Security Roundup May 2026

Key Takeaways

• Software vulnerabilities now top breach vector, overtaking credential theft
• Only 26% of known exploited flaws patched, down from 38%
• Median patch time grew 11 days, exposing organizations longer
• Supply chain breaches rose 60%, now 48% of incidents
• Shadow AI usage triped, increasing data leakage risk

Pulse Analysis

Verizon’s latest Data Breach Investigations Report underscores a pivotal shift in threat landscapes: software flaws have eclipsed credential theft as the primary breach vector. The report’s analysis of 31,000 incidents reveals a troubling slowdown in remediation—only a quarter of CISA‑listed exploited vulnerabilities were patched, and the average time to apply fixes stretched by 11 days. For CIOs and security leaders, this translates into heightened exposure across legacy systems and cloud workloads, prompting a reassessment of patch‑management strategies, automated deployment pipelines, and risk‑based prioritization to curb the widening attack surface.

Across the Atlantic, Europol’s Internet Organised Crime Threat Assessment paints a complementary picture of evolving cyber‑crime tactics. Generative AI now powers highly targeted phishing campaigns, while privacy‑focused cryptocurrencies and offshore exchanges streamline ransomware payments. The agency catalogued more than 120 active ransomware families in 2025, a clear indicator that threat actors are diversifying payloads and extorting victims beyond encryption. Enterprises must therefore augment traditional defenses with AI‑enhanced threat intelligence, robust encryption hygiene, and proactive incident‑response playbooks to stay ahead of adversaries exploiting these emerging tools.

Regulatory pressure is mounting in Europe, where data‑protection authorities are cracking down on compliance gaps. Ireland’s Data Protection Commission has launched an inquiry into Shein’s cross‑border data transfers, fined Permanent TSB €277,500 for inadequate security, and upheld a €530 million TikTok fine pending appeal. The GDPR’s 10th anniversary reinforces the continent’s commitment to a unified privacy framework, with the EDPB rolling out a harmonised DPIA template to streamline impact assessments. Companies operating in or serving EU markets must therefore embed privacy‑by‑design principles, conduct regular DPIAs, and monitor evolving guidance to avoid costly penalties and safeguard consumer trust.