Notifications
Clear all
Topic starter
10/06/2026 12:24 am
TL;DR: The 2026 breach landscape is still dominated by a small set of failure modes, led by phishing, weak credentials, unpatched systems, insider activity, and cloud misconfiguration, with IBM putting average breach cost at $4.88 million and Verizon attributing 22% of breaches to stolen credentials. The real problem is governance drift: organisations know the controls, but still leave access, patching, and cloud exposure unresolved.
NHIMG editorial — based on content published by Zluri: The Top 5 Common Causes of Data Breaches in 2026
By the numbers:
- Phishing was the initial attack vector in 16% of all 2025 data breaches, with an average incident cost of $4.88 million.
- Credential abuse was the initial access vector in 22% of non-error, non-misuse breaches in 2025.
Questions worth separating out
Q: What breaks when credential hygiene is weak in enterprise environments?
A: Weak credential hygiene turns ordinary accounts into standing entry points for attackers.
Q: Why do phishing and social engineering still succeed against mature IAM programmes?
A: They succeed because they target trust decisions, not just technical controls.
Q: How do security teams know whether cloud misconfiguration is becoming a breach risk?
A: Look for permissions and storage paths that no business owner can clearly explain, especially where third parties, SaaS tools, or service accounts can reach sensitive data.
Practitioner guidance
- Harden phishing-resistant access paths Use hardware-key or passkey-based MFA for high-risk accounts, pair it with out-of-band verification for unusual requests, and remove SMS codes from privileged workflows.
- Eliminate standing credential reuse Mandate password managers, block credential reuse, and revoke accounts immediately when roles change or employment ends so credentials do not outlive accountability.
- Review cloud permissions as a living control Inventory SaaS, storage, and vendor-linked access paths continuously, then recertify who can reach sensitive data rather than relying on one-time configuration reviews.
What's in the full article
Zluri's full analysis covers the operational detail this post intentionally leaves for the source:
- Step-by-step prevention guidance for phishing, credential abuse, cloud misconfiguration, insider error, and supply chain exposure.
- Practitioner-oriented examples that map each breach cause to specific controls, including MFA, offboarding, patching, and access review.
- The article's full FAQ section, which expands on breach cost, detection timelines, and incident response questions.
- A longer breakdown of how Zluri connects these breach causes to its own access governance context.
👉 Read Zluri's analysis of the top 5 data breach causes in 2026 →
Top breach causes in 2026: where IAM and NHI controls fail?
Explore further
10/06/2026 9:33 pm
Phishing is no longer just a human-awareness problem, it is an identity assurance failure. The article's phishing section shows that attackers now combine AI-generated context, real-time session interception, and impersonation across channels to defeat trust at the moment of authentication. That means the old assumption that a user can visually validate a request before acting is already too weak for modern breach conditions. The practitioner conclusion is that authentication design must be paired with explicit verification of intent, not just user presence.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to 52 NHI Breaches Analysis.
- Only 5.7% of organisations have full visibility into their service accounts, which leaves breach investigation and entitlement review structurally incomplete.
A question worth separating out:
Q: Who is accountable when orphaned accounts or stale access contribute to a breach?
A: Accountability sits with the teams that own identity lifecycle, application access, and offboarding governance, not just the security function. If access is still active after a role change or departure, the organisation has accepted a governance failure. Compliance frameworks expect clear ownership, reviewability, and timely revocation across the access lifecycle.
👉 Read our full editorial: Top 5 data breach causes in 2026 and the identity gaps behind them
