Verizon’s Data Breach Investigations Report (DBIR) for 2026 has been released, and the single most interesting piece of information is the new prevalence of attackers leading with vulnerability exploitation. This is the first time in 19 years that credential abuse has not been the leading initial breach cause.
Of all the cyber attacks examined in the 2025 DBIR, 22% kicked off with credential abuse. Vulnerability exploitation has been making a strong push to take the lead over the last two years, however, with its most recent surge putting it at 20% (and ahead of phishing at 16%).
2022 Verizon DBIR finds that at least 90% of data breaches are attempts at financially motivated crime, with nearly all of the remainder made up of espionage (in turn almost entirely conducted by nation-state threat groups).