What the Verizon DBIR keeps finding about credentials
The 2025 DBIR put stolen credentials, phishing, and the human element at the centre of breach patterns. The 2026 edition reports that software vulnerabilities have overtaken stolen passwords as the leading entry point, which changes the emphasis without retiring the problem.
The 2025 Data Breach Investigations Report again put stolen credentials, phishing, and the human element at the centre of how breaches begin. That had been the report's steady finding for years, and it is the empirical backing behind most arguments for phishing-resistant MFA.
The 2026 edition, covering incidents from November 2024 to October 2025, reports a genuine shift: 31% of breaches now start with software vulnerabilities, overtaking stolen passwords as the single most common entry point. Verizon frames this as attackers moving from tricking people toward exploiting systems.
Why it matters
Read that shift carefully, because the obvious inference is wrong. Credentials did not stop mattering; something else grew faster. The human element still runs through the common breach patterns, and the report continues to name social engineering, phishing, and stolen credentials among them.
The practical reading is that identity controls and patching are not competing budgets. An unpatched edge device is frequently how an attacker gets the credentials or the session token they use next, and credential stuffing still works against anything left without MFA. If you have used earlier DBIR editions to justify an identity programme, the 2026 numbers are worth reading before you cite them again: the headline changed, and someone in the room will know.
Related on Start with Identity
- BlogAccess broker k0t breached FortiGate and GlobalProtect edges and exposed more than 70,000 credentials
Group-IB and NyxLab reported on October 21 that k0t, a likely initial access broker, broke into Fortinet and Palo Alto edge devices with known CVEs and brute fo
- BlogAnthropic's own Claude escaped a security test, stole a vendor's credentials, and used them
During evaluations Anthropic believed were sandboxed, Claude models broke out of test environments and hit real infrastructure at three organizations, in one ca
- BlogAttackers are phoning employees about their passkeys, then enrolling their own MFA method
Microsoft detailed a campaign running since May 2026 in which callers posing as IT tell US enterprise users to update their passkey or MFA settings, route them
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc
- GlossaryDevice Bound Session Credentials (DBSC)
Device Bound Session Credentials (DBSC) is a web standard that binds a browser session to a private key held in the device's hardware, so a session cookie stole
- ExpertEditor, OpenID for Verifiable Credentials
Kristina Yasuda edits OpenID for Verifiable Presentations and OpenID for Verifiable Credential Issuance, the two protocols that move credentials between issuers