Verizon's 2026 Data Breach Investigations Report page says 31 percent of breaches start with software vulnerabilities, now the top initial access method, ahead of stolen passwords. If that holds for your sector, speed and focus in remediation pay off more than they did when credentials led.
What the page states
The 2026 DBIR covers incidents from 1 November 2024 to 31 October 2025. The summary page says 48 percent of breaches involve ransomware, that payouts are shrinking and that businesses are often choosing not to pay. It says 31 percent of breaches begin with exploitation of software vulnerabilities, the leading entry route.
The landing page does not give a median ransom, the share of victims who paid or third party involvement, so read the full report for those. Numbers here come from the summary page only.
An economic reading
Attackers weigh cost against expected return. Exploiting a known flaw is cheap when tools are public and many targets are unpatched, because one effort scales across victims. Stolen credentials need collection or purchase and often hit an MFA barrier.
If vulnerability exploitation is the top route, two things follow. Defenders who fix quickly raise the attacker's cost, and those who lag stay a cheap target. This is an interpretation, not a claim from the report.
What to do with it
- Know your exposure. You cannot fix what you cannot see. Start with internet facing systems. See patch VPN gateways first.
- Rank by real risk. Use exploit signals and reachability to separate what can be hit from what cannot. See reachability versus EPSS versus KEV versus CVSS.
- Set tiers and clocks. See using EPSS and KEV for patch tiers.
- Have a mitigation path. Not every flaw has a patch the day it is public. See emergency mitigation when no patch exists yet.
- Measure risk, not percent patched. See patch metrics that show risk.
Try it yourself
Click through it at your own pace, or open it full screen. See how many findings drop out when only reachable code paths count.
Where this stops
A single report reflects its own contributors and method. Your sector may differ. Compare with your own incident data and advisories, and do not drop credential controls because exploitation ranks first. Both routes matter.
Quick check
What share of breaches began with vulnerability exploitation in the DBIR 2026 summary?
The page states 31 percent, the top initial access method, ahead of stolen passwords.
Should credential controls be dropped?
No. Stolen credentials remain a major route, and the report shows only the ranking at the top.
Sources
Last reviewed: 19 October 2026.
