Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credentials as #1 Breach Vector — And Only 26% of CISA KEV Flaws Were Patched
The Verizon 2026 Data Breach Investigations Report analyzed 22,052 incidents and 12,195 confirmed breaches — the largest dataset in the report’s history. The headline finding: vulnerability exploitation has overtaken stolen credentials as the #1 initial access vector in breaches for the first time ever. Only 26% of CISA KEV vulnerabilities were fully remediated in 2025. Median remediation time grew to 43 days while exploitation timelines shrank to 5 days. Ransomware appeared in 44% of all breaches. Supply chain attacks doubled. Here is what every enterprise security team needs to act on immediately.