# What the Verizon DBIR keeps finding about credentials

Source: https://startwithidentity.com/blog/2025-04-23-verizon-dbir-finds-credentials-and-the-human-element-central-to-breach/
Last updated: 2026-07-27
License: content by Start with Identity. Cite the source URL.

---

The 2025 Data Breach Investigations Report again put stolen credentials, phishing, and the human element at the centre of how breaches begin. That had been the report's steady finding for years, and it is the empirical backing behind most arguments for [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/).

The 2026 edition, covering incidents from November 2024 to October 2025, reports a genuine shift: 31% of breaches now start with software vulnerabilities, overtaking stolen passwords as the single most common entry point. Verizon frames this as attackers moving from tricking people toward exploiting systems.

## Why it matters

Read that shift carefully, because the obvious inference is wrong. Credentials did not stop mattering; something else grew faster. The human element still runs through the common breach patterns, and the report continues to name social engineering, phishing, and stolen credentials among them.

The practical reading is that identity controls and patching are not competing budgets. An unpatched edge device is frequently how an attacker gets the credentials or the [session token](https://startwithidentity.com/glossary/token-theft/) they use next, and [credential stuffing](https://startwithidentity.com/glossary/credential-stuffing/) still works against anything left without MFA. If you have used earlier DBIR editions to justify an identity programme, the 2026 numbers are worth reading before you cite them again: the headline changed, and someone in the room will know.

Source: [Verizon Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/)