The IT Nerd

The new Verizon Data breach investigations report has been released, revealing that nearly a third (31%) of data breaches over the past year started with vulnerability exploitation. This is up from 20% in last year’s report. The report looks at the dramatic impact that AI and supply chains are having on businesses.

Ensar Seker, CISO at SOCRadar:

“The latest Verizon DBIR confirms what many defenders have been experiencing operationally over the past year: attackers are increasingly prioritizing speed and scalability. Vulnerability exploitation jumping from 20% to 31% is a major signal that threat actors are moving away from slower intrusion methods and focusing on exposed internet-facing assets, edge devices, third-party software, and unpatched vulnerabilities that can provide immediate access at scale. What is especially concerning is how this trend intersects with supply chain risk and AI-driven operational acceleration. Organizations are no longer defending only their own infrastructure. They are also inheriting the risks of vendors, MSPs, SaaS providers, open-source dependencies, and interconnected ecosystems. 

A single exploited supplier can create downstream compromise opportunities across hundreds or thousands of organizations simultaneously, which dramatically increases attacker ROI. The AI component is equally important. While AI is currently improving productivity for defenders, adversaries are also leveraging automation to accelerate reconnaissance, phishing customization, vulnerability research, and operational decision-making. This lowers the barrier for less sophisticated actors while increasing the speed of mature threat groups. The result is a threat landscape where exploitation cycles are becoming shorter and organizations have less time to detect and respond. One of the biggest lessons from this year’s DBIR is that exposure management is becoming just as critical as traditional detection. 

Organizations need continuous visibility into external attack surfaces, third-party dependencies, exposed credentials, vulnerable assets, and misconfigurations. The companies that reduce attacker dwell time will be the ones that can rapidly identify exploitable exposure before threat actors operationalize it. We are also seeing a growing divide between organizations that treat patching as a periodic IT function versus those treating vulnerability prioritization as an active cyber risk management process tied to real-world exploitation intelligence. Attackers are increasingly targeting the vulnerabilities organizations fail to prioritize correctly, not necessarily the ones with the highest CVSS score.”

Brian Higgins, Security Specialist at Comparitech:

“The DBIR is always a useful publication. The contribution community is quite unique and it’s worth reading how the data is collected and managed if you haven’t already. A study of results and trends etc. should inform a lot of budget allocation and decision making in the coming periods.The major takeaways this year are:

Vulnerability exploitation overtaking credential theft as the highest ranking breach method. This in itself should be a catalyst for some major resource restructuring.

AI is obviously changing the attack landscape but possibly more noteworthy is a reported 45% of employees using unauthorised generative AI allowing data leakage at alarming levels. Clearly some policy and enforcement measures could help here.

Third party/Supply Chain attacks now account for almost half of all reported breaches. Conclusive proof, should anyone still need it, that it’s not enough in today’s digital environment to simply put your own house in order. Your Network is dynamic and its security relies heavily on factors difficult to control. It’s more vital than ever to have a Plan for when things go sideways.”

I really suggest reading this report as it really provides a lot of insight as to what threat actors are up to and where your next threats may come from. That way you can plan your defences accordingly.

UPDATE: Dave Hayes, VP of Product at cybersecurity company FusionAuth, commented:

“Credentials continue to do a lot of damage, they just don’t look like passwords anymore. The Drift Breach wasn’t a traditional password breach, it was a token abuse problem. OAuth tokens are critical to modern apps, but they’re also incredibly powerful. If companies don’t know where tokens exist, what they can access, and when they expire, attackers will happily answer  those questions for them.”

UPDATE #2: Scott Miserendino, VP of Engineering, Cyber at DataBee, A Comcast Company commented:

“Vulnerability exploitation is now the front door—and patching isn’t keeping up.

The DBIR confirms what many security leaders are experiencing operationally: exploitation of vulnerabilities is now the leading initial access vector (31%), overtaking credential abuse. But the more important signal isn’t just attacker behavior—it’s defender constraints. Organizations are facing a growing backlog of critical vulnerabilities, with only 26% fully remediated and a median remediation time stretching to 43 days. 

The gap here isn’t awareness—it’s operational execution. Security teams don’t lack vulnerability data; they lack the ability to prioritize, coordinate, and act on it at scale across fragmented environments.

Looking ahead, this challenge is likely to intensify. Emerging cyber-focused AI models—such as Anthropic’s Mythos, OpenAI’s GPT-5.5-Cyber, and DeepMind’s Big Sleep—have the potential to dramatically accelerate vulnerability discovery and lower the barrier to exploitation. Even before broad availability, it’s reasonable to expect that attackers will gain access to similar capabilities, enabling them to uncover undisclosed vulnerabilities faster and weaponize them with far less expertise. If that happens, the already widening gap between time-to-exploit and time-to-remediate could expand further, making it a critical area to watch in next year’s DBIR.

The implication is clear: vulnerability management is no longer just a prioritization problem—it’s a speed and accountability problem.

The most effective defense remains foundational but difficult to execute consistently:

• A robust, disciplined patching process
• Continuous monitoring of exposures across environments
• Clear, enforced accountability for remediation, grounded in accurate asset and application ownership

Organizations that can reliably answer who owns what, and ensure those owners are accountable for timely patching, will be far better positioned to reduce risk, even as attacker capabilities accelerate. In other words, while the threat landscape is evolving rapidly, the winners will be those who can operationalize the fundamentals with greater precision, speed, and accountability.”