Attackers stopped asking for passwords. They use what you haven't patched

For years the advice was simple: protect your passwords. That advice still matters, but attackers have moved on. In 2026, the most common way into a company is a vulnerability nobody patched.

Verizon’s Data Breach Investigations Report, the largest yearly study of real breaches, shows the shift clearly.

How breaches happen

43 daysis the median time to fully fix a vulnerability that attackers already use

Every day the hole stays open →

What changed

Exploited vulnerabilities are now the top way in. They started 31% of breaches, up from 20% a year earlier. Stolen or abused credentials fell to 13%.

Known holes stay open. Only 26% of the vulnerabilities in the US government’s list of flaws that attackers actively exploit were fully fixed during 2025, down from 38%. Fixing one took a median of 43 days.

Vendors are part of the problem. A third party, such as a supplier, an IT provider or a software vendor, was involved in 48% of breaches, up from 30%.

Ransomware is still everywhere. It appeared in 48% of breaches. The good news: 69% of victims refused to pay.

In short, attackers no longer need to trick a person. They scan the internet for a system that missed an update, and they find one.

Five things to fix first

1. Know what faces the internet. Make a list of every server, VPN, firewall and web application reachable from outside. You can’t patch what you don’t know you have.
2. Patch the dangerous ones in days, not weeks. When a flaw is on the list of actively exploited vulnerabilities, set a deadline of 7 to 14 days for systems that face the internet. 43 days is too slow.
3. Check your vendors’ access. Who can log in to your systems from outside, with which rights, and when was that last reviewed? Remove what nobody uses.
4. Watch for the attack, not just the hole. Monitoring catches the attacker who got in through a gap you haven’t closed yet.
5. Test your backups. Ransomware is a business problem only if you can’t restore. Restore one system from backup this month and time it.

Where to start

Most companies don’t need a new security product. They need a clear list of what is exposed, an owner for each item and a deadline. That’s what a security review gives you: the holes ranked by risk, the cost to close each one and the order to do it in.

Sources: Verizon 2026 Data Breach Investigations Report; figures as summarised by Help Net Security.