--- title: Vulnerability exploitation rising as the root cause of... description: Attackers are increasingly breaking into corporate systems by exploiting vulnerabilities rather than phishing. LevelBlue's Q3 findings show vulnerability... canonical: https://daily.dev/posts/vulnerability-exploitation-rising-as-the-root-cause-of-many-breaches-hx9y5wr0w twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Vulnerability exploitation rising as the root cause of many breaches | daily.dev og:description: Attackers are increasingly breaking into corporate systems by exploiting vulnerabilities rather than phishing. LevelBlue's Q3 findings show vulnerability... og:url: https://daily.dev/posts/vulnerability-exploitation-rising-as-the-root-cause-of-many-breaches-hx9y5wr0w og:image: https://api.daily.dev/og/posts/HX9Y5Wr0W.png og:image:alt: Vulnerability exploitation rising as the root cause of many breaches og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Vulnerability exploitation rising as the root cause of many breaches **[CSO Online](https://daily.dev/sources/csoonline)** · 2 min read · 0 upvotes · 0 comments ## Summary Attackers are increasingly breaking into corporate systems by exploiting vulnerabilities rather than phishing. LevelBlue's Q3 findings show vulnerability exploitation accounted for 14% of initial access cases, up from 4% in Q2 but below the 20% it recorded in Q1. Verizon's 2026 Data Breach Investigations Report placed exploitation at the centre of 31% of breaches, up from 20% the year before and ahead of credential abuse for the first time. Doerr of ForeGuard Advisory Group says LevelBlue's most-exploited CVE lists this year are dominated by edge appliances from SonicWall, Fortinet, Palo Alto, Ivanti, and BeyondTrust. Phishing and social engineering remain the top initial intrusion vector at 42% of breaches, down from 65% in Q2, according to LevelBlue. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of breaches in 2026 were caused by vulnerability exploitation according to Verizon's Data Breach Investigations Report? Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation at the root of nearly a third, 31%, of breaches, up from 20% the previous year. This was the first time exploitation surpassed credential abuse as a breach cause, based on combined evidence from multiple incident response vendors and law enforcement agencies. _Security teams prioritizing patch cycles can track breach-cause trends like this on daily.dev._ ### Which vendors' edge devices are most commonly exploited by attackers to breach networks? LevelBlue's most-exploited CVE lists are dominated by edge appliances from SonicWall, Fortinet, Palo Alto, Ivanti, and BeyondTrust. These internet-facing VPNs, firewalls, and remote access devices are exposed by design, letting a working exploit put an attacker directly on the network without needing to fool a user or bypass MFA. _Teams evaluating edge device vendors weigh exposure risks like these on daily.dev._ ### Is phishing or vulnerability exploitation the bigger initial access vector for breaches right now? Phishing and social engineering remain the top initial intrusion vector at 42% of breaches, though down from 65% in the prior quarter, per LevelBlue's Q3 report. Vulnerability exploitation accounted for 14% of initial access cases in that period, up from 4% the quarter before, after peaking at 20% in Q1. _Security planners weighing where to focus defenses follow shifts like this on daily.dev._ ## Similar posts on daily.dev - [Vulnerabilities have become cyber attackers’ No. 1 door to the enterprise](https://daily.dev/posts/vulnerabilities-have-become-cyber-attackers-no-1-door-to-the-enterprise-ybhmgdbuz) · CSO Online · 0 upvotes · 0 comments - [Vulnerability exploits now dominate intrusions](https://daily.dev/posts/vulnerability-exploits-now-dominate-intrusions-6prcq9dmw) · The Register · 0 upvotes · 0 comments - [Industry Reacts to Verizon DBIR 2026 as Vulnerability Exploitation Takes Top Spot](https://daily.dev/posts/industry-reacts-to-verizon-dbir-2026-as-vulnerability-exploitation-takes-top-spot-bkvonaewx) · IT Security Guru · 1 upvotes · 0 comments - [Initial Access Changed, The Attack Path Did Not: Findings From The Verizon 2026 DBIR](https://daily.dev/posts/initial-access-changed-the-attack-path-did-not-findings-from-the-verizon-2026-dbir-lmeaaxxot) · GitGuardian · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/vulnerability-exploitation-rising-as-the-root-cause-of-many-breaches-hx9y5wr0w) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Vulnerability exploitation rising as the root cause of many breaches","url":"https://daily.dev/posts/vulnerability-exploitation-rising-as-the-root-cause-of-many-breaches-hx9y5wr0w","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/vulnerability-exploitation-rising-as-the-root-cause-of-many-breaches-hx9y5wr0w"},"datePublished":"2026-10-29T10:05:40.024Z","dateModified":"2026-10-29T10:08:27.027Z","description":"Attackers are increasingly breaking into corporate systems by exploiting vulnerabilities rather than phishing. LevelBlue's Q3 findings show vulnerability...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/499207d27088fb474e694de92eb7d21e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/499207d27088fb474e694de92eb7d21e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/vulnerability-exploitation-rising-as-the-root-cause-of-many-breaches-hx9y5wr0w","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,phishing","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Vulnerability exploitation rising as the root cause of many breaches"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/vulnerability-exploitation-rising-as-the-root-cause-of-many-breaches-hx9y5wr0w#faq","mainEntity":[{"@type":"Question","name":"What percentage of breaches in 2026 were caused by vulnerability exploitation according to Verizon's Data Breach Investigations Report?","acceptedAnswer":{"@type":"Answer","text":"Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation at the root of nearly a third, 31%, of breaches, up from 20% the previous year. This was the first time exploitation surpassed credential abuse as a breach cause, based on combined evidence from multiple incident response vendors and law enforcement agencies. Security teams prioritizing patch cycles can track breach-cause trends like this on daily.dev."}},{"@type":"Question","name":"Which vendors' edge devices are most commonly exploited by attackers to breach networks?","acceptedAnswer":{"@type":"Answer","text":"LevelBlue's most-exploited CVE lists are dominated by edge appliances from SonicWall, Fortinet, Palo Alto, Ivanti, and BeyondTrust. These internet-facing VPNs, firewalls, and remote access devices are exposed by design, letting a working exploit put an attacker directly on the network without needing to fool a user or bypass MFA. Teams evaluating edge device vendors weigh exposure risks like these on daily.dev."}},{"@type":"Question","name":"Is phishing or vulnerability exploitation the bigger initial access vector for breaches right now?","acceptedAnswer":{"@type":"Answer","text":"Phishing and social engineering remain the top initial intrusion vector at 42% of breaches, though down from 65% in the prior quarter, per LevelBlue's Q3 report. Vulnerability exploitation accounted for 14% of initial access cases in that period, up from 4% the quarter before, after peaking at 20% in Q1. Security planners weighing where to focus defenses follow shifts like this on daily.dev."}}]} ```