Verizon DBIR: Exploited Vulnerabilities Led Breach Entry in 2025

Summary

Verizon’s DBIR found exploited vulnerabilities were the leading known initial access vector in 2025 breaches. It also reported slow patching of CISA KEV flaws and ransomware in 48% of breaches, while ransom payments declined.

Key points

• Verizon analyzed more than 22,000 breaches over a period ending in October 2025.
• Exploited vulnerabilities accounted for 31% of known initial access vectors, up from 20% the previous year.
• Among more than 13,000 organizations studied, 26% of critical CISA KEV vulnerabilities were fully remediated; median time to patch rose to 43 days from 32.
• Ransomware accounted for 48% of breaches, up from 44% in 2024.
• Verizon reported that 69% of ransomware victims did not pay, while the median ransom payment fell from $150,000 to almost $140,000.
• Financial motives accounted for 88% of breaches; espionage accounted for the remainder.
• Verizon cautioned that ransomware activity is difficult to track, citing threat actors’ reuse or fabrication of breach claims.