LevelBlue: vulnerability exploitation rose to 14% of initial access
Original title: Vulnerability exploitation rising as the root cause of many breaches
The firm's Q1 figure was 20%, while Verizon's 2026 DBIR put exploitation behind 31% of breaches.
LevelBlue's Q3 incident-response findings say vulnerability exploitation accounted for 14% of initial-access cases, up from 4% in Q2 and below the 20% recorded in Q1. Known flaws in edge devices were the prime target in both periods. Verizon's 2026 Data Breach Investigations Report placed exploitation behind 31% of breaches, ahead of credential abuse for the first time. LevelBlue still lists phishing and social engineering as the top intrusion vector at 42%, down from 65% in Q2.
Unconfirmed: The percentages come from LevelBlue's own investigations and Verizon's multi-source report, not a complete census of breaches.
- LevelBlue recorded vulnerability exploitation in 20% of Q1 cases and 4% in Q2.
- Verizon's 2026 DBIR put exploitation at 31%, up from 20% the prior year.
- Phishing and social engineering fell from 65% in Q2 to 42% in LevelBlue's Q3 report.
- Cited edge appliances include SonicWall, Fortinet, Palo Alto, Ivanti, and BeyondTrust.
From the original article
2 min read at csoonline.com
More evidence has emerged that attackers are turning to vulnerabilities rather than phishing as a means for breaking into corporate systems. Incident response firm LevelBlue’s Q3 findings show that vulnerability exploitation accounted for 14% of initial access cases, up from 4% in Q2.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.