Lessons for Irish Organisations From the Verizon 2026 Data Breach Investigations Report (DBIR)

Key Takeaways

• Vulnerability exploitation now leads breaches (31%) vs credentials (13%).
• Only 26% of critical CISA vulnerabilities patched in 2025.
• Ransomware involved in 48% of breaches; 69% victims refused payment.
• Third‑party breaches rose 60%, now appear in 48% of incidents.
• 45% of employees regularly use unsanctioned AI tools, raising data leakage risk.

Pulse Analysis

The Verizon DBIR remains a benchmark for understanding global cyber trends, and the 2026 edition underscores a pivotal shift: attackers are increasingly leveraging unpatched vulnerabilities rather than relying on stolen credentials. With 31% of breaches originating from exploited flaws, organisations face a capacity challenge—security teams must triage a flood of findings while maintaining rapid remediation cycles. The report’s finding that only a quarter of critical CISA‑listed vulnerabilities were fully patched in 2025 highlights the widening gap between discovery and remediation, a gap amplified by the growing use of AI to automate vulnerability discovery.

Ransomware continues to dominate, appearing in nearly half of all incidents, yet the data also reveals a silver lining—69% of victims chose not to pay, suggesting improved backup and recovery practices. However, the real danger now lies in the supply chain: third‑party breaches surged 60% and now feature in almost half of all attacks, reflecting the complex web of cloud services, SaaS platforms, and outsourced IT partners that modern businesses rely on. Coupled with the rise of “Shadow AI,” where 45% of employees regularly use unsanctioned generative‑AI tools, the attack surface is expanding beyond traditional endpoints.

For Irish firms and their global peers, the takeaway is clear: sophisticated tools won’t compensate for neglected fundamentals. Asset inventory, timely patching, multi‑factor authentication, least‑privilege access, and robust third‑party risk programs remain the most effective defenses. Investing in a comprehensive cybersecurity maturity assessment can help organisations map these basics into a resilient, business‑focused strategy, ensuring compliance with GDPR, NIS2, and other regulations while safeguarding operational continuity.