More evidence has emerged that attackers are turning to vulnerabilities rather than phishing as a means for breaking into corporate systems.
Incident response firm LevelBlue’s Q3 findings show that vulnerability exploitation accounted for 14% of initial access cases, up from 4% in Q2. The finding represents more of a comeback than a fresh surge because in Q1 LevelBlue already recorded vulnerabilities as the root cause in 20% of the intrusions it investigated.
In both Q1 and the latest figures known security vulnerabilities in edge devices made them the prime target for exploitation.
Verizon’s 2026 Data Breach Investigations Report — which is based on the combined evidence of multiple incident response vendors and law enforcement agencies — placed exploitation at the center of nearly a third (31%) of breaches, up from 20% the year before and ahead of credential abuse for the first time.
Phishing/social engineering remain the top initial intrusion vector, accounting for 42% of breaches, down from 65% in Q2, according to LevelBlue’s Q3 report.
Living on the edge
Scott Doerr, experienced CISO turned founder of ForeGuard Advisory Group, said the biggest driver of the trend is exploitation of security flaws in internet-facing edge devices such as VPNs, firewalls, and remote access appliances.
“LevelBlue’s most-exploited CVE lists this year are dominated by those appliances from SonicWall, Fortinet, Palo Alto, Ivanti, and BeyondTrust,” said Doerr. “They’re exposed by design, and a working exploit puts the attacker directly on the network with no user to fool and often no MFA prompt in the way.”
Mitchell Spicer, co-founder and COO of Revelion AI, an autonomous AI penetration-testing platform, backed this assessment.
“Phishing is still a major threat, but exploiting a vulnerability can give an attacker a direct route into a system without needing to persuade an employee to click a link,” said Spicer. “The opportunity is particularly attractive when organizations have internet-facing services that are unpatched, misconfigured, or forgotten.”
AI offers a double-edged sword
AI is adding another dimension to the cat and mouse game between attackers and enterprise security defenders.
“It [AI] is making parts of reconnaissance and vulnerability discovery cheaper and more accessible, which can help defenders find weaknesses but can also help attackers identify potential targets,” Spicer said. “The longer those weaknesses remain exposed, the more opportunity attackers have to find and exploit them.”
No Responses