Credentials did not stop mattering. The DBIR headline was read wrong
Vulnerability exploitation took the top initial access spot in the 2026 DBIR at 31%, and the coverage moved on. The same report puts credential abuse somewhere in the attack chain in 39% of breaches, and finds 73% of ransomware victims had an infostealer or credential leak in the preceding year.
By Parminder Kumar Sharma · · 6 min read
The headline, and the sentence underneath it
The 2026 Verizon Data Breach Investigations Report gave the security press an easy story: vulnerability exploitation is now the leading initial access vector, at 31% of breaches and up 55% year on year. Credential abuse, top of that table for as long as anyone has been reading the DBIR, was pushed off it.
That is true, and it is close to useless on its own. Initial access is one step. The DBIR also counts credential abuse wherever it appears in the attack progression, and on that measure it is in 39% of all breaches, more than any other vector.
The infostealer-to-ransomware pipeline, with a clock on it
The most operationally useful finding in the report is not a ranking. It is a timing.
What the DBIR data says about the run-up to a ransomware incident
Day −95 or later
Credentials appear in a stealer log
For half of affected victims, the leak lands inside this window. Usually harvested from a device the organisation does not manage.
Between
The access is packaged and sold
Initial access brokers price non-privileged access at roughly $700 and administrative access at roughly $1,300, per SpyCloud. VPN credentials make up 44% of listings.
Day 0
Ransomware
The operator authenticates. Nothing about this step looks like an intrusion, because it is not one.
Ninety-five days is the number worth carrying out of this. It is not a warning shot measured in hours. For half of these organisations there were three months in which the credential was already for sale, and the reason nobody acted is that the telemetry never existed on their side. The theft happened on a personal laptop with a synced browser profile, a contractor's machine, a developer's home desktop.
What the 2026 DBIR actually reports
| Finding | Figure | Source |
|---|---|---|
| Vulnerability exploitation as initial access | 31% of breaches, up 55% year on year | Verizon DBIR 2026 |
| Credential abuse anywhere in the attack chain | 39% of breaches, more than any other vector | Verizon DBIR 2026 |
| Ransomware victims with an infostealer or credential leak in the prior year | 73% | Verizon DBIR 2026 |
| Of those, leaks occurring within 95 days of the attack | 50% | Verizon DBIR 2026 |
| Initial access broker price, non-privileged | around $700 | SpyCloud |
| Initial access broker price, administrative | around $1,300 | SpyCloud |
| VPN credentials as a share of broker listings | 44% | SpyCloud |
Thirteen hundred dollars for administrative access. Set that against the $1.7m mean recovery cost in Sophos's 2026 ransomware figures and the economics of the whole ecosystem are on one line.
From credential to encryption, and who sees each step
- Not your deviceCredential stolen from a device
- Days to monthsSold on, sometimes in bulk
- Looks like the userValid login, no alert
- WeeksAccess broadened quietly
- The part you seeEncryption
Where the time goes, and where the alerting is
Why your controls did not see it
Where the security programme is looking
- Managed endpoints with EDR deployed.
- The corporate network edge and VPN concentrator.
- Authentication events on corporate identity providers.
- Vulnerability scanning and patch cadence, genuinely important, and now the top initial access vector.
Where the credential was actually taken
- A personal device with the corporate password saved in a synced browser profile.
- A contractor machine that never appeared in any asset register.
- A developer home desktop with a session cookie that outlives the password reset.
- A stealer log aggregated and resold months before anyone authenticates.
The uncomfortable part is that a password reset does not close this. Session cookies harvested alongside the password survive the reset unless sessions are explicitly revoked, which is why rotate the credential is an incomplete response to a stealer log.
The device you do not manage
The uncomfortable part of this pattern is where the theft happens, because it is usually somewhere your controls do not reach.
A contractor's laptop. A personal machine used to check webmail. A home device a family member also uses. The credential is stolen there, and everything that follows happens against your systems using a login that is entirely valid. Your endpoint protection was never on the device that mattered, and your identity provider sees a correct password and a correct second factor if the attacker has the session cookie.
That is why the useful controls here are not detection controls. They are assumptions. Assume a valid credential can be somebody else's. Which means session lifetime matters more than password strength, device trust matters more than location, and re-authentication before a consequential action is worth more than another alert on a login that looks correct.
The organisations that catch this early are not the ones watching harder. They are the ones who made a stolen credential less useful before it was stolen.
One practical consequence for suppliers. If a credential belonging to your organisation is stolen from a device you do not manage, the first party to learn about it is usually neither you nor the device owner. It is whoever bought it. Credential monitoring services exist for exactly this gap, and they are one of the few controls that operates during the long quiet stage rather than at the end of it.
What to check this week
Take this with you
Closing the 95-day window
- Subscribe to stealer-log monitoring for your own domains. This is the single control that turns an invisible three-month window into an alert, and it is cheap relative to what it prevents.
- Revoke sessions, not just passwords, when credentials are exposed. A stolen cookie outlives a reset unless you explicitly kill it.
- Shorten session lifetimes for privileged and remote access, so a cookie expires before it can be packaged and sold.
- Make browser profile sync from unmanaged devices a policy decision rather than a default. That sync is the collection mechanism.
- Cover contractors and personal devices in the identity controls even where you cannot manage the endpoint: phishing-resistant MFA, device binding, conditional access.
- Alert on new-device and impossible-travel authentication for the accounts that matter, since the attacker arrives authenticated and looks legitimate.
- Keep patching. Vulnerability exploitation is genuinely the top initial access vector now, at 31%: this is an and, not an instead.
Sources
- PrimaryData Breach Investigations ReportVerizon Businessaccessed 2026-08-10
