The Verizon 2026 Data Breach Investigations Report, published on 19 May, analysed 22,000 incidents and confirmed 6,400 breaches. Among its headline findings: vulnerability exploitation has displaced phishing as the most common initial access vector, accounting for 28% of analysed breaches versus phishing’s 22%. The shift, which the DBIR notes began emerging in 2024 and accelerated in 2025, reflects structural changes in how attackers approach enterprise targets — and has direct implications for where security investment should be directed.
The Exploitation vs. Phishing Shift
For nearly a decade, phishing was the dominant initial access mechanism in the DBIR data. Social engineering — manipulating humans into taking actions that enable compromise — was more reliable and lower-cost than developing or purchasing working exploit code. This calculus is changing.
Several converging factors explain the shift:
Exploit commoditisation: The gap between vulnerability disclosure and weaponised exploit code has compressed dramatically. In 2020, a typical CVSS 9.x vulnerability would take weeks to months before a reliable public exploit was available. In 2025–2026, median time from CVE publication to functional exploit availability has dropped to days for high-profile vulnerabilities. Exploit code circulates rapidly through cybercriminal forums and is integrated into scanner-based attack frameworks within hours.
Scan-and-exploit automation: Mass exploitation campaigns no longer require attacker manual effort per target. Automated scanners identify vulnerable internet-facing services and deliver exploit payloads at scale. A vulnerable internet-facing appliance becomes an exploited appliance within hours of a reliable PoC publication, without any human interaction from either attacker or victim.
Phishing detection improvements: Enterprise email security has improved materially. Multi-factor authentication deployment has increased, reducing the yield from credential-phishing campaigns. Anti-phishing training programmes, while imperfect, have raised the cost of social engineering. Phishing remains effective but requires more effort per successful compromise.
What the Data Says About Vulnerability Types
The DBIR breaks down the vulnerability exploitation category further. The dominant classes in 2025–2026 breaches:
- Network perimeter appliances (VPN gateways, firewalls, load balancers): Most frequently exploited class by both nation-state and financially motivated actors. Palo Alto GlobalProtect, Cisco ASA/FTD, Fortinet FortiGate, and Citrix NetScaler appear repeatedly in the underlying incident data.
- Remote management interfaces: RMM tools, remote desktop gateways, and management console interfaces. The healthcare ransomware pattern this week is directly reflected in DBIR data.
- Web application frameworks: Server-side deserialization vulnerabilities (the class that produced CVE-2026-45247 in Magento this week) and insecure direct object reference patterns in custom web applications.
Recalibrating Enterprise Security Investment
If vulnerability exploitation has overtaken phishing as the primary initial access vector, security investment calibration should follow:
Patch management deserves greater investment than it receives. Most enterprise security budgets allocate more to security awareness training (phishing defence) than to automated patch management, vulnerability scanning, and remediation workflow tooling. The DBIR data suggests this ratio should shift.
Internet-facing attack surface inventory is the first-order problem. Knowing what is internet-exposed — which management interfaces, which services, which appliances — is a prerequisite for managing the vulnerability exploitation risk. Many organisations cannot answer “what does an attacker see when they scan our IP ranges?” in under an hour.
Time-to-patch for internet-facing systems is the critical metric. The DBIR exploitation data skews heavily toward vulnerabilities in internet-facing systems. Internal systems that are not reachable from the internet are materially lower exploitation risk. A vulnerability management programme that treats all CVEs equally, regardless of whether the affected system is internet-exposed, is not calibrated to the actual threat data.
Phishing defence is still necessary. The 22% figure for phishing breaches means it remains the second-most-common initial access vector. The shift is relative, not absolute — social engineering attacks have not stopped working. The recalibration is to stop treating phishing as the primary threat and recognise it as one of two equally important initial access categories.
DBIR 2026 Sector Data
Healthcare breach counts remained elevated, consistent with the sector being disproportionately targeted by ransomware. Financial services breaches were numerically lower but higher in average impact (larger data volumes, regulatory reporting consequences). Technology sector breaches reflected supply chain and credential compromise patterns. Education remained persistently over-represented relative to sector size.
The sector data reinforces the finding that ransomware with financial motivation dominates the breach landscape — 81% of analysed breaches had a financial motive, consistent with prior years.
Share this article