Overview
- Verizon’s 2026 Data Breach Investigations Report, released Tuesday, says 31% of breaches began with exploited software vulnerabilities, overtaking stolen credentials for the first time in 19 years.
- The report finds attackers using generative AI to speed every stage of intrusions, from picking targets to building malware, which lets them turn known bugs into working exploits in hours.
- Organizations are falling behind on fixes, with median full patching time rising to 43 days in 2025 and only 26% of issues in CISA’s Known Exploited Vulnerabilities catalog patched last year.
- Breaches involving vendors or other outside providers rose about 60% to 48% of cases, which expands supply‑chain risk for companies that rely on third‑party software and services.
- Unapproved use of AI tools at work jumped to 45% of employees, making “shadow AI” a leading non‑malicious source of data loss as staff paste source code, images, and other sensitive files into public models.