The 2026 Verizon DBIR just dropped, and one trend that stood out is:

Vulnerability exploitation is now the leading initial access vector, accounting for 31% of breaches.

That’s up from 20% last year (+55% YoY), which is a pretty significant shift. Credential abuse dropped to 13%, and phishing is at 16%.

https://preview.redd.it/7rtbr4luqj2h1.png?width=900&format=png&auto=webp&s=f92574128c9f8d72f438531217267675aca10607

What’s changing?

This feels less like a small trend shift and more like attackers adjusting how they get in.

Instead of relying as heavily on users, there’s a stronger focus on:

• Exposed services
• Edge infrastructure
• Unpatched systems

Basically, anything reachable and vulnerable is getting hit more consistently.

The patching gap isn’t closing

You’d expect faster remediation to offset this, but the data says otherwise:

• Only 26% of critical vulnerabilities were fully remediated in 2025
• Median time to fix is now 43 days
• Organizations are dealing with ~50% more vulnerabilities than last year

So defenders are dealing with higher volume and limited capacity at the same time.

AI is accelerating everything

Another interesting layer here is how AI is being used.

The report shows attackers using AI across multiple stages:

• Vulnerability discovery
• Exploit development
• Campaign execution

In some cases, they’re using it across ~15 techniques per attack, sometimes up to 40. The “automation of known attacks” is becoming more real.

Old vulnerabilities are still a big problem

One of the more frustrating takeaways:

Around 80% of heavily exploited vulnerabilities are not new.

They’ve been around for a while, just still not fully patched.

So even as new CVEs drop, attackers are still getting plenty of mileage out of older ones.

What this means for security teams

The traditional vuln management model assumes there’s time between:

• Discovery
• Prioritization
• Remediation

That assumption seems harder to hold now.

With faster exploitation and more volume, it feels like the bigger challenge is:

• Figuring out what’s actually exposed
• Understanding what’s realistically exploitable
• Not just trying to fix everything equally

Curious how others are thinking about this.

• How are you prioritizing vuln remediation right now (risk-based, exploitability, asset context, etc.)?
• Anyone adopting exposure validation / attack path–based approaches? Or not quite yet?

Read our blog for more: https://www.breachlock.com/resources/blog/inside-verizons-2026-dbir-and-the-shift-to-vulnerability-exploitation-for-initial-access/