- Hackers are now exploiting software flaws faster than companies can patch their systems
- Mobile phishing scams are now surpassing traditional email attacks in enterprise environments around the world.
- Unauthorized AI tools are quietly leaking sensitive information in workplaces around the world.
For the first time in nearly two decades, the exploitation of software vulnerabilities has overtaken stolen passwords as the primary way hackers breach corporate networks.
Verizon’s 2026 Data Breach Investigations Report claims that vulnerability exploitation now accounts for 31% of all confirmed data breaches.
Credential theft, once the dominant entry point, has fallen to just 13% of reported incidents this year.
Vulnerability exploitation has become the number one threat
The report analyzed more than 31,000 security incidents across 145 countries, revealing how the threat landscape has fundamentally changed.
Attackers leverage artificial intelligence to accelerate the discovery and weaponization of known software vulnerabilities, significantly narrowing the window defenders have to patch their systems, reducing response time from months to just hours.
Despite this growing risk, the report reveals that only 26% of critical vulnerabilities have been fully patched by 2025.
The median time it takes organizations to apply patches has increased to 43 days, leaving networks exposed for weeks or even months.
“Even as AI-driven cyberthreats increase, security fundamentals remain the most effective defense,” said Daniel Lawson, senior vice president of Worldwide Solutions at Verizon Business.
Ransomware was present in almost half of all breaches, or 48%, up from 44% the previous year.
However, the report notes that ransom payments have declined, with 69% of victims refusing to pay.
Mobile devices have become a more dangerous attack vector than email, with phishing simulations showing that text messages and voice calls generate 40% higher click-through rates than traditional email phishing.
The human element remains involved in 62% of all breaches, as attackers increasingly target mobile-centric communication channels, where users are less suspicious.
Nearly half of all employees, 45%, now use AI tools at work, which is a significant increase from just 15% the previous year.
But 67% of these workers access AI platforms through unauthorized personal accounts rather than approved corporate channels.
Shadow AI has become the third most common cause of non-malicious data leaks, putting corporate secrets at significant risk of unintended exposure.
Supply chain attacks have also increased significantly, with third-party involvement in breaches increasing by 60% year-over-year.
The DBIR clearly shows that attackers have changed tactics and most organizations have not kept pace with modern threat actors.
Security fundamentals and the use of firewalls or malware removal tools still work, but they only work when organizations practice them consistently.
Organizations are advised to apply patches more quickly, monitor mobile channels, control AI usage, and assume that third parties will eventually be compromised.
Attackers are already acting on this basis, and DBIR numbers prove them right more often than wrong.
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds.
