At an external pentest in early 2025, I received an shell on the corporate network through a VPN gateway with a CVE from the CISA KEV catalog. From the first scan to access, three hours. No phishing, no leaked passwords. Unpatughed edge-device at the perimeter, standard Nuclei-fine template, working exploit. When the Verizon DBIR 2026 was released in May 2026, the figures confirmed that I saw with my hands: 31% of all data breaches begin with the operation of vulnerabilities - for the first time in 19 years of the report's existence, this vector overtook the theft of accounting data. For a penester, this is not an abstract statistic, but a signal to revise the methodology, the priorities of the slaughterhouse and the instrument stack.
Accounting Theft vs Vulnerabilities: DBIR 2026 statistics
Verizon DBIR 2026 is based on the analysis of more than 22 000 confirmed leaks from 145 countries (the total number of incidents is over 31 000). The original access picture is unambiguous: exploiting vulnerabilities (Exploit Public-Facting Application, T1190 by MITRE ATT&CK. Initial Access tactics) is responsible for 31% of data-disromerytification incidents. A year earlier - 20%. Increase by 55% per account cycle.
In parallel with the theft of accounting data (Valid Accounts, T1078) fell from 22% to 13%. The reasons are understandable to any practice: MFA-rollout, password managers, identity-aware proxies do their job. The frontal entrance through the stolen passwords has become more difficult. The attackers did not become more ethical - they shifted to the path of least resistance.
Pretexting - synchronous social engineering, calls and correspondence with the establishment of trust - is allocated to a separate category of initial access this year. A partial decline in credentials may be due to this redistribution, but the trend towards the growth of vulnerability exploitation is steady: it has been observed for three consecutive years in a row in the DBIR dataset and is confirmed by other reports. Mandiant M-Trends 2025 called exploits the most common initial access vector in 2024 with a share of 38% - DBIR with an annual lag fixes the same dynamics.
Conclusion for the pentester is specific: if the standard engagement starts with a broodforse.Brute Force, T1110) and credential stuffing - you are testing yesterday's threat. The real attacker in 2025 more often begins with a vulnerability (T1595.002) perimeter than with Hydra on RDP.
Initial access vector 2026: edge-devices and attack surface
Verizon DBIR 2026 calls specific asset classes through which the operation: web applications, VPN gateways and remote access infrastructure (External Remote Services, T1133) The report for the first time singled out remote access devices in a separate category of "Network" - it jumped from 1.5% to 5% of all leaks. In the absolute, the figure is small, but the dynamics x3.3 for the year shows the direction of the blow.
On every second external pentest for the last year, my main findings are edge-devices. VPN gateway with a patched CVE from KEV - ready-made initial access without user interaction. The script fits into two steps of ATT&CK: Vulnerability Scanning (T1595.002) for reconnaissance, then Exploit Public-Facing Application (T1190) for penetration.
Organizations get more KEV, close a smaller percentage and spend more time on it. According to the IBM X-Force Threat Intelligence Index 2025, the average time from CVE to elimination is 29 months (across the CVE population, including low-priority; for critical KEV median is significantly shorter).
Separate nuance: 60-70% of KEV remain open on the 7th day after detection, regardless of the maturity of the organization and investments. Verizon researchers call it "the potential theoretical ceiling of the remediation process." The ceiling is not the floor. It is not possible to fix faster on the current model. And that's the window we go through every second enagement game.
Vulnerability Prioritization 2026: Recenter is More Important
One of the most useful finds of the Verizon DBIR 2026 for vulnerability management is the analysis of the possibility of re-operating. Result - decay-curve:
After 30 days without fixed operation, the probability of reuse of CVE falls about half
In 90 days - twice more
After ~9 months - twice more
After ~1 years without activity, the probability of operation is comparable to CVE, which has never been exploited
Practical conclusion: recency of exploitation is a more reliable priority signal than CVSS score or belonging to a static directory. CVE with CVSS 9.8, which no one has exploited for 14 months, is in reality less dangerous than CVE with CVSS 7.5 and recorded activity last week. watchTower describes the same approach: "recency of real-world psyche is a prior stronger signalization than the severity of assessments or static lists."“Recent cases of exploiting vulnerabilities in real-world conditions are a stronger priority-setting signal than seriousness assessments or static lists.”.
In practice, I caliber external test scan according to three criteria:
CVE from CISA KEV catalog with active operation in the last 30 days
CVE Affecting edge-devices in Schuppa (VPN, WAF, file transfer appliance)
CVE with public PoC and Nuclei-stakes
This filter narrows thousands of CVE from the scanner to dozens - and it is these dozens that give initial access on real re-engagements. Everything else is the noise for the report, not for use.
Third-party as an initial access vector: trends of cyber attacks 2026
The second digit of DBIR 2026, which the pentesters for some reason miss: the share of leaks involving a third party increased by 60% and reached 48%. Almost every second leak passes through a vendor, supplier or service provider.
According to the report, a third party is involved in leaks on three patterns:
Vulnerability in the vendar product - compromising through CVE in the software used
Vendor hosts customer data - the compromising cloud provider opens access to your data
Vendor has network access to the customer's environment - a contractor with VPN access or integration becomes the entry point
The root causes according to DBIR 2026: the absence of MFA (only 23% of third parties have completely eliminated the problem with MFA in cloud accounts), incorrect credentials rotation and impairment of least privilege for service accounts. All these are tested conditions - provided that they are in a scrap.
Here's the problem. In most standard engagement letter, these surfaces are clearly not listed. The standard perimeter of the external pentest ends where trust boundary begins with a vendor: OAuth redirect URI, API-keys of service accounts, SSO configuration, webhook endpoints without validation of signature. The attackers go through these surfaces, because there is the trust and the mess begins. When planning Action in 2026, intersectional interfaces with third parties must be clearly enabled to be clearly included in the work of work.
At the annual pentest, each KEV released after the last test never appeared. If the last external pentest was 9 months ago, it is about 12 untested CVE from the catalog, which by definition contains vulnerabilities with confirmed operation.
Disclosure is a continuous process. Exploitation is a continuous process. The only discrete event is engagement letter once a year. This model tested the threats of 2018, when credentials were the main vector and the annual cycle was permissible.
This does not mean that you need to abandon manual tests. Between them should work automated validation of the perimeter to fresh KEV.
Nuclei + KEV: practical stack for management vulnerability on pentest
Adjustments to the environment:
OS: (GNU/Linux)/macOS (Windows through WSL2)
Nuclei v3.x+ (Go-binary, without external dependencies)
curl, jq for scripting
Internet access for template updates
File targets.txtwith a list of hosts in a horseback
Minimum pypeline - updating templates and scanning of the choke on KEV-tags:
Bash:
nuclei -update-templates
nuclei -t cves/ -tags kev -l targets.txt -o kev_results.txt
grep -i "critical\|high" kev_results.txt > kev_priority.txt
For prioritization by recent - intersecting Nuclei results with EPSS (Exploit Prediction Scoring System). EPSS score > 0.1 indicates an increased likelihood of active operation (threspond 0.1-0.2 to FIST.org for prioritization patching):
Bash:
cat kev_results.txt | grep -oP 'CVE-\d{4}-\d+' | sort -u | \
while read cve; do
epss=$(curl -s "https://api.first.org/data/v1/epss?cve=$cve" | jq -r '.data[0].epss // empty')
[ -n "$epss" ] && echo "$cve EPSS:$epss"
done | awk -F'EPSS:' '$2 > 0.1'
This pypaline does not replace the manual pentest. It closes the gap between the annual tests: the perimeter of the client is checked on the CVE, which are currently being operated. The launch weekly - according to Verizon DBIR 2026, on the 7th day 60-70% of KEV is still open. Here's the window.
Attack vectors 2026: shadow AI and mobile phishing
Accounting Theft vs Vulnerabilities: DBIR 2026 statistics
Verizon DBIR 2026 is based on the analysis of more than 22 000 confirmed leaks from 145 countries (the total number of incidents is over 31 000). The original access picture is unambiguous: exploiting vulnerabilities (Exploit Public-Facting Application, T1190 by MITRE ATT&CK. Initial Access tactics) is responsible for 31% of data-disromerytification incidents. A year earlier - 20%. Increase by 55% per account cycle.
In parallel with the theft of accounting data (Valid Accounts, T1078) fell from 22% to 13%. The reasons are understandable to any practice: MFA-rollout, password managers, identity-aware proxies do their job. The frontal entrance through the stolen passwords has become more difficult. The attackers did not become more ethical - they shifted to the path of least resistance.
Pretexting - synchronous social engineering, calls and correspondence with the establishment of trust - is allocated to a separate category of initial access this year. A partial decline in credentials may be due to this redistribution, but the trend towards the growth of vulnerability exploitation is steady: it has been observed for three consecutive years in a row in the DBIR dataset and is confirmed by other reports. Mandiant M-Trends 2025 called exploits the most common initial access vector in 2024 with a share of 38% - DBIR with an annual lag fixes the same dynamics.
Conclusion for the pentester is specific: if the standard engagement starts with a broodforse.Brute Force, T1110) and credential stuffing - you are testing yesterday's threat. The real attacker in 2025 more often begins with a vulnerability (T1595.002) perimeter than with Hydra on RDP.
Initial access vector 2026: edge-devices and attack surface
Verizon DBIR 2026 calls specific asset classes through which the operation: web applications, VPN gateways and remote access infrastructure (External Remote Services, T1133) The report for the first time singled out remote access devices in a separate category of "Network" - it jumped from 1.5% to 5% of all leaks. In the absolute, the figure is small, but the dynamics x3.3 for the year shows the direction of the blow.
On every second external pentest for the last year, my main findings are edge-devices. VPN gateway with a patched CVE from KEV - ready-made initial access without user interaction. The script fits into two steps of ATT&CK: Vulnerability Scanning (T1595.002) for reconnaissance, then Exploit Public-Facing Application (T1190) for penetration.
Organizations get more KEV, close a smaller percentage and spend more time on it. According to the IBM X-Force Threat Intelligence Index 2025, the average time from CVE to elimination is 29 months (across the CVE population, including low-priority; for critical KEV median is significantly shorter).
Separate nuance: 60-70% of KEV remain open on the 7th day after detection, regardless of the maturity of the organization and investments. Verizon researchers call it "the potential theoretical ceiling of the remediation process." The ceiling is not the floor. It is not possible to fix faster on the current model. And that's the window we go through every second enagement game.
Vulnerability Prioritization 2026: Recenter is More Important
One of the most useful finds of the Verizon DBIR 2026 for vulnerability management is the analysis of the possibility of re-operating. Result - decay-curve:
After 30 days without fixed operation, the probability of reuse of CVE falls about half
In 90 days - twice more
After ~9 months - twice more
After ~1 years without activity, the probability of operation is comparable to CVE, which has never been exploited
Practical conclusion: recency of exploitation is a more reliable priority signal than CVSS score or belonging to a static directory. CVE with CVSS 9.8, which no one has exploited for 14 months, is in reality less dangerous than CVE with CVSS 7.5 and recorded activity last week. watchTower describes the same approach: "recency of real-world psyche is a prior stronger signalization than the severity of assessments or static lists."“Recent cases of exploiting vulnerabilities in real-world conditions are a stronger priority-setting signal than seriousness assessments or static lists.”.
In practice, I caliber external test scan according to three criteria:
CVE from CISA KEV catalog with active operation in the last 30 days
CVE Affecting edge-devices in Schuppa (VPN, WAF, file transfer appliance)
CVE with public PoC and Nuclei-stakes
This filter narrows thousands of CVE from the scanner to dozens - and it is these dozens that give initial access on real re-engagements. Everything else is the noise for the report, not for use.
Third-party as an initial access vector: trends of cyber attacks 2026
The second digit of DBIR 2026, which the pentesters for some reason miss: the share of leaks involving a third party increased by 60% and reached 48%. Almost every second leak passes through a vendor, supplier or service provider.
According to the report, a third party is involved in leaks on three patterns:
Vulnerability in the vendar product - compromising through CVE in the software used
Vendor hosts customer data - the compromising cloud provider opens access to your data
Vendor has network access to the customer's environment - a contractor with VPN access or integration becomes the entry point
The root causes according to DBIR 2026: the absence of MFA (only 23% of third parties have completely eliminated the problem with MFA in cloud accounts), incorrect credentials rotation and impairment of least privilege for service accounts. All these are tested conditions - provided that they are in a scrap.
Here's the problem. In most standard engagement letter, these surfaces are clearly not listed. The standard perimeter of the external pentest ends where trust boundary begins with a vendor: OAuth redirect URI, API-keys of service accounts, SSO configuration, webhook endpoints without validation of signature. The attackers go through these surfaces, because there is the trust and the mess begins. When planning Action in 2026, intersectional interfaces with third parties must be clearly enabled to be clearly included in the work of work.
At the annual pentest, each KEV released after the last test never appeared. If the last external pentest was 9 months ago, it is about 12 untested CVE from the catalog, which by definition contains vulnerabilities with confirmed operation.
Disclosure is a continuous process. Exploitation is a continuous process. The only discrete event is engagement letter once a year. This model tested the threats of 2018, when credentials were the main vector and the annual cycle was permissible.
This does not mean that you need to abandon manual tests. Between them should work automated validation of the perimeter to fresh KEV.
Nuclei + KEV: practical stack for management vulnerability on pentest
Adjustments to the environment:
OS: (GNU/Linux)/macOS (Windows through WSL2)
Nuclei v3.x+ (Go-binary, without external dependencies)
curl, jq for scripting
Internet access for template updates
File targets.txtwith a list of hosts in a horseback
Minimum pypeline - updating templates and scanning of the choke on KEV-tags:
Bash:
nuclei -update-templates
nuclei -t cves/ -tags kev -l targets.txt -o kev_results.txt
grep -i "critical\|high" kev_results.txt > kev_priority.txt
For prioritization by recent - intersecting Nuclei results with EPSS (Exploit Prediction Scoring System). EPSS score > 0.1 indicates an increased likelihood of active operation (threspond 0.1-0.2 to FIST.org for prioritization patching):
Bash:
cat kev_results.txt | grep -oP 'CVE-\d{4}-\d+' | sort -u | \
while read cve; do
epss=$(curl -s "https://api.first.org/data/v1/epss?cve=$cve" | jq -r '.data[0].epss // empty')
[ -n "$epss" ] && echo "$cve EPSS:$epss"
done | awk -F'EPSS:' '$2 > 0.1'
This pypaline does not replace the manual pentest. It closes the gap between the annual tests: the perimeter of the client is checked on the CVE, which are currently being operated. The launch weekly - according to Verizon DBIR 2026, on the 7th day 60-70% of KEV is still open. Here's the window.
Attack vectors 2026: shadow AI and mobile phishing
