What the 2026 breach data changes for defenders

The 2026 Verizon Data Breach Investigations Report analyzes more than 31,000 incidents and more than 22,000 confirmed breaches across 145 countries. Verizon reports that 31% of breaches began with vulnerability exploitation and 48% involved ransomware. In phishing simulations, the median click rate for mobile-centric vectors was 40% higher than for email (Key topics and findings, pages 10-12).

For the 793 actors in the Anthropic dataset discussed in the 2026 DBIR, page 26 (Figure 26), AI assistance was requested for a median of roughly 15 MITRE ATT&CK techniques. The dataset records requested help; it does not establish that an attack succeeded.

The dataset covers incidents from November 1, 2024 through October 31, 2025 across many organizations, so the percentages will not match your environment. Use them to check whether your program can see and act on the paths the data emphasises.

Exposure and patch operations have converged

When vulnerability exploitation leads initial access, responders need four connected records:

1. The vulnerable product or component.
2. The organization-owned asset on which it exists.
3. That asset's reachability and trust relationships.
4. Which product or component is vulnerable. Which of your assets it sits on. Whether that asset is reachable, and what it trusts. Who can change or isolate it.

A weekly scanner export does not guarantee that connection. Products are renamed, cloud resources are short-lived, DNS points to third parties, and duplicate findings split ownership. What you need instead is an asset record that stays current and names someone who can fix it.

Do not overcorrect away from identity

Vulnerability exploitation leads, but it does not stand alone. The DBIR still finds stolen credentials, social engineering and the human element among common breach causes. Mobile phishing adds another delivery surface, and session tokens and SaaS identities can bypass controls that protect only passwords.

The balanced response is to connect patch operations and identity operations. An exposed appliance with an active exploit path deserves urgent attention. So does a privileged account without phishing-resistant authentication, a stale integration token, or a help-desk process that can be socially engineered. Attack paths often combine them.

Ransomware percentage is a resilience test

Verizon's reported 48% ransomware involvement should drive questions beyond endpoint prevention. Can the organization contain a compromised identity? Are backups isolated and restore-tested? Can responders identify the affected business service? Are administrative paths segmented? Does the team know what must be rebuilt first?

Ransomware is both an intrusion problem and a continuity problem. Measure recovery dependencies and restoration times alongside alert counts.

AI changes speed before it changes fundamentals

Attackers are using generative AI to work faster, not to replace themselves with autonomous systems. It cuts the time spent researching targets, writing lures and reworking commodity code. You get less warning, and more variation, from attackers spending less.

The fundamentals have not moved: inventory, patching, authentication, and rehearsed response, among others. AI just shortens the time you have to get them connected.

Five actions for the next 90 days

1. Reconcile internet exposure weekly. Tie each domain to its address and owner. Keep certificate, cloud-service, and supported-version evidence on that record.
2. Put known exploitation ahead of generic severity. Use the CISA KEV catalog as a priority input, then add reachability, local evidence, business impact, and compensating controls.
3. Test identity recovery alongside MFA enrollment. Exercise session revocation and privileged-account recovery, including help-desk verification, service-account ownership, and emergency access.
4. Run one restoration exercise end to end. Choose a critical service, restore it from protected backups, validate dependencies, and record the actual recovery time.
5. Map AI use as part of the attack surface. Record each approved tool with its data and agent permissions. Add the model provider, dependencies, retention terms, and human approval points.

How KernelHawk applies the lesson

KernelHawk connects affected assets, current exploitation evidence, business impact, and remediation ownership so teams can decide what to fix first.

KernelHawk Baseline turns that evidence into a scoped baseline and a 1-10 posture view. The score carries its date and covers only what you authorised us to assess — it expires as your environment changes.