At A Glance
- Vulnerability exploitation overtook stolen credentials as the top breach vector for the first time in the DBIR’s 19-year history: 31% versus 13%.
- Third-party involvement in breaches jumped 60% year over year and now shows up in 48% of all breaches, right as AI infrastructure comes to depend on more third parties than ever.
- Machine identities now outnumber human identities 109 to 1, and nine in ten organizations reported at least one identity-related breach in the past year.
- The controls built to secure the perimeter, API keys, VPNs, IP allowlists, were designed to identify people, not workloads.
For 19 years, the Verizon Data Breach Investigations Report told roughly the same story about how attackers get in: they log in. Stolen credentials sat at the top of the initial access rankings for so long that “attackers don’t hack in, they log in” became the industry’s most durable cliché. The 2026 DBIR just retired it, and the report also split out “pretexting” as its own tracked category for the first time.
What the 2026 DBIR Found About Vulnerability Exploitation vs. Stolen Credentials
Exploiting vulnerabilities accounted for 31% of breaches in this year’s DBIR, ahead of credential abuse at 13% (note: the new “pretexting” category pulled incidents out that would have previously been wrapped up in credential abuse). Add phishing (16%), and identity-related initial access totals roughly 32%, statistically even with vulnerability exploitation.
Identity hasn’t stopped mattering; the attack surface itself just got bigger and less directly controlled by any one organization. The report found that third-party involvement in breaches jumped 60%, now appearing in 48% of all breaches, a change driven by the growing web of vendors, SaaS platforms, and external services every enterprise depends on. That trend lands squarely on AI infrastructure: hosted LLM APIs, third-party MCP servers, and SaaS-based agent tooling all extend an organization’s attack surface to systems it doesn’t operate and can’t patch directly.
Why Machine Identities Now Outnumber Human Identities 109 to 1
The 2026 DBIR found unapproved “shadow AI” use tripled in a year, from 15% to 45% of employees, with AI bot traffic growing 21% month over month. Organizations now manage an average of 109 machine identities for every human identity, and expect their AI agent populations to grow another 85% over the next twelve months.
The same research found that roughly nine in ten organizations had at least one identity-related breach in the past year, a sign that identity governance was already straining before AI agents entered the picture at scale. That’s non-human identity, the credential and access model assigned to something that isn’t a person, expanding faster than the tools built to govern it, layered on top of machine workloads generating continuous, autonomous connections that the network wasn’t to see.
Why API Keys and VPNs Fail to Secure AI Workloads
Every control most networks rely on today (API keys, VPN access, IP allowlists) was built for a person sitting at a keyboard: someone logs in, their device carries the credential, and the network decides what they can reach.
An AI agent breaks that model at every point. It initiates its own connections, holds sessions open for hours, fans out across dozens of tools in a single task, and scales from one instance to a hundred without anyone filing a change ticket. An MCP server sitting between an agent and a system of record holds real credentials that no person ever types. None of the controls built for the human-user era were designed to answer the question that actually matters now: not “where is this connection coming from,” but “which workload is this, and what has it actually been authorized to do.”
Can Zero Trust Prevent Prompt Injection?
Here’s the part the DBIR can’t fully measure yet, and it’s the reason this problem doesn’t resolve itself once patching catches up. An attacker doesn’t need to breach your network if they can convince an agent already inside it to act on their behalf. A poisoned document, a malicious result in a retrieval pipeline, or a crafted tool response can steer an agent that already holds legitimate credentials and legitimate connectivity. No perimeter control detects this, because no perimeter is ever crossed. Firewall rules and IAM policies both fail here in the same way: they verify that a connection is permitted, not that the thing using it is behaving the way it’s supposed to. That’s a harder problem than patching, and it’s the one platform teams are the least prepared to answer today.
How to Close the AI Reachability Gap
The DBIR’s finding isn’t really about vulnerabilities or credentials. It’s about what’s reachable in the first place, and how much of your environment now sits outside the model built to govern it. That question gets harder every quarter AI adoption accelerates.
We put together a full guide for the people who own this problem day to day. The Platform Engineer’s Guide to AI Network Architecture walks through:
- The three AI traffic patterns most networks were never built to see, and where each one breaks down
- Why API keys, VPNs, and IP-based rules fail specifically for machine workloads, not just in theory
- A six-principle Zero Trust framework built for AI infrastructure, including how to design for an agent you have to assume will eventually be compromised
- A reference architecture and a five-point checklist for evaluating any platform against it
- A rollout roadmap that doesn’t start with mapping your entire environment first
Get the guide, or talk to us about the connection that worries you most.
Frequently Asked Questions
What is identity-first reachability?
Identity-first reachability is a security model in which a service or workload is not visible on the network at all until a connecting party proves its identity and passes policy. At NetFoundry, we deliver this through Identity-First Reachability™, which closes inbound ports entirely and authenticates every session before any connection forms.
What did the 2026 Verizon DBIR find about breach vectors?
The 2026 DBIR found that exploiting software vulnerabilities overtook stolen credentials as the leading way attackers get into networks, the first time that’s happened in the report’s 19-year history, accounting for 31% of breaches versus 13% for credential abuse.
How did third-party involvement in breaches change in the 2026 DBIR?
Third-party involvement in breaches jumped 60% year over year and now appears in 48% of all breaches, according to the 2026 DBIR. That trend is especially relevant to AI infrastructure, where hosted LLM APIs and third-party MCP servers extend an organization’s attack surface into systems it doesn’t directly control.
Can Zero Trust prevent prompt injection?
Not at the model layer. Prompt injection happens inside a conversation an agent is already authorized to have, so no network or identity control can stop the manipulation itself. What Zero Trust principles can do is limit what a manipulated agent is able to reach, which determines how much damage a successful injection can actually cause.
What is non-human identity, and why does it matter for AI security?
Non-human identity is a distinct, verifiable identity assigned to an AI agent, API, or service, separate from any person who deployed it. It matters because most identity and access systems were built to authenticate people, and organizations now manage far more machine identities than human ones, a gap that’s widening as AI agent adoption grows.
How many machine identities does the average enterprise manage today?
Recent research puts the ratio at 109 machine identities for every human identity, with AI agent populations specifically projected to grow another 85% over the next year.
