DBIR Finds Unpatched Vulnerabilities Overtake Stolen Credentials in Breaches

Exploitation of software vulnerabilities has become the most common entry point for data breaches, surpassing stolen credentials for the first time, according to a major annual security report. The findings highlight a widening gap between the speed of attacks and the ability of organizations to defend themselves.

The 2026 Data Breach Investigations Report (DBIR), which analyzed more than 31,000 security incidents, found that 31% of confirmed data breaches began with attackers exploiting unpatched vulnerabilities. This represents a significant increase from the previous year. Concurrently, organizations are taking longer to fix critical flaws. The median time to fully patch a vulnerability grew to 43 days, an increase of 11 days from the prior year.

The report links these trends to the growing use of artificial intelligence by threat actors. Researchers state that AI is being used to accelerate the discovery and weaponization of known security weaknesses, shrinking the defensive window from months to mere hours. The median threat actor was found to have researched or used AI assistance in 15 different attack techniques.

Organizations are struggling to keep pace with the volume of...