated in 2025, widening exposure windows, according to Abnormal AI’s analysis of Verizon’s DBIR 2026. Identity trust, remediation speed, and workflow context now behave as one attack surface, not separate controls.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “62% of Breaches Involved the Human Element: Key Takeaways From Verizon 2026 DBIR”.
By the numbers:
- Third-party compromise appeared in 48% of breaches, a 60% year-over-year increase.
- Vulnerability exploitation accounted for 31% of breaches and overtook credential abuse at 13%.
- Only 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38% the year before.
Key questions
Q: What fails when organisations treat third-party access as low risk?
A: They lose control of the trust boundary.
Q: Why does vulnerability exploitation increase identity risk instead of replacing it?
A: Because exploited services often become the bridge to credentials, tokens, and session reuse.
Q: What are the signs that workflow-based social engineering is succeeding?
A: Look for subtle changes in communication patterns, request timing, approval routing, and the reuse of familiar threads or relationships.
Practitioner guidance
- Inventory third-party identity pathways Build and maintain a current map of vendor accounts, SaaS integrations, OAuth grants, contractor identities, and shared service access that can reach production data or workflows.
- Tie vulnerability response to identity containment When a vulnerable internet-facing service is identified, assess whether it can expose credentials, session tokens, or delegated access before normal remediation closes the gap.
- Review workflow trust points Examine approval chains, finance workflows, help desk processes, and vendor communication paths for places where a trusted thread can be reused to request action or access.
Bottom line: Third-party compromise and vulnerability exploitation now overlap with identity governance, which means the attack surface is defined by trust relationships as much as by technology stacks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:04 pm
Third-party trust is now an identity control, not a vendor-management footnote: The DBIR’s third-party figures show that attackers are exploiting the trust relationship itself, not just the partner’s environment. Once access is delegated through SaaS, OAuth, or contractor pathways, the organisation inherits the partner’s identity hygiene as part of its own attack surface. Practitioners should treat third-party identity scope as a governed security boundary.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- The 2026 Verizon DBIR found that exploitation of software vulnerabilities became the leading initial access vector in confirmed breaches, accounting for 31% of incidents.
A question worth separating out:
Q: What should security teams do when a vendor may already be compromised?
A: Security teams should assume the vendor access path is at risk and act quickly to reduce exposure. Restrict or suspend access, review logs for unusual activity, validate what data the vendor could reach, and assess whether the compromise touched regulated or sensitive information. Then rotate credentials, tighten permissions, and recheck controls before restoring trust.
👉 Read our full editorial: DBIR 2026 shows identity trust is now an attack surface