Vulnerability exploitation overtakes credentials as top breach entry path
Trend
Summary
Hide ▲
Show ▼
Vulnerability exploitation became the top initial access vector for data breaches over the past year, displacing compromised credentials and signaling a major shift in breach entry patterns. The finding matters because it affects how defenders prioritize patching, exposure reduction, and attack-surface management. The latest measurement shows 31% of breaches began this way, up sharply from 20% the year before.
Related Happenings
Healthcare breach trend shifts toward AI-assisted social engineering in 2025
Trend
H score39
First: 22.05.2026 16:17
Last: 22.05.2026 16:17
Sources 1
About this happening:
Healthcare organizations faced a sharp rise in social engineering and pretexting in 2025, making identity abuse a dominant breach pattern. Verizon Business’ 2026...
Healthcare breach trend shifts toward AI-assisted social engineering in 2025
TrendAbout this happening: Healthcare organizations faced a sharp rise in social engineering and pretexting in 2025, making identity abuse a dominant breach pattern. Verizon Business’ 2026...
Verizon 2026 DBIR shows vulnerability exploitation as the top breach access trend in 2025
Trend
H score39
First: 20.05.2026 03:04
Last: 20.05.2026 03:04
Sources 1
About this happening:
Vulnerability exploitation became the leading breach access vector in 2025, increasing compromise risk across 31,000 incidents and 22,000+ confirmed breaches. Un...
Verizon 2026 DBIR shows vulnerability exploitation as the top breach access trend in 2025
TrendAbout this happening: Vulnerability exploitation became the leading breach access vector in 2025, increasing compromise risk across 31,000 incidents and 22,000+ confirmed breaches. Un...
Storm-1175 high-velocity exploit campaign
Campaign
H score59
First: 06.04.2026 19:56
Last: 06.04.2026 19:56
Sources 1
About this happening:
Storm-1175 is running a high-velocity exploit campaign that rapidly turns access into Medusa ransomware deployment, creating risk of data exfiltration and encrypte...
Storm-1175 high-velocity exploit campaign
CampaignAbout this happening: Storm-1175 is running a high-velocity exploit campaign that rapidly turns access into Medusa ransomware deployment, creating risk of data exfiltration and encrypte...
44% Rise in public-facing application exploitation as vulnerability-led incidents dominated 2025
Trend
H score40
First: 25.02.2026 16:30
Last: 25.02.2026 16:30
Sources 1
About this happening:
Attacks against public-facing applications jumped 44%, widening exposure for internet-facing services and increasing intrusion risk. Vulnerability exploitation became...
44% Rise in public-facing application exploitation as vulnerability-led incidents dominated 2025
TrendAbout this happening: Attacks against public-facing applications jumped 44%, widening exposure for internet-facing services and increasing intrusion risk. Vulnerability exploitation became...
Accelerating pre-disclosure exploitation of known exploited vulnerabilities in 2025
Trend
H score35
First: 22.01.2026 14:45
Last: 22.01.2026 14:45
Sources 1
About this happening:
Pre-disclosure exploitation of known exploited vulnerabilities (KEVs) accelerated in 2025, increasing the chance that defenders face attacks before patches and public...
Accelerating pre-disclosure exploitation of known exploited vulnerabilities in 2025
TrendAbout this happening: Pre-disclosure exploitation of known exploited vulnerabilities (KEVs) accelerated in 2025, increasing the chance that defenders face attacks before patches and public...
Timeline
-
20.05.2026 11:40 2 articles · 1mo ago
Verizon DBIR shifts breach entry trends
Technical Analysis UpdateVerizon's latest DBIR says vulnerability exploitation became the top initial access vector for data breaches for the first time in nearly two decades, with 31% of breaches over the past year starting that way versus 20% the year before. The report also says only 26% of critical CISA KEV vulnerabilities were fully remediated by organizations in 2025, shadow AI became the third most common non-malicious insider action in Verizon's DLP dataset, and only 23% of third-party organizations fully remediated missing or improperly secured MFA on cloud accounts.
Show sources
- Verizon DBIR: Vulnerability Exploits Overtake Credentials as Top Access Vector — www.infosecurity-magazine.com — 20.05.2026 11:40
- Three-Quarters of Firms Knowingly Ship Vulnerable Code — www.infosecurity-magazine.com — 21.05.2026 16:00