The 2026 Verizon DBIR Says Vulnerability Exploitation Beat Stolen Credentials as the Top Breach Entry Point

The 2026 DBIR covers confirmed breaches investigated between November 2024 and October 2025. Within that dataset, vulnerability exploitation was identified as the initial access vector in 31 percent of breaches, up from 20 percent in the prior year's report. Stolen credentials, which had been the leading or co-leading vector for years, fell to 13 percent from 22 percent. Verizon's own summary of the finding, published on its DBIR site, puts it plainly: 31 percent of breaches now start with software vulnerabilities, beating stolen passwords as the top way attackers get in. Coverage of the report from Help Net Security and other outlets that reviewed the full findings confirms this is the first time in the DBIR's 19-year history that credential theft has been displaced from the top of the initial access ranking.

One methodology detail matters here and is easy to miss in headline coverage: this year's DBIR broke out pretexting as its own tracked initial access category for the first time, which pulled some incidents out of what would previously have been counted as credential abuse. Reporting on the report notes that without that reclassification, credential abuse would have come in closer to 16 percent rather than 13 percent. The underlying decline in credential abuse's share is real either way, but the size of the drop is partly an artifact of how this year's taxonomy was drawn, which is worth knowing before quoting the 22-to-13 delta as a pure apples-to-apples comparison.

The more useful part of this finding is not the ranking change itself but what Verizon says is driving it, because that points directly at what a security team can act on. According to the report's own explanation as summarized by Help Net Security, Verizon attributes the shift to organizations failing to patch known vulnerabilities quickly, and sometimes not thoroughly, enough. Notably, Verizon does not attribute the rise to AI-assisted vulnerability discovery or exploitation, and the report is explicit that the incidents analyzed predate AI-assisted attack tooling becoming a mainstream factor in exploitation activity. This is a patching and prioritization story, not an attacker-capability story, at least based on the window this edition covers.

The DBIR's own remediation data backs that framing up. Of the roughly 13,000 organizations surveyed for vulnerability remediation behavior, only 26 percent had fully remediated vulnerabilities listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, down from 38 percent the prior year. Median time to fully patch a vulnerability rose to 43 days from 32 days. That is a meaningful backward slide in patch cadence during the same window that vulnerability exploitation became the top initial access vector, and it is consistent with Verizon's stated read that rising vulnerability volume is outpacing organizations' ability to prioritize and close the ones that matter, rather than attackers having discovered some fundamentally new class of exploit.

It would be a mistake to read this shift as credentials no longer mattering. Reporting on the 2026 DBIR notes that credential abuse still appears at some point in the attack chain in 39 percent of breaches, more than any other single vector, even though it is no longer the leading initial access method specifically. The distinction matters: initial access vector measures how attackers first got in, not everything that happened afterward. A breach that starts with a exploited vulnerability can still involve stolen credentials for lateral movement, privilege escalation, or accessing a second system once the attacker is inside. Credential abuse losing the top initial-access spot is a real change in the data, but it is not evidence that credential hygiene, multifactor authentication coverage, or phishing-resistant authentication have become lower priorities. They remain load-bearing controls; they are just no longer the single most common front door.

The operational takeaway is that patching cadence and vulnerability management maturity now belong in the same tier of breach-likelihood reduction as credential hygiene and phishing defense, not a tier below it. For years, a reasonable argument could be made that a security program under-resourced relative to its risk should put phishing-resistant MFA and credential monitoring ahead of vulnerability management on the priority list, because credential theft was the more common way in. The 2026 DBIR data undercuts that argument. A team that has strong MFA coverage and credential monitoring but a slow, inconsistent patch cycle for internet-facing systems is now defending against the smaller of the two problems and leaving the larger one open.

This is also a cost argument, not just a likelihood argument. Our analysis of IBM's 2026 Cost of a Data Breach Report covers how breach lifecycle length and containment cost scale with how long an attacker's entry point stays open, and a slower median patch cycle (43 days, per the DBIR figure above) directly extends that exposure window on the vulnerability side of the equation in a way that a credential-focused control set cannot compensate for.

Three concrete changes follow from this shift, and none of them require waiting for next year's DBIR to confirm the trend continues.

First, patch SLAs for internet-facing and perimeter systems need to be tighter than the SLA a team applies to internal, non-exposed assets, and tighter than the 43-day median the DBIR data shows across its surveyed organizations. A vulnerability sitting unpatched on a system reachable from the internet is a fundamentally different risk than the same CVSS score on an internal system behind multiple network controls, and SLA tiers should reflect that exposure difference explicitly rather than treating all vulnerabilities of a given severity the same.

Second, CVSS score alone is not a sufficient prioritization input anymore, if it ever was. Exploit-availability signals and active-exploitation status (a CVE's presence on CISA's KEV catalog, a rising EPSS score, public proof-of-concept code) need to sit alongside CVSS in the triage decision, because a lower-CVSS vulnerability with active exploitation in the wild is operationally more urgent than a higher-CVSS vulnerability nobody is using yet. Our EPSS-based vulnerability prioritization guide walks through building that scoring layer into an existing patching workflow, and our enterprise patch management best practices guide covers the operational side of actually hitting tighter SLAs once they are set.

Third, an annual or semiannual penetration test is not frequent enough to catch what this shift demands. Pentests are point-in-time snapshots; new internet-facing vulnerabilities and newly exposed assets appear between test cycles, and a vulnerability that became actively exploited three months after the last pentest gets no coverage until the next one. Continuous external attack surface visibility, meaning ongoing discovery and monitoring of what is actually internet-facing and what is vulnerable on it, closes that gap in a way a scheduled test cannot.

Two caveats deserve equal billing with the headline number, because overapplying this finding is its own risk.

The DBIR is not a random sample of every breach that happened worldwide in the analyzed window. Its dataset is built from incidents contributed by Verizon's own investigations, partner organizations, and law enforcement sources, which means it reflects the population of breaches that get reported, investigated, and shared with Verizon's data partners rather than every breach that occurred. Sectors, regions, or breach types that are underrepresented among those contributors will be underrepresented in the report's statistics regardless of their actual real-world frequency. That does not invalidate the finding, but it means the 31 percent figure describes this dataset's composition, not a universal constant.

The second caveat is a distinction between two different questions that are easy to conflate: which vector shows up most often across a count of breach reports, and which vector actually drives the most risk-weighted impact (cost, data volume, downtime) across those same breaches. The DBIR's initial-access-vector ranking answers the first question. A vector can be the most common way in without necessarily being the costliest or most damaging once a breach occurs, since severity depends heavily on what the attacker does after getting in, not only on how they got in. Treat the 31 percent figure as strong evidence that patching deserves more attention than it has been getting, not as proof that every other control category should be deprioritized in proportion to its shrinking share of the initial-access chart.