One year, a different threat picture
Last year's report put stolen credentials first, at 22% of breaches. This year, credential abuse dropped to 13%, and vulnerability exploitation jumped from 20% to 31%. Third-party involvement rose from 30% to 48%, so nearly half of all breaches now involve a vendor, partner or supplier.
| Item | DBIR 2025 | DBIR 2026 |
|---|---|---|
| Vulnerability exploitation | 20% | 31% |
| Stolen credentials | 22% | 13% |
| Third-party involvement | 30% | 48% |
| Ransomware present | 44% | 48% |
Patching is falling behind
Only 26% of critical vulnerabilities on CISA's Known Exploited list were fully fixed during 2025. The median time to fix one grew from 32 days to 43. Attackers usually move within days of a public exploit, so a 43-day window is a long time to stay exposed.
| Item | Value |
|---|---|
| Previous report | 32 days |
| DBIR 2026 | 43 days |
Small businesses carry the ransomware burden
In the 2025 report, ransomware showed up in 88% of breaches at small and mid-sized businesses, compared with 39% at larger organisations. The 2026 report found the same pattern: small and mid-sized businesses make up the large majority of ransomware victims whose size is known.
| Item | Value |
|---|---|
| Small and mid-sized | 88% |
| Large organisations | 39% |
What I recommend
- Patch internet-facing systems first: VPNs, firewalls, routers, CMS and plugins.
- Set a target: critical fixes within 7 days, and track it like a sales number.
- List every vendor with access to your systems or data, and review it every quarter.
- Keep offline, tested backups. They are what makes refusing a ransom possible.
- Require company accounts and single sign-on for any AI tool used at work.
Frequently asked questions
What are the key findings of the Verizon DBIR 2026?
Vulnerability exploitation became the top initial access vector at 31% of breaches. Third-party involvement rose to 48%, ransomware was present in 48% of breaches, and 62% involved a human element.
How fast are companies patching known exploited vulnerabilities?
Only 26% of critical vulnerabilities on CISA's Known Exploited Vulnerabilities list were fully remediated in 2025, and the median time to fix rose from 32 to 43 days.
Are small businesses targeted by ransomware?
Yes. In the 2025 DBIR, ransomware was involved in 88% of breaches at small and mid-sized businesses, compared with 39% at large organisations.
