Verizon’s 2026 Data Breach Investigations Report delivers a landmark finding: vulnerability exploitation is now the leading initial access vector in confirmed breaches — surpassing stolen credentials for the first time in the report’s 19-year history. 31% of breaches stemmed from unpatched vulnerabilities; credential abuse accounted for just 13%.

Patching Is Losing the Race

The shift is partly a story of attacker speed and partly one of defender inertia. AI-assisted exploitation is compressing the time from vulnerability disclosure to active weaponization from months down to hours. At the same time, organizations patched only 26% of vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog in 2025 — down from 38% in 2024. The exploit window is shrinking while remediation rates are falling.

Ransomware, Supply Chain, and Shadow AI

Three other findings stand out:

Ransomware was present in 48% of confirmed breaches in 2025, up from 44% — continuing to dominate as the primary monetization path after initial access is achieved.

Supply chain breaches surged 60% year-over-year, now accounting for 48% of total breaches. Third-party vendor access is as dangerous as direct exploitation.

Shadow AI emerges as a new data risk: 67% of employees accessing AI services from corporate devices are using personal accounts — outside corporate visibility. With overall AI adoption at 45% of employees (up from 15%), this is a rapidly expanding data exfiltration surface.

Mobile Phishing Outperforms Email

Mobile-centric phishing attacks are now 40% more successful than email phishing. As endpoint security matures on desktops, mobile devices represent the softer target — and attackers have noticed.

What This Means

The 2026 DBIR makes the case that traditional reactive patching cadences and perimeter security models are insufficient against the current threat landscape. Security teams need to prioritize CISA KEV remediation as a hard requirement, extend third-party risk monitoring beyond point-in-time assessments, build AI usage governance before shadow AI becomes a breach vector, and invest in mobile phishing defense.

The full report is available at verizon.com/business/resources/reports/dbir/.