Vulnerability exploitation drives 14% of initial access in Q3

LevelBlue's Q3 data shows vulnerability exploitation accounted for 14% of initial access cases, up from 4% in Q2, after hitting 20% in Q1. Verizon's 2026 DBIR tied exploitation to 31% of breaches, overtaking credential abuse for the first time, while phishing remains the top vector at 42%.

• Vulnerability exploitation hit 14% of initial access in Q3, up from 4% in Q2
• Verizon DBIR 2026: exploitation in 31% of breaches, ahead of credential abuse
• Phishing remains the top vector at 42% of breaches, down from 65% in Q2
• Most-exploited CVEs target edge devices from SonicWall, Fortinet, Palo Alto, Ivanti, BeyondTrust