The 2026 DBIR says the quiet part loud: fundamentals still win

Every year, the Verizon Data Breach Investigations Report (DBIR) is one of the most hotly-anticipated and widely-read documents in security. And every year includes some surprising stats and reshuffles the top few threat vectors. But longtime readers will notice that the 2026 DBIR features some advice that ought to be familiar to everyone by now: get the basics right. The report’s authors even say that the overarching theme this year is “keeping a strong foundation in the face of change.” So what does a strong foundation look like? It looks like patching faster, reducing credential reuse, tightening third-party access, and making it harder for attackers to turn one weak login into a company-wide mess. Glamorous? No. Effective? Yes. Exploits, credentials, and AI: The stories that stood out in the 2026 DBIR This year’s DBIR analyzes more than 31,000 incidents, including more than 22,000 confirmed breaches across 145 countries. It’s not light reading, unless your idea of a beach read includes ransomware economics, exploit chains, and the occasional donut chart. But diving deep into these topics is worthwhile, because the numbers show both change and stubborn repetition. Vulnerability exploitation is surging In terms of eye-popping statistics, the big story this year is the explosion of vulnerability exploitation, which is now the leading initial access vector for breaches–far exceeding phishing and credential abuse. Only 26% of critical vulnerabilities in the CISA Known Exploited Vulnerabilities catalog were fully remediated in 2025, down from 38% the prior year. Median time to full remediation rose to 43 days, a huge jump from last year’s 32 days. Maybe the scariest part of this whole scenario is that these are pre-Mythos numbers, and security experts are still bracing for an AI-powered hurricane of vulnerabilities. The report’s authors attribute this escalation to the sheer volume of vulnerabilities organizations had to face, finding that there were roughly 50% more critical vulnerabilities to patch over last year. But while we can speculate about why there are suddenly so many more vulnerabilities to patch, what’s indisputable is that organizations need to be investing more resources in their patch management efforts. It might be a sisyphean task, but that doesn’t mean it’s not worth doing. Diminishing returns for ransomware Ransomware remains a dominant pressure point, appearing in 48% of breaches. However, there is some good news: 69% of ransomware victims in the DBIR dataset did not pay, and median payments continued to decline. That suggests resilience work is having an impact. Tested backups, segmentation, access controls, and incident response planning are not exciting cocktail conversations, but they sure beat explaining why the finance share was encrypted by someone named DarkSomething_1997. Weak links in the supply chain Third-party risk spiked in this year’s report, and breaches involving third parties rose to 48% of total breaches, a 60% increase from the prior dataset. The report points to familiar causes in cloud and SaaS environments: missing or improperly secured MFA, weak passwords, poor credential rotation, and excessive permissions. This is where security programs often discover that their real perimeter includes vendors, contractors, SaaS apps, service accounts, OAuth tokens, and at least one integration nobody remembers approving. The report cautions organizations to reign in permissions, writing “...a strong starting point is to focus on the authentication and authorization layers, as those are usually the ones that end up on an organization’s end of the responsibility matrix of cloud environments.” The authors also warn, “We should pay special attention to service and machine accounts, as those will likely be the ones leveraged in our potential agentic AI future.” Credentials and the “human element” Even in our ever more automated work environment, the human element is still at the center of many breach stories. It appeared in 62% of breaches, while Social Engineering represented 16% of all breaches. This year, the report separated traditional phishing attacks (which they define as using asynchronous communication like emails) from “pretexting,” where attackers are communicating with victims in real time. Email phishing is still common, but mobile-centric tactics are gaining traction. In simulations, voice and text-based attacks had a median success rate 40% higher than email simulations. Attackers have learned that people make decisions while multitasking, commuting, or staring at a phone between meetings. Corporate security training needs to catch up to this new reality. And what about passwords? This year credential abuse fell to 13% as the first observed entry point. So at last, we here at 1Password can hang up our spurs and call it a day. Just kidding. While passwords may not be the leading initial attack vector, credential abuse appears in 39% of breaches when measured across th

Extras afișat conform termenilor RSS ai publicației · 122 cuvinte · textul integral și figurile sunt pe site-ul publicației