For the first time in the 19-year history of Verizon’s Data Breach Investigations Report, stolen passwords are no longer the number one way attackers get into a network. According to the 2026 report, released May 19, exploiting software vulnerabilities is now the leading entry point, involved in 31% of breaches.
What changed
Attackers are moving faster. Verizon notes that AI has shrunk the window between a vulnerability becoming known and being used against organizations “from months to mere hours.” Software that sits unpatched for a few weeks used to be a manageable risk. Today it is an open door.
Your vendors are part of your risk
The same report found that breaches involving a third party rose 60% and now account for 48% of all breaches. The software, cloud services and suppliers your business relies on all extend your attack surface.
What small businesses can do
- Patch on a schedule, and faster for critical fixes. Operating systems, browsers, firewalls, VPNs and line-of-business software all count.
- Keep an inventory. You can’t patch devices and software you don’t know you have.
- Retire what’s out of support. Unsupported systems never receive fixes.
- Ask your vendors how they secure their products, and how quickly they notify you of problems.
Staying on top of updates is exactly the kind of work managed IT support exists to take off your plate. If you’re not sure how current your systems are, give us a call at (317) 585-6100.
Source: Verizon, 2026 Data Breach Investigations Report news release.