Vulnerability exploitation rising as the root cause of many breaches

Publisher excerpt From CSO Online

More evidence has emerged that attackers are turning to vulnerabilities rather than phishing as a means for breaking into corporate systems. Incident response firm LevelBlue’s Q3 findings show that vulnerability exploitation accounted for 14% of initial access cases, up from 4% in Q2. The finding represents more of a comeback than a fresh surge because in Q1 LevelBlue already recorded vulnerabilities as the root cause in 20% of the intrusions it investigated. In both Q1 and the latest figures known security vulnerabilities in edge devices made them the prime target for exploitation. Verizon’s 2026 Data Breach Investigations Report — which is based on the combined evidence of multiple incident response vendors and law enforcement agencies — placed exploitation at the center of nearly a third (31%) of breaches, up from 20% the year before and ahead of credential abuse for the first time. Phishing/social engineering remain the top initial intrusion vector, accounting for 42% of breaches, down from 65% in Q2, according to LevelBlue’s Q3 report. Living on the edge Scott Doerr, experienced CISO turned founder of ForeGuard Advisory Group, said the biggest driver of the trend is exploitation of security flaws in internet-facing edge devices such as VPNs, firewalls, and remote access appliances. “LevelBlue’s most-exploited CVE lists this year are dominated by those appliances from SonicWall, Fortinet, Palo Alto, Ivanti, and BeyondTrust,” said Doerr. “They’re exposed by design,…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.