Errors, social engineering, phishing, and misuse remained the dominant factor in confirmed breaches across 139 countries.

Credential abuse was the single most common initial access vector in the 2025 DBIR, ahead of phishing and vulnerability exploitation.

Within basic web application breaches, the overwhelming majority were carried out with stolen credentials rather than exploits.

Third-party involvement in confirmed breaches doubled year over year from 15% to 30%, underscoring supply-chain risk.

Phishing remained a leading initial-access technique, and researchers found click rates were largely unaffected by awareness training.

More than 97% of identity attacks observed by Microsoft target passwords; identity-based attacks surged 32% in the first half of 2025.

Microsoft reports phishing-resistant MFA stops over 99% of identity attacks, even when the adversary already holds valid credentials.

Over 15 billion user accounts are equipped to sign in with a passkey, roughly doubling availability year over year.

FIDO consumer research shows three-quarters of consumers recognize passkeys, with roughly 69% having enabled at least one.

FIDO's Passkey Index found passkeys deliver a roughly 30% conversion lift and a 93% sign-in success rate.

Announced on World Passkey Day 2026, a marker that passkeys have crossed into the mainstream.

Up sharply from roughly 75% a year earlier, per FIDO's State of Passkeys 2026 research across ten countries.

Workforce passwordless is moving from pilot to rollout, though account recovery and legacy systems remain the hard part.

A single-retailer datapoint on consumer-scale adoption, with passkey sign-in reported about six times faster than passwords.

Ransomware was present in 44% of breaches, up sharply from 32% the prior year, often entering via stolen credentials.

Industry analysis attributes roughly 1.8 billion stolen credentials in early 2025 to infostealer malware, a steep surge.

Roughly a third of malware-sourced credentials included active session cookies, letting attackers hijack sessions and bypass MFA.

GitGuardian detected 23.8 million new hardcoded secrets in public GitHub commits in 2024, a 25% year-over-year increase.

GitGuardian found 70% of secrets leaked in 2022 remained active, dramatically extending the exposure window for attackers.

CyberArk reports machine (non-human) identities now outnumber humans by more than 80 to 1, driven by cloud and AI adoption.

CyberArk found 68% of organizations have no identity security controls for AI, even as AI creates the most new privileged identities.

IBM's global average breach cost fell about 9% to $4.44M, driven mainly by faster identification and containment.

Organizations averaged 158 days to identify and 83 days to contain a breach, the lowest combined figure in nine years.