cyber.hendryadrian.com
Security Report · wiz.io

Verizon DBIR Finds Exploitation Leads Breach Access as KEV Remediation Slows

· Original article ↗

Summary

The Verizon DBIR reports that vulnerability exploitation accounted for 31% of breaches and third-party involvement rose to 48%. Wiz’s contribution found only 26% of tracked KEVs fully remediated, with median remediation time increasing to 43 days.

Key points

  • Vulnerability exploitation was the leading initial access vector, accounting for 31% of breaches.
  • Only 26% of the analyzed Known Exploited Vulnerabilities were fully remediated; 16% remained entirely unremediated.
  • Median KEV remediation time rose from 32 to 43 days, while the median number of KEVs organizations faced increased from 11 to 16.
  • Third-party involvement in breaches increased from 30% to 48% year over year.
  • The article describes attackers abusing trusted relationships, including software packages, OAuth tokens, developer credentials, CI/CD systems, and SaaS integrations.
  • The DBIR describes AI as accelerating attacker tasks such as reconnaissance and exploit operations; the article also notes security risks from AI agents, MCP servers, permissions, and credentials.
  • Recommended priorities include reducing internet-exposed systems, remediating actively exploited vulnerabilities, hardening identities and integrations, and governing AI systems.

Article Details

Publisher
Wiz
Report Period
2026
Scope
Wiz's contribution to the Verizon DBIR on KEV remediation across cloud and code environments, alongside DBIR findings on breaches, third-party involvement, and AI-related security risks.
Key Statistics
  • Vulnerability exploitation accounted for 31% of breaches in the DBIR.
  • In Wiz's Cloud Threats Retrospective, 40% of documented cloud intrusions began with weaponized vulnerabilities.
  • Only 26% of KEVs were fully remediated; 16% remained entirely unremediated.
  • Median KEV remediation time increased from 32 days to 43 days; the median number of KEVs requiring remediation rose from 11 to 16, with organizations facing roughly 50% more KEVs than the year before.
  • Third-party involvement in breaches rose from 30% to 48% year over year; Wiz also reported AI agents in 57% of organizations and MCP servers in 80% of cloud environments.
Recommendations
  • Reduce externally reachable exposure.
  • Prioritize remediation of actively exploited vulnerabilities.
  • Harden identities and trusted integrations.
  • Secure software supply chains and development environments.
  • Apply to AI systems the governance and visibility controls used for cloud infrastructure.

Threat Actors

TeamPCPWiz says TeamPCP's recent activity continued the trend of attacks abusing trusted relationships into 2026.

Vendors

VerizonEvery year, the Verizon Data Breach Investigations Report (DBIR) provides a snapshot of how attackers are compromising organizations. This year's report highlights a clear trend: attackers continue to succeed throughWizThis year, Wiz contributed research on Known Exploited Vulnerability (KEV) remediation trends to the DBIR, providing visibility into how organizations are responding to vulnerabilities that attackers are actively

Related Articles