Every spring, security teams wait for Verizon's Data Breach Investigations Report, better known as the DBIR. It's one of the largest annual studies of how breaches actually happen. This year's edition, released May 19, analyzed more than 31,000 security incidents and 22,000 confirmed breaches.
The headline finding should get the attention of any IT director in a school district, city hall or county office: exploiting vulnerabilities is now the most common way attackers break in, accounting for 31 percent of breaches. Credential abuse, which held the top spot for years, fell to 13 percent. Phishing came in at 16 percent.
Put simply, more attackers are getting in through software that should have been patched.
Patching is losing ground
If attackers are leaning harder on vulnerabilities, you'd hope defenders were patching faster. The DBIR found the opposite.
The report looked at vulnerabilities on CISA's Known Exploited Vulnerabilities (KEV) list. These aren't theoretical flaws. They are ones attackers are already using. Only 26 percent of them were fully fixed, down from 38 percent the year before. The median time to fully remediate rose from 32 days to 43.
The report's authors described the situation as "a treadmill picking up speed." As SC Media reported, the number of vulnerability instances organizations are dealing with has grown enormously over the past few years. Teams are being asked to patch more systems, more often, with the same number of people.
"That gap is not just a patching problem," Jon Baker of AttackIQ told SC Media. "It's a visibility and prioritization problem."
Ransomware is still the payoff
Ransomware showed up in 48 percent of breaches, up from 44 percent. There was one encouraging number: 69 percent of victims refused to pay, up from 65 percent. That trend reflects better backups and more organizations deciding that paying doesn't guarantee anything.
The Center for Internet Security, which runs the MS-ISAC for state and local governments, contributed data to this year's report. "Exploitation of vulnerabilities continues to outpace defenders' ability to remediate them," said TJ Sayers, the MS-ISAC's senior director of threat intelligence.
Two more findings worth a second look
Remote management tools are being abused. The DBIR found a 240 percent jump in attackers misusing remote monitoring and management (RMM) software during intrusions. These are the tools IT teams and managed service providers use to support computers remotely. If someone steals access to them, they get the same reach as your IT staff. If you use an outside IT provider, and we're one, it's fair to ask how they secure their remote tools. You should expect MFA, tight access controls and logging at minimum.
Shadow AI is now a real leak path. Employees putting data into unapproved AI tools is now the third most common way non-malicious insiders leak data, at 12 percent. That's about four times last year's share. As AI features show up in more of the tools staff already use, expect this number to keep climbing.
What public agencies should do with this
The DBIR is a global study, and the public sector has its own pressures: tight budgets, older systems and small teams. But the fixes it points to work for agencies of any size.
Know what you have. You can't patch what you don't know exists. Keep an up-to-date inventory of every server, workstation, network device and internet-facing application. Forgotten systems are where attackers find the easy wins.
Patch by risk, not by calendar. Start with anything on CISA's KEV list and anything exposed to the internet, such as VPNs, firewalls, remote access portals and web servers. Those get fixed in days, not weeks. Everything else can follow your normal cycle.
Retire what can't be patched. Old operating systems, unsupported firmware and end-of-life network gear add risk every month they stay online. If you have Windows 10 machines on Extended Security Updates, make sure they're actually enrolled and receiving patches, and have a replacement plan for when that coverage ends.
Shrink what's exposed. Every service reachable from the internet is a potential door. Review what's exposed, close what isn't needed and put the rest behind MFA.
Protect your backups. With ransomware in nearly half of breaches, at least one copy of critical data should be offline or immutable, and you should test restoring it.
Write an AI policy. Even a short one that names approved tools and spells out what data can't go into them is better than nothing.
The bottom line
Attackers are taking the path of least resistance, and right now that's unpatched software. The good news is that fixing it doesn't require exotic tools. It takes a good inventory, clear priorities and the discipline to close known holes quickly.
vTECH io helps Florida school districts, cities and counties with vulnerability management, patching, endpoint protection and hardware refreshes. As a Dell Technologies Platinum Partner, we can also help you replace aging systems that can no longer be secured. If you'd like help getting ahead of the patching treadmill, call us at 888-277-5918.
Sources
- Verizon DBIR 2026: vulnerability exploits top initial access as patching coverage falls, SC Media, May 20, 2026
- CIS Controls and MS-ISAC insights featured in Verizon's 2026 Data Breach Investigations Report, Center for Internet Security, May 19, 2026