Verizon 2026 DBIR: Vulnerability Exploitation Becomes Top Breach Vector

Summary

Verizon's 2026 DBIR says vulnerability exploitation caused 31% of 2025 breaches, ahead of credential abuse at 13%; it also reports slower patching, more ransomware and third-party breaches, and growing AI use by attackers and employees.

Key points

• The report analyzed 31,000 security incidents and more than 22,000 confirmed breaches, nearly double the 12,195 confirmed breaches reported for the previous year.
• Unpatched vulnerability exploitation accounted for 31% of breaches in 2025, compared with 13% attributed to credential abuse.
• Median time to fully patch vulnerabilities rose to 43 days from 32; organizations patched 26% of flaws in CISA's KEV catalog, down from 38%.
• Ransomware was involved in 48% of confirmed breaches, up from 44%; the median ransom paid fell below $140,000, and 31% of victims paid.
• Breaches involving third parties increased 60% and made up 48% of the total, according to the report.
• Verizon reported growing threat-actor use of generative AI for targeting, initial access, and malware and tool development; the median actor researched or used AI assistance across 15 documented techniques.
• The report says 62% of breaches involved a human element and social engineering accounted for 16%; mobile-centric phishing had a 40% higher median success rate than email phishing.

MITRE ATT&CK

People