Exploitation Overtook Stolen Credentials. Now What?
Verizon’s 2026 Data Breach Investigations Report, released on May 19, contains a headline that would have seemed unlikely a few years ago. Exploitation of vulnerabilities accounted for 31% of initial access in the breaches studied, overtaking credential abuse for the first time in the report’s history. In last year’s edition, exploitation stood at 20% and credential abuse at 22%. This year, credential abuse fell to 13%.
Figure 1. Initial access vectors, 2025 and 2026 DBIR. Source: Verizon Data Breach Investigations Report, 2025 and 2026 editions, as reported by Verizon.
The 2026 report covers incidents from November 2024 through October 2025, the period that included the SharePoint ToolShell campaign, repeated edge device exploitation and the React2Shell framework flaw. Readers of this publication won’t be surprised by the direction. The size of the shift is still notable.
Two forces behind the shift
Credential defenses are working
The fall in credential abuse is partly good news. Phishing-resistant authentication, conditional access and better detection of password spraying have made stolen passwords less useful. Attackers haven’t stopped using credentials, but they increasingly need to steal sessions or tokens, or social-engineer their way past MFA, rather than simply log in. When one door gets harder, attackers try another.
Exploitation got faster and cheaper
The report highlights AI as an accelerant, particularly in finding and exploiting software flaws. That matches what threat intelligence teams have described over the past year: tooling that helps attackers analyze patches, write working exploits and scan for vulnerable systems at scale. The window between disclosure and exploitation, already short for edge devices, has continued to shrink.
The report also notes that organizations patched more and remediated faster in 2025 than in prior years, and still fell behind. That’s the key point. Patching improved; attackers improved faster.
Why “patch faster” isn’t enough on its own
Patching remains essential. But a program that relies on patching to stay ahead runs into three hard limits:
- Some exploitation happens before a patch exists. Several of the year’s most damaging campaigns began as zero-days.
- Patches can be bypassed. ToolShell showed attackers turning a fix into a roadmap for a variant within days.
- Some systems can’t be patched quickly. Appliances, operational technology and critical line-of-business systems often need change windows measured in weeks.
So alongside “how fast can we patch?”, programs in 2026 need to ask how much exposure they carry while they wait, and how to reduce it.
Where exposure management should focus
Reduce what’s reachable
The most effective exploitation defense is an attack surface that doesn’t include the vulnerable service. For every internet-facing system, the questions are whether it needs to be reachable at all, and if so, by whom. Management interfaces, file transfer services and remote access tools are the usual candidates for restriction.
Prioritize by exploitation, exposure and asset importance
CVSS scores remain a poor guide on their own. Prioritize findings using evidence of exploitation (KEV listings, vendor statements, exploit prediction scores), whether the system is internet-facing, and how important the asset is. A medium-severity flaw on an exposed gateway under active exploitation outranks a critical flaw on an isolated internal system.
Have mitigations ready for when patches aren’t
For each class of critical system, decide in advance what you’d do if a serious flaw appeared and no patch was available, or patching had to wait: restrict access, disable a feature, add a virtual patch at a web application firewall, or take the service offline. Agreeing those options with system owners before an incident saves the hours that matter most.
Assume some exploitation will succeed
Detection and containment around exposed systems matter more as exploitation becomes the main way in. Monitor internet-facing systems for post-exploitation behavior: new files in web directories, unexpected child processes, outbound connections, configuration changes. Make sure their logs are stored somewhere an attacker can’t alter.
Measures for the year ahead
| Measure | What it tells you |
|---|---|
| Count of internet-reachable services, by type, trending over time | Whether the attack surface is shrinking |
| Time from exploitation evidence to mitigation, for internet-facing systems | Whether response matches attacker timelines |
| Share of internet-facing systems with off-box logging and post-exploitation detection | Whether a successful exploit would be noticed |
| Count of critical systems without a documented fallback mitigation | Where you’re relying entirely on patching |
Credential abuse hasn’t gone away
The drop to 13% shouldn’t encourage anyone to ease off identity security. The gains came from sustained investment in phishing-resistant authentication and detection, and attackers will return to credentials wherever those defenses lapse. The help desk and integration token attacks of 2025 show how readily they adapt.
Defenses work, and attackers respond by moving to the next door. Programs need to keep the credential door shut while they reinforce the exploitation one.