Verizon published its 2026 Data Breach Investigations Report this week, covering more than 22,000 confirmed breaches – the largest dataset in the report’s 19-year history. The headline finding is a shift that security teams have watched developing for the past two years: exploiting software vulnerabilities (31%) has overtaken stolen credentials as the most common way attackers gain initial access, the first time this has happened since the report began.

Why the shift matters

Credential theft has dominated Verizon’s rankings for years, and most enterprise security investment over the past decade has been shaped by that reality. MFA deployment, password managers, identity detection tools, and phishing training have all grown in part as direct responses to the credential-dominated threat landscape.

The 2026 DBIR suggests the threat mix is changing. Attackers are increasingly finding it easier to find and exploit an unpatched vulnerability than to phish or buy their way through a credential-protected perimeter. Generative AI is contributing to this directly: the report notes that AI tools are compressing attack timelines from months to hours, enabling threat actors to move faster from identifying a security gap to exploiting it in production systems.

The practical implication is that patch management speed matters more than it ever has. A vulnerability that would previously have allowed weeks of exposure before exploitation now may allow only hours.

Third-party and supply chain breaches jump 60%

Third-party supply chain incidents now account for 48% of total breaches, up from 30% the previous year – a 60% increase. Only 23% of third-party organizations had fully remediated missing or improperly secured MFA on cloud accounts, meaning the gap between what organizations require of themselves and what they verify in their supply chain remains very wide.

This figure reinforces what the 2025 DBIR began flagging: breach exposure is increasingly determined not by your own security controls but by the weakest link in your vendor and dependency chain. For organizations that have invested heavily in internal security but apply lighter scrutiny to third-party access and software, the report is a direct signal about where the next breach is most likely to originate.

Ransomware, mobile, and shadow AI

Ransomware was involved in 48% of confirmed breaches, up from 44% the prior year, even as ransom payments decreased – the median payment dropped below $140,000 and only 31% of victims paid at all. The reduction in payment rates has not reduced the frequency of attacks; it has instead pushed groups toward higher volumes with lower individual demands.

The report also flags two emerging contributors to breach exposure. Mobile social engineering success rates rose 40% as attackers shifted focus from email to text and app-based channels that employees have been less trained to scrutinize. Separately, employee use of unsanctioned “shadow AI” tools tripled to 45% of the workforce, creating data leakage risks through inputs to external AI services that bypass normal data handling controls.

What this means for your security program

The 2026 DBIR is effectively a prioritization guide for where to direct security investment. Three areas stand out based on this year’s data:

Vulnerability management velocity. The window between public disclosure and active exploitation is shorter than it has been at any point in the report’s history. Patch management processes that treat critical vulnerabilities as a weekly or sprint-cycle task are no longer adequate for internet-exposed systems.

Third-party security requirements. Supply chain breaches at 48% of total incidents means that your security posture is only as strong as the access and software you extend trust to. Third-party access reviews, software bill of materials practices, and vendor security assessments need to become standard operating procedure rather than occasional exercises.

Shadow AI governance. With 45% of employees using unapproved AI tools, the data governance conversation has shifted from theoretical to active. Organizations need policies that address AI tool usage with the same specificity applied to other categories of sensitive data handling.

If you want to review your current exposure across any of these areas – vulnerability management processes, third-party access controls, or AI governance in a cloud or DevOps environment – contact Excello Digital. We help organizations translate findings like these into concrete security improvements.