Verizon 2026 DBIR: Vulnerability Exploitation Leads Initial Access as Ransomware Grows
Report discovered via Awesome Annual Security Reports.
Summary
Verizon’s 2026 DBIR analyzes over 22,000 confirmed breaches across 145 countries. Vulnerability exploitation led initial access at 31%, while ransomware and third-party involvement each appeared in 48% of breaches.
Key points
- Verizon analyzed more than 31,000 security incidents, including over 22,000 confirmed breaches across 145 countries, normalizing contributor data through VERIS. Contributor coverage and detection limitations influence the findings.
- Vulnerability exploitation accounted for 31% of initial access, up from 20%. Credential abuse fell to 13%, partly because pretexting became a separately tracked vector; credential abuse still occurred somewhere in 39% of breaches.
- Across vulnerability-management data from more than 13,000 organizations, only 26% of identified CISA KEV vulnerabilities were fully remediated, down from 38%. Median full-remediation time increased from 32 to 43 days.
- Ransomware appeared in 48% of breaches, up from 44%. Among ransomware victims in the dataset, 69% did not pay, while the median payment declined to $139,875.
- Third-party involvement reached 48% of breaches, a 60% relative increase. In the cloud-exposure dataset, only 23% of third-party organizations fully remediated missing or improperly secured MFA.
- Phone-centric social-engineering simulations had a roughly 40% higher median success rate than email simulations. The report cautions that the non-email comparison used only 35 campaigns, versus 8,395 email campaigns.
- Threat actors used generative AI for targeting, initial access and tool development, but most observed AI-assisted malware development reproduced established techniques. Less than 2.5% of observations involved techniques with one or fewer known malware examples.
Article Details
- Publisher
- Verizon
- Report Period
- 2024-11-01 to 2025-10-31
- Scope
- Global analysis of anonymized security incidents and confirmed data breaches across 145 countries, with industry, regional, and small- and medium-sized business analysis.
- Sample Size
- More than 31,000 security incidents, including more than 22,000 confirmed data breaches; supplementary research datasets have separate populations and timeframes.
- Key Statistics
- Vulnerability exploitation accounted for 31% of known initial access vectors in the reporting dataset, up from 20% in the previous report.
- In the vulnerability-management study covering more than 13,000 organizations, 26% of detected CISA KEV vulnerabilities were fully remediated, down from 38%; median full remediation time increased from 32 to 43 days.
- Ransomware appeared in 48% of breaches, up from 44%; 69% of ransomware victims in the payment dataset did not pay, and the median ransom payment was $139,875.
- Third-party involvement appeared in 48% of breaches, up from 30%, representing a 60% relative increase.
- The non-intentional human element contributed to 62% of breaches, compared with 60% previously; the report cautions that the difference does not warrant extensive interpretation given error margins.
- Recommendations
- Prioritize vulnerability remediation using recent exploitation intelligence alongside environment-specific risk, rather than vulnerability age or KEV inclusion alone.
- Deploy and correctly configure MFA, rotate credentials appropriately, and enforce least privilege in cloud environments, including service and machine accounts.
- Adapt awareness training and business procedures to voice- and text-based pretexting, particularly for help desks and customer support, and make incident reporting easy for users.
- Inventory and minimize internet-facing assets, prepare for coordinated patch releases, and segment networks containing difficult-to-replace end-of-life devices.
- Embed security fundamentals into contracts with business associates and suppliers.
MITRE ATT&CK
T1003.002 · Security Account ManagerThe report identifies Security Account Manager dumps as a method of extracting credentials.T1003.006 · DCSyncThe privilege-escalation analysis describes DCSync convincing a domain controller to replicate data, including passwords.T1046 · Network Service DiscoverySystem Intrusion cases included scanning local networks to discover systems after compromise.T1078 · Valid AccountsAttackers used stolen credentials to access organizational systems, cloud environments, VPNs, and remote desktop services.T1199 · Trusted RelationshipThe third-party breach analysis describes attackers leveraging vendor network connections or vendor-held credentials to enter customer environments.T1219 · Remote Access ToolsAttackers increasingly used legitimate RMM and desktop-sharing software to establish remote sessions and orchestrate attacks.T1486 · Data Encrypted for ImpactRansomware encrypted victim data, making systems or their contents unusable.T1550.001 · Application Access TokenAccording to publicly disclosed information, compromised Salesloft Drift OAuth tokens, or keys capable of deriving them, were used against Salesforce to steal customer data.T1566 · PhishingPhishing messages were used to induce credential submission or other actions that advance compromise.
People
Alex PintoNamed member of the Verizon DBIR author team.C. David HylenderNamed member of the Verizon DBIR author team.Jay JacobsChief Data Scientist at Empirical Security and former DBIR writer who assisted with the vulnerability exploitation-frequency analysis.Philippe LangloisNamed member of the Verizon DBIR author team.Suzanne WidupNamed member of the Verizon DBIR author team.
Threat Actors
Vendors
Anthropicall, we didn’t spend all this time and effort from AnthropicOraclea zero-day vulnerability in Oracle’sSalesforceconcern themselves with where the initial campaign around the Salesforce plugin improper credential rotation) or lack ofSalesloftaccess happens and where the data that Salesloft Drift facilitating breaches of least privilege enforcement for users orSnowflakeyear’s campaign involving Snowflake is
Products
ACEmanageraccessible ACEmanager interfaceClaudeAnthropic (developers of the Claude AIMicrosoft Active Directorymedian percentage of Active Directory are looking to crack the hashes of theOracle E-Business Suiteaffected by the Oracle E-Business SuiteSalesforceconcern themselves with where the initial campaign around the Salesforce plugin improper credential rotation) or lack ofSalesloft Driftaccess happens and where the data that Salesloft Drift facilitating breaches of least privilege enforcement for users orSnowflakeyear’s campaign involving Snowflake is
Tools
Countries
AustraliaCybersecurity Architecture AustraliaCanadaincluding regional disclosure laws, our Southern Asia (034), South-eastern Asia United States and CanadaSingaporeactor UNC3886 against Singapore’s investigations and implementing theUnited Statesincluding regional disclosure laws, our Southern Asia (034), South-eastern Asia United States and Canada
Industries
Educational ServicesVERIS Actors 23 Educational Services 82 Appendix C: Using the DBIRFinancial and Insurance| VERIS Actions | 29 Financial and Insurance | 84 |Healthcare| VERIS Assets | 33 Healthcare | 86 |Manufacturing| VERIS Attributes | 35 Manufacturing | 88 |Professional ServicesProfessional Services and Manufacturing the last few years, with 50% of attacksPublic administration| | Public Administration | 90 |Retail| | Retail | 94 |Utilitiesand NAICS 22 (Utilities), which may