The Verizon Data Breach Investigations Report (DBIR) is the most quoted breach dataset in security, and also one of the most misquoted, because its percentages only make sense once you know how the data is collected and classified. This guide explains how to read the 2026 DBIR, the 19th edition, covering incidents between 1 November 2024 and 31 October 2025. It covers the VERIS framework behind the report, the difference between incidents and breaches, the incident classification patterns, the headline 2026 findings against the 2025 edition, and the caveats you need before putting a DBIR number in a board paper or a risk model. It is written for threat intelligence analysts, risk managers and CISOs. Figures were checked against Verizon's 2026 report, executive summary and report page on 8 November 2026. For a cross-source roundup of breach figures, see the Data Breach Statistics Guide.
Last reviewed: November 2026.
Key takeaways
- Vulnerability exploitation is now the top way in: 31% of breaches in the 2026 DBIR started with exploitation of a vulnerability, overtaking credential abuse at 13%.
- Ransomware and third parties each reach 48%: ransomware was present in 48% of breaches (44% in 2025) and third-party involvement in 48%, which Verizon describes as a 60% increase.
- Patching got slower: organisations fully remediated 26% of CISA KEV vulnerabilities, down from 38%, with a median of 43 days to full resolution, up from 32.
- The human element is still in most breaches: 62% involved a human element, up from 60%, and mobile-centric social engineering simulations drew click rates 40% higher than email.
- Read the method before the numbers: the DBIR is a sample of contributed cases, not a census, and its slanted bars mark 95% confidence intervals that decide whether two figures really differ.
What the DBIR is and where the data comes from
- Publisher and cadence: Verizon Business publishes the DBIR every year. The 2026 edition is the 19th, released with a separate executive summary and a 2026 Breach Impact Study.
- Dataset: more than 31,000 incidents, of which more than 22,000 were confirmed breaches, affecting organisations in 145 countries.
- Period: incidents that occurred between 1 November 2024 and 31 October 2025, so the "2026" report describes 2025 activity.
- Contributors: almost a hundred data contributors, including law enforcement, forensic firms, law firms, cyber insurers, industry sharing groups and Verizon's own threat research caseload.
- Bias: because the dataset depends on who contributes, a change of contributors can move a figure without any change in the real world. Verizon says it flags potential biases where they apply.
VERIS: the language behind the numbers
Every case in the DBIR is coded in VERIS, the Vocabulary for Event Recording and Incident Sharing, described by its maintainers as a set of metrics providing a common language for describing security incidents in a structured and repeatable manner. The schema is published on GitHub (vz-risk/veris, version 1.3.2 in JSON when checked in November 2026), and the VERIS Community Database (VCDB) is an open repository of publicly reported incidents coded in VERIS.
| VERIS element | What it records | How it shows up in the DBIR |
|---|---|---|
| Actor | Who caused the incident: external, internal, partner | 2026: external actors 88%, internal 12% (18% in 2025); state-affiliated actors in close to 15% of breaches |
| Action | What they did: hacking, malware, social, misuse, error, physical, environmental | Initial access vectors and action varieties such as use of stolen credentials (36% of breaches) |
| Asset | What was affected: servers, user devices, people, networks | Asset charts and the mobile and edge device analysis |
| Attribute | How the asset was affected, using confidentiality, integrity and availability | Data varieties compromised, such as credentials in 28% of breaches |
Two definitions matter most. An incident is a security event that compromises the integrity, confidentiality or availability of an information asset. A breach is an incident with confirmed disclosure of data to an unauthorised party, not just potential exposure. Always check whether a DBIR percentage is "of breaches" or "of incidents"; the two bases give very different numbers. The report also has a Denial of Service pattern, which the 2026 breach chart does not give a share for.
Incident classification patterns
The DBIR groups cases into patterns: clusters of VERIS actions and assets that tend to occur together. The patterns are the best entry point for mapping DBIR findings to controls.
| Pattern | Share of breaches (2026 chart) | What it covers |
|---|---|---|
| System Intrusion | 61% | Multi-step attacks using hacking and malware, including ransomware |
| Social Engineering | 17% (the executive summary text gives 16%) | Phishing, pretexting and other manipulation of people |
| Basic Web Application Attacks | 10% | Short attacks on web applications, often with stolen credentials |
| Miscellaneous Errors | 8% | Unintentional actions such as misdelivery and misconfiguration |
| Privilege Misuse | 3% | Insiders misusing legitimate access |
When the chart and text differ by a point, as for Social Engineering here, quote one and name the location, or give the range. The difference is within the uncertainty the report itself shows.
Headline findings: 2026 compared with 2025
| Measure | 2025 DBIR | 2026 DBIR |
|---|---|---|
| Exploitation of vulnerabilities as initial access vector | Below credential abuse | 31%, the most common vector |
| Credential abuse as initial access vector | 22% | 13% (16% without the new Pretexting category) |
| Phishing as initial access vector | 16% | 16% |
| Ransomware present in breaches | 44% | 48% |
| Median ransom paid | $150,000 | $139,875 (69% of ransomware victims did not pay) |
| Human element involved | 60% | 62% |
| Third-party involvement | Verizon reports the 2026 figure as a 60% increase | 48% |
| CISA KEV vulnerabilities fully remediated | 38% | 26% |
| Median days to full resolution | 32 | 43 |
The fall in credential abuse is partly a classification change. Verizon added Pretexting as an initial access category in 2026 and says credential abuse would have been 16% without it. Credentials still matter: credential abuse appeared at some point in 39% of breaches. See the Identity Attack Statistics Guide.
Themes in the 2026 edition
- Vulnerabilities and patching: the median organisation had 50% more critical vulnerabilities to patch than a year earlier. Weak passwords and permission misconfigurations took about eight months to resolve half the findings. See the Vulnerability and Exploitation Statistics Guide and the CISA KEV Catalogue Guide.
- Edge and end-of-life devices: Verizon observed 45,000 to 50,000 end-of-life wireless modem devices with publicly accessible management interfaces between June and October 2025. See the Edge Device Security Guide.
- Mobile social engineering: median successful click rates in voice and text simulations were 40% higher than in email. See the Vishing and Smishing Guide.
- Generative AI: the median threat actor researched or used AI assistance across 15 documented techniques, and fewer than 2.5% of AI-assisted malware cases involved uncommon techniques, suggesting AI mostly speeds up known methods.
- Shadow AI: 45% of employees were regular AI users on corporate devices (15% previously), 67% of users accessed AI services with non-corporate accounts, and source code was the most common data type submitted to unauthorised AI tools. See Shadow AI Statistics.
- Third parties: third-party cloud MFA exposures were fully remediated in 23% of cases, with 50% resolved within a month. See the Third-Party Risk Management Guide.
Industry and regional snapshots
Verizon publishes counts of incidents and confirmed breaches for each industry and region. Use them to find your section of the report, not to rank sectors: counts reflect who contributes data, and some regional and sector figures are dominated by a few large contributors.
| Segment (2026 DBIR) | Incidents | Confirmed breaches |
|---|---|---|
| Manufacturing | 3,627 | 2,713 |
| Public Administration | 3,634 | 2,410 |
| Financial and Insurance | 3,809 | 1,300 |
| Healthcare | 1,492 | 1,438 |
| Education | 1,302 | 1,252 |
| Retail | 997 | 806 |
| Small and medium-sized businesses | 7,256 | 7,152 |
| EMEA | 5,229 | 2,855 |
Caveats before you quote the DBIR
- Sample, not census: the DBIR shows the cases its contributors handled. It cannot tell you the probability that your organisation will be breached.
- Confidence intervals: slanted bars show uncertainty at 95% confidence. If the slanted areas of two bars overlap, you cannot say one is larger.
- Classification changes: new categories, such as Pretexting in 2026, shift other figures. Check the methodology note before comparing years.
- Report year is not incident year: the 2026 DBIR covers November 2024 to October 2025.
- Base matters: "48% of breaches" and "48% of ransomware incidents" are different claims. Copy the denominator with the number.
- Costs are elsewhere: the DBIR reports ransom payments, not total breach cost. For cost data, see the IBM Cost of a Data Breach Report guide.
Using the DBIR in a risk assessment
- Scope: choose the sections that match your industry, region and size, and note their incident and breach counts so you know how much data sits behind them.
- Extract patterns and vectors: list the top patterns, initial access vectors and action varieties for your segment, with the base and confidence interval for each.
- Map to controls: for each pattern, name the preventive and detective controls you rely on and the evidence that they work, such as patch SLAs met for KEV entries or phishing-resistant authentication coverage.
- Score gaps: record in the risk register where a frequent DBIR pattern meets a weak or untested control, and set an owner and date.
- Test: use the patterns as exercise and purple team scenarios, then compare next year's edition with what you changed.
What the numbers mean for defenders
- Prioritise exploited vulnerabilities on exposed systems: with exploitation at 31% and KEV remediation falling to 26%, a KEV-driven patch SLA for internet-facing and edge assets is the clearest response. See the Risk-Based Vulnerability Management Guide.
- Do not relax on credentials: credential abuse appears somewhere in 39% of breaches, stolen credentials in 36%. Phishing-resistant authentication and session protection still remove a large share of paths, including for non-human identities that carry long-lived keys.
- Treat suppliers as part of the attack surface: 48% third-party involvement supports contract and access controls for suppliers, not just questionnaires.
- Expand awareness to voice and text: the 40% higher click rate on mobile channels means email-only simulations understate risk.
- Build threat models from patterns: map System Intrusion, Social Engineering and Basic Web Application Attacks to your controls and test the gaps. See the Threat-Informed Defence Guide.
Control mapping: using the DBIR as a threat source supports NIST CSF 2.0 ID.RA-02 (cyber threat intelligence is received) and ID.RA-03 (threats are identified and recorded), and NIST SP 800-53 PM-16 (threat awareness programme) and RA-3 (risk assessment). The patching findings map to RA-5.
Practitioner checklist
- Quote every DBIR figure with edition, base ("of breaches" or "of incidents") and the incident period.
- Read the methodology appendix and note any new or changed categories before comparing with last year.
- Check the slanted bars before claiming one figure is larger than another.
- Start from your industry or regional section, then map its top patterns to your control set.
- Use the KEV remediation and time-to-resolve figures as external benchmarks for your own patch metrics.
- Record which DBIR findings changed a decision in the risk register, so next year's edition can be used to test them.
- Pair the DBIR with a cost source and a regional source (such as the UK Cyber Security Breaches Survey) rather than using it alone.
Standards and references
- Verizon: 2026 Data Breach Investigations Report (PDF)
- Verizon: 2026 DBIR executive summary (PDF)
- Verizon: Data Breach Investigations Report page
- VERIS: Vocabulary for Event Recording and Incident Sharing
- VERIS: schema on GitHub
- VERIS: VERIS Community Database (VCDB)
Related NHI Mgmt Group resources: Data Breach Statistics Guide · UK Cyber Security Breaches Survey · Ransomware Statistics Guide · ENISA Threat Landscape Guide · Cybersecurity Statistics Guide