{"id":10195,"date":"2026-10-29T10:00:00","date_gmt":"2026-10-29T10:00:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10195"},"modified":"2026-10-29T10:00:00","modified_gmt":"2026-10-29T10:00:00","slug":"vulnerability-exploitation-rising-as-the-root-cause-of-many-breaches","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10195","title":{"rendered":"Vulnerability exploitation rising as the root cause of many breaches"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

More evidence has emerged that attackers are turning to vulnerabilities rather than phishing<\/a> as a means for breaking into corporate systems.<\/p>\n

Incident response firm LevelBlue\u2019s Q3 findings<\/a> show that vulnerability exploitation accounted for 14% of initial access cases, up from 4% in Q2. The finding represents more of a comeback than a fresh surge because in Q1 LevelBlue already recorded vulnerabilities as the root cause in 20% of the intrusions it investigated.<\/p>\n

In both Q1 and the latest figures known security vulnerabilities in edge devices made them the prime target for exploitation.<\/p>\n

Verizon\u2019s 2026 Data Breach Investigations Report<\/a> \u2014 which is based on the combined evidence of multiple incident response vendors and law enforcement agencies \u2014 placed exploitation at the center of nearly a third (31%) of breaches, up from 20% the year before and ahead of credential abuse for the first time.<\/p>\n

Phishing\/social engineering remain the top initial intrusion vector, accounting for 42% of breaches, down from 65% in Q2, according to LevelBlue\u2019s Q3 report.<\/p>\n

Living on the edge<\/h2>\n

Scott Doerr, experienced CISO turned founder of ForeGuard Advisory Group, said the biggest driver of the trend is exploitation of security flaws in internet-facing edge devices<\/a> such as VPNs, firewalls, and remote access appliances.<\/p>\n

\u201cLevelBlue\u2019s most-exploited CVE lists this year are dominated by those appliances from SonicWall, Fortinet, Palo Alto, Ivanti, and BeyondTrust,\u201d said Doerr. \u201cThey\u2019re exposed by design, and a working exploit puts the attacker directly on the network with no user to fool and often no MFA prompt in the way.\u201d<\/p>\n

Mitchell Spicer, co-founder and COO of Revelion AI, an autonomous AI penetration-testing platform, backed this assessment.<\/p>\n

\u201cPhishing is still a major threat, but exploiting a vulnerability can give an attacker a direct route into a system without needing to persuade an employee to click a link,\u201d said Spicer. \u201cThe opportunity is particularly attractive when organizations have internet-facing services that are unpatched, misconfigured, or forgotten.\u201d<\/p>\n

AI offers a double-edged sword<\/h2>\n

AI is adding another dimension<\/a> to the cat and mouse game between attackers and enterprise security defenders.<\/p>\n

\u201cIt [AI] is making parts of reconnaissance and vulnerability discovery cheaper and more accessible, which can help defenders find weaknesses but can also help attackers identify potential targets,\u201d Spicer said. \u201cThe longer those weaknesses remain exposed, the more opportunity attackers have to find and exploit them.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

More evidence has emerged that attackers are turning to vulnerabilities rather than phishing as a means for breaking into corporate systems. Incident response firm LevelBlue\u2019s Q3 findings show that vulnerability exploitation accounted for 14% of initial access cases, up from 4% in Q2. The finding represents more of a comeback than a fresh surge because […]<\/p>\n","protected":false},"author":0,"featured_media":10196,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10195","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10195"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10195"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10195\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10196"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10195"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}