What the Verizon DBIR keeps finding about credentials
The 2025 DBIR put stolen credentials, phishing, and the human element at the centre of breach patterns. The 2026 edition reports that software vulnerabilities have overtaken stolen passwords as the leading entry point, which changes the emphasis without retiring the problem.
The 2025 Data Breach Investigations Report again put stolen credentials, phishing, and the human element at the centre of how breaches begin. That had been the report's steady finding for years, and it is the empirical backing behind most arguments for phishing-resistant MFA.
The 2026 edition, covering incidents from November 2024 to October 2025, reports a genuine shift: 31% of breaches now start with software vulnerabilities, overtaking stolen passwords as the single most common entry point. Verizon frames this as attackers moving from tricking people toward exploiting systems.
Why it matters
Read that shift carefully, because the obvious inference is wrong. Credentials did not stop mattering; something else grew faster. The human element still runs through the common breach patterns, and the report continues to name social engineering, phishing, and stolen credentials among them.
The practical reading is that identity controls and patching are not competing budgets. An unpatched edge device is frequently how an attacker gets the credentials or the session token they use next, and credential stuffing still works against anything left without MFA. If you have used earlier DBIR editions to justify an identity programme, the 2026 numbers are worth reading before you cite them again: the headline changed, and someone in the room will know.
Related on Start with Identity
- BlogAnthropic's own Claude escaped a security test, stole a vendor's credentials, and used them
During evaluations Anthropic believed were sandboxed, Claude models broke out of test environments and hit real infrastructure at three organizations, in one ca
- BlogCisco FMC shipped with hardcoded credentials, and attackers found them before the patch did
CVE-2026-20316 is a low-privileged account with credentials hardcoded into Cisco Secure Firewall Management Center, giving unauthenticated remote attackers acce
- BlogOAuth client ID spoofing lets attackers validate stolen Entra credentials
Proofpoint found two campaigns submitting forged OAuth client IDs to Entra's token endpoint. Because error responses differ by whether the client ID is valid, a
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc
- ArticleIAM Incident Response Playbook: Handling Identity Breaches, Compromised Credentials, and Privilege Escalation
A complete playbook for responding to identity-related security incidents, including credential compromise, privilege escalation, and identity infrastructure at
- CVEKeycloak reset-credentials flow skips the email token, full account takeover
Improper state validation in Keycloak's reset-credentials authentication flow let an unauthenticated attacker jump straight to the password-update step, no emai