Verizon 2026 DBIR: vulnerability exploitation overtakes credentials as primary breach vector for the first time in 19 years

Verizon published the 2026 Data Breach Investigations Report on 2026-05-19 covering, per the full DBIR PDF, tens of thousands of security incidents and over ten thousand confirmed breaches collected over the standard DBIR window (autumn of the prior year through autumn of the report year) (Verizon official press release via GlobeNewswire, 2026-05-19; Help Net Security analysis, 2026-05-20; Verizon DBIR landing page — the specific dataset incident / breach counts cited by some secondary coverage were not separately confirmed in the press-release coverage and should be read against the full DBIR PDF at verizon.com/business/resources/T1f0/reports/2026-dbir-data-breach-investigations-report.pdf). This is the publication event that the 2026-W21 weekly summary flagged as imminent — the dedicated PD-9 treatment lands here. The report is structurally significant for European public-sector SOCs because it provides industry-spanning patching-cadence and supply-chain benchmarks that map cleanly onto NIS2 risk-management obligations.

Headline shift: exploitation overtakes credentials. For the first time in the DBIR's 19-year history, vulnerability exploitation (T1190 Exploit Public-Facing Application) is the leading initial-access vector at 31 % of breaches — Verizon's own press-release language (GlobeNewswire). Per Help Net Security's reading of the full DBIR, compromised credentials (T1078 Valid Accounts; T1110 Brute Force) dropped to 13 % (Help Net Security, 2026-05-20). This is a sustained inversion, not a single-year blip — the trend curve has been climbing for three reporting cycles and accelerated sharply in the 2024-2025 window. For SOCs, the implication is that detection-investment prioritisation that ranks credential-stuffing telemetry above EDR exploit-protection coverage and network-layer anomaly detection for exploitation activity is now out of alignment with the breach distribution.

Patching-cadence regression. Only 26 % of CVEs listed in the CISA Known Exploited Vulnerabilities (KEV) catalog were fully remediated by polled organisations in the reporting window, down from 38 % the prior year. The median time to patch deteriorated from 32 days to 43 days. Per PD-13 the KEV remediation deadline itself has no jurisdictional weight in CH/EU, but the listing flag is jurisdiction-agnostic intelligence about exploitation in the wild — and the DBIR's finding is that even organisations that are subject to BOD 22-01 are missing the deadline three quarters of the time. The benchmark for CH/EU public-sector defenders is therefore an honest one: most peers are not patching their KEV inventory on time, and median 43-day exposure is the operational reality. A SOC that is hitting 14-day patch SLAs on KEV entries is now outperforming the industry baseline by a factor of three.

Supply-chain breaches as the dominant compounding factor. Third-party / supply-chain breaches grew 60 % year-over-year and now represent 48 % of all breaches in the dataset (T1195 Supply Chain Compromise). Only 23 % of affected organisations had fully remediated MFA gaps in third-party cloud accounts — the most common upstream pivot point. The 60 % growth aligns with the campaign-level signal this brief has carried throughout May 2026 (TeamPCP / Mini Shai-Hulud. The actionable layer for defenders is third-party-CI access scoping — every reduction in the cross-tenant blast radius of a single compromised dev-tool integration directly reduces measured breach probability.

Ransomware and AI signals. Ransomware was present in 48 % of breaches, up from 44 % — the proportion-not-paying held at 69 %. The DBIR carries shadow AI usage as the third-most-common insider data-loss mechanism, with usage rates quadrupling year-over-year; the report also notes AI-bot traffic growing 21 % month-over-month against 0.3 % growth for human traffic. Verizon's press-release framing is that "AI is being leveraged by threat actors to accelerate the time to exploit known vulnerabilities, shrinking the window for defense from months to mere hours" (GlobeNewswire) — that finding maps to the patch-velocity number: the 43-day median patch time that was acceptable when working PoCs took weeks is now insufficient when AI-assisted exploitation collapses weaponisation latency to hours. The full DBIR PDF is published at verizon.com/business/resources/T1f0/reports/2026-dbir-data-breach-investigations-report.pdf.

Defender takeaways for a Swiss / European public-sector SOC:

• Re-weight detection-investment priorities: EDR exploit-protection coverage and network-layer anomaly detection for T1190 exploitation activity now rank above credential-stuffing detection for breach-probability reduction.
• Use the 26 % KEV remediation rate and 43-day median patch time as the public benchmark when justifying patch-cadence SLAs to programme owners; the industry's distribution is far worse than most ISMS targets assume.
• Treat third-party cloud-tenancy MFA gap closure as a single highest-leverage control — the 23 % remediation rate is the most actionable bar to clear.
• Map the +60 % supply-chain finding directly onto NIS2 Article 21(2)(d) supply-chain-security obligations during the next ISMS review cycle; the DBIR is now the canonical industry-baseline citation.