Verizon: exploits now beat stolen passwords as the way in, 31% to 13%

01The crossover: exploitation 31%, credential abuse 13%

Verizon records the first action it can identify in each breach. Exploiting a vulnerability rose from 20% of breaches in last year’s report to 31% in this one, an increase of 55%. Credential abuse, the previous leader, fell from 22% to 13%. Phishing held at 16%. Pretexting, now tracked separately, was 6%.¹

The crossover is not one region’s quirk. Verizon’s regional table shows exploitation ahead of credential abuse in all four regions it reports. The gap is narrowest in North America and widest in Europe, the Middle East and Africa.

The second headline rise is tied to the first. Third parties were involved in 48% of breaches, up from 30%, a 60% increase after the figure had already doubled the year before. Verizon’s definition of a third party includes a vendor whose product carried the flaw that let the attacker in, which it says covers “the majority of single Exploit vuln actions” in the report.¹ Read together, the two numbers tell one story: the hole is usually in something you bought.

02The password did not stop mattering

Verizon is blunt about what the 13% does not mean: “You should stop postponing that MFA rollout in your organization because credentials are an integral part of the threat actor’s toolkit.”¹ Count credential abuse at any stage of a breach, not only as the first step, and it is 39%. That still puts it ahead of exploitation. In System Intrusion breaches, the pattern behind 60% of all breaches, stolen credentials and exploits run level as the way in, at about 39% each.¹

Ransomware was in 48% of breaches, up from 44%. Fewer victims paid: 69% did not, against 65% the year before, and the median ransom paid fell to US$139,875 from US$150,000.¹ Smaller firms carry most of it. Where Verizon knew the victim’s size, about 96% of ransomware victims were small or mid-sized businesses. Their attackers got in through compromised credentials in 38% of cases and through unpatched vulnerabilities in edge devices in 29%. Initial access brokers, who sell a foothold to ransomware crews, listed VPN access in 44% of the offers Verizon examined.¹

03Where exploitation lands: the edge

Last year’s report measured it. Edge devices and VPNs were 22% of the targets of exploitation, an almost eight-fold rise from 3%. Only about 54% of those flaws were fully fixed during the year.³ This year’s report does not repeat that single figure, so we will not claim one. What it does say points the same way. Network devices (routers, firewalls and, under a new coding rule, remote-access appliances) rose from 1.5% to 5% of breaches where the asset was known. In System Intrusion breaches, attacks through web applications and desktop-sharing software grew, while VPN held at about 16%.¹

CISA’s catalogue shows what the first five months of 2026 looked like for anyone running these boxes. Two flaws in Cisco’s SD-WAN platform drew an emergency directive. Its order told US federal agencies to inventory, collect forensic evidence, patch within two days and hunt for a root-level compromise.⁶

On 5 February CISA also set the first dated rule we have seen for retiring these devices. It gave US agencies three months to inventory listed end-of-support edge devices, 12 months to remove those, 18 months to remove all such devices, and 24 months to build continuous discovery. Its reason fits in one line: “Edge devices are attractive targets due to their extensive reach into an organization’s network.”⁵ The directive binds only US federal agencies. It is still the clearest public yardstick a private board can borrow.

04Patching got slower as the pile grew

The remediation numbers come from scanner data covering more than 13,000 organisations. They count every flaw in CISA’s catalogue found in an environment, old or new. Only 26% of those flaws were fully fixed, against 38% a year earlier. The share left entirely unfixed rose from 12% to 16%.¹

Verizon’s explanation is volume, not neglect. The median organisation had 16 known-exploited flaws to patch in 2025, against 11 in 2024. The dataset held 527.3 million vulnerability instances, almost eight times the 68.7 million of 2022. At day 28, 35% were still open, up from 27%. Even the best organisations fix only 30% to 40% of these flaws in the first week, and the share patched before a flaw reached CISA’s list fell from 17% to 12%.¹ The authors also expect the queue to lengthen. Their advice is to “prepare for a large number of patches from coordinated disclosures of AI-augmented vulnerability discovery, while making sure to inventory and minimize your internet-facing footprint.”¹

05Another identity tool, or a faster patch cycle?

Our answer is that for most mid-sized organisations the next rupee goes to the edge. That holds once the identity basics are in place, and only then. The evidence against us is real. Credential abuse is still in 39% of breaches. Infostealer leaks precede most ransomware. And in one cloud dataset Verizon examined, 37% of organisations had an admin account on an infrastructure service with MFA switched off.¹ But those are gaps in tools most firms already own. They do not call for a new product category.

We call the line between the two columns the three-day test. When a flaw in one of your internet-facing devices enters CISA’s catalogue, can you patch it or take it offline within three days? That is the window CISA gave 10 of the 11 edge flaws it listed this year.⁴ If the answer is no, run four steps before any new identity purchase. First, inventory every firewall, VPN gateway, load balancer, SD-WAN controller and router that faces the internet, with its software version and end-of-support date. Second, write a three-day patch rule for known-exploited flaws on that list, with a named owner and a tested rollback. Third, plan the replacement of anything past end of support. Fourth, enforce MFA on every VPN and every device admin console, with the identity tools you already have. Then spend on identity, against a gap you can name.