For 19 years stolen credentials were the #1 way hackers got in. Not anymore.
Source Reddit BlueTeam
Discussion
The 2026 Verizon Data Breach Investigations Report (DBIR) reveals a shift in the primary attack vector from stolen credentials to exploitation of software vulnerabilities. Attackers are leveraging AI to identify and weaponize known vulnerabilities faster, reducing the window between disclosure and exploitation from months to hours. Mobile phishing has surpassed email phishing by 40%, and shadow AI usage in workplaces has tripled, with 75% occurring through personal accounts. Third-party breaches have increased by 60% year over year. Despite these challenges, fewer ransomware victims are paying ransoms, with the refusal rate rising from 65% to 69%. This report highlights evolving attacker tactics and the growing difficulty in patching vulnerabilities promptly.
r/Information_Security (opens in a new tab)u/Syncplify0 points0 comments
For 19 years, stolen credentials topped the Verizon Data Breach Investigations Report as the #1 way attackers get into networks. But not anymore.
Vulnerability exploitation has taken the top spot, and the reason isn't hard to figure out - AI is helping attackers find and weaponize known flaws faster than security teams can patch them, with the window between disclosure and active exploitation having shrunk from months to hours. Only a quarter of vulnerabilities ever get fully patched, and it takes an average of 43 days to fix even half of them, so "just patch faster" isn't really a strategy anymore.
But that's not all the report found. Mobile phishing is now outperforming email phishing by 40%, shadow AI has tripled in a single year with 75% of workplace AI happening through personal accounts, and third-party breaches are up 60% year on year.
The one piece of good news - fewer ransomware victims are paying up, with the proportion refusing to pay rising from 65% to 69%.
Which of these do you think most companies are completely unprepared for?