Topic starter
15/08/2026 6:45 pm
TL;DR: Verizon’s 2026 DBIR shows exploitation of vulnerabilities rising to 31% of breaches as the first initial access vector, while credential abuse fell to 13% but still appeared somewhere in 39% of breaches. Descope’s analysis underscores that attackers may be changing entry points, but identity controls, token governance, and partner access remain the real security battleground.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Verizon DBIR 2026: Credential Abuse Is Down, But Not Out”.
By the numbers:
- Exploitation of vulnerabilities reached 31% of breaches as the first known initial access vector, up from 20% in 2025.
- Credential abuse fell to 13% as a first initial access vector, but it still appeared in 39% of breaches when counted anywhere in the breach progression.
- Third-party involvement grew to 48% of breaches, up 60% year over year.
Key questions
Q: What breaks when credential abuse is no longer the first step in a breach?
A: Security teams can over-focus on initial access and miss the identity abuse that actually drives persistence and exfiltration.
Q: Why do third-party access failures keep showing up in breach investigations?
A: Because partner access often inherits weak MFA, poor rotation and overly broad permissions, then remains active long after the business need changes.
Q: How should security teams govern OAuth tokens as non-human identities?
A: Security teams should assign ownership, expiry, and revocation rules to OAuth tokens just as they would for service accounts or API keys.
Practitioner guidance
- Audit the full credential path, not just the first compromise Track where passwords, OAuth tokens, API keys and session material remain usable after initial exposure, then retire the identities that still have standing authority across systems or tenants.
- Put hard expiry on delegated access Require every partner token, service credential and machine-issued secret to expire by design, with revocation tied to business context rather than manual exception handling.
- Re-check third-party MFA and least privilege Validate that partner-facing accounts cannot operate with disabled MFA, broad admin rights or unmanaged scoping, especially where cloud and SaaS access is externally administered.
Bottom line: The DBIR shows that entry tactics are changing, but identity abuse remains embedded throughout the breach lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:46 pm
Credential abuse did not stop being the central identity risk just because it stopped being the first initial access vector. The DBIR’s methodology change matters, but it does not erase the underlying pattern: attackers still rely on stolen credentials, tokens and delegated access after they get in. Identity programmes that focus on first-step compromise miss the larger breach condition, which is that valid access often survives long enough to be reused. The practitioner conclusion is simple: measure where credentials travel and how long they remain usable, not just where they were first exposed.
A few things that frame the scale:
- Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
A question worth separating out:
Q: What is the difference between patching exposure and identity remediation?
A: Patching reduces the chance that an external service becomes the first foothold, while identity remediation reduces how much authority an attacker can use after entry. Both matter, but they solve different failure modes. Organisations need to run them as separate control loops with separate ownership.
👉 Read our full editorial: Verizon DBIR 2026 shows credential abuse is down but not out