Exploited software flaws now open more breaches than stolen credentials do

A leading vector at 31% is a weaker statement than the ranking makes it sound. Verizon's 2026 Data Breach Investigations Report puts exploitation of software vulnerabilities at 31% of breaches, ahead of stolen credentials ^[1], which leaves roughly 69% of breaches starting some other way ^[1] and places credentials somewhere below 31% themselves ^[2]. The order of the top two has changed while the spread across routes has not, and that matters for anyone tempted to move an identity budget into vulnerability management on the strength of one table.

The board-deck version of readiness is a list of acquisitions: cyber insurance, an incident response retainer, endpoint detection, backups, and a few more products each year ^[4]. It is incomplete because acquisition and operation are funded on different clocks. Approval for a tool clears once; the rota that watches it at 3am and the drill that proves a restore is fast enough recur annually, and the half-finished capabilities Ryan Ikeler of MOXFIVE describes are all cases where the second clock was never wound ^[5].

MOXFIVE is paid by organizations already inside an incident ^[2], so a claim that executives overestimate their visibility, their response speed and the durability of their controls ^[3] doubles as a pitch. But the claim is cheap to falsify in-house: a restore drill has a stopwatch, and a round-the-clock monitoring rota has a name against every hour. A firm that runs both and finds its dashboard was accurate has spent an afternoon.

The detection argument is the part that should change how a quarterly review reads. Deloitte's 2025 Cyber Threat Trends Report describes attackers combining credential theft, social engineering, AI-assisted phishing and exploitation of existing vulnerabilities so that malicious activity is hard to separate from normal enterprise operations ^[8]. Ikeler adds that obfuscation, living-off-the-land technique and slow movement mean many intrusions never announce themselves with a ransom note or a black screen, and that the ones caught early are caught by teams actively looking ^[9]. If dwell time has always set how bad an incident becomes ^[10], the line item that governs severity is hunting capacity rather than alert volume, and attacker-side AI compresses the time available without altering the mechanism ^[11].

On Ikeler's account, investigations rarely trace to a single failure and usually trace to a chain of forgivable ones: a deferred patch, a credential that outlived its purpose, an unverified segmentation boundary, a gap in monitoring ^[7]. That points away from any single emergency purchase and toward upkeep of what is already in place. Chains break at their cheapest link, which is why his own prescription favours tools that have performed in real incidents over what shows well in a demo ^[12], and why he treats maturity as how effectively tools are deployed rather than how many exist ^[6]. The choice this quarter sets up for next year is whose budget absorbs the running cost of what is already owned, because if that lands nowhere, the 31% will still be accurate and the coverage report will still read green.