How attackers actually got in last year

If you only have budget to fix one class of problem this year, it helps to know how people are actually getting in - not how they got in when the training material you read was written.

So here is what the named reports say, including the places where they flatly disagree with each other. We think the disagreement is more useful than any single number.

Exploiting software has overtaken stealing passwords

Verizon’s Data Breach Investigations Report for 2026, covering incidents from November 2024 to October 2025, puts exploitation of vulnerabilities at 31% of breaches as the initial access vector, up from 20% the year before, and ahead of stolen credentials for the first time. Credential abuse as the first known step fell to 13% - but it is still present somewhere in 39% of breach chains.

Google’s Mandiant team, in M-Trends 2026, has exploits as the most common initial infection vector for the sixth year running, at 32%. Interactive voice phishing jumped to second at 11%. Email phishing - the thing most security awareness budgets are spent on - fell to 6% of intrusions.

And now the report that says the opposite

Sophos surveyed 2,158 IT and security leaders in 17 countries whose organisations were hit by ransomware, with fieldwork between January and March 2026. Their root causes: malicious email 26%, phishing 24%, compromised credentials 23%, and exploited vulnerability 18%, down from 32% in the previous year’s survey. They report that 79% of ransomware attacks started with an identity-based approach.

One set of reports says software exploitation is surging; another says it is falling by half. Both are honest. They measure different things: Verizon and Mandiant work from incident response and forensic data, Sophos from what victims say happened to them. Victims are better at remembering a phishing email than at reconstructing which appliance was exploited three weeks before anyone noticed.

The practical reading is not to pick a winner. It is that identity and unpatched exposed software are the two doors, in some order, in almost every dataset - and that most organisations are much better at telling you who their users are than at telling you what of theirs is reachable from the internet.

The edge is where it happens

The single most useful number we know for a Pakistani SME comes from Coalition, a cyber insurer, looking at its own 2024 claims: 58% of ransomware claims began with attackers compromising a perimeter security appliance - a VPN or a firewall. Another 18% came through remote desktop products.

Verizon’s 2025 report put edge devices and VPNs at 22% of exploitation-driven breaches, “almost eight-fold” growth from 3% the year before. That figure is widely misattributed to the 2026 report; it is from DBIR 2025.

Why the edge? Because these are the devices that cannot run an EDR agent, that nobody owns after the person who installed them left, and that sit outside the patch cycle the servers are on. Mandiant’s 2026 report makes the window brutal: the mean time to exploit has dropped to an estimated minus seven days - exploitation is routinely happening before the patch exists.

The most under-reported finding of the year

M-Trends 2026 found that prior compromise is the third most common initial infection vector overall at 10%, and the top one in ransomware operations at 30%, double the 15% seen in 2024.

In plain terms: the most likely way a ransomware crew gets into your network is through a previous intrusion that was never fully cleaned up. Somebody found something, rebuilt a server, changed a few passwords and moved on, and the access that was sold on is still good.

This is why we argue so hard for retesting as part of an engagement rather than as an upsell, and why “we patched it” is not the same as “we checked they were gone.” Mandiant also notes that with threats like BRICKSTORM reaching dwell times near 400 days, a standard 90-day log retention policy leaves you unable to reconstruct how they got in at all.

Ransomware economics are shifting

• Ransomware was present in 48% of breaches in DBIR 2026, up from 44%.
• The median ransom paid fell to US$139,875, and 69% of victims did not pay.
• Sophos found 56% of attacks succeeded in encrypting data, up from 50%, and put average recovery cost excluding ransom at US$1.7 million.
• Third-party involvement reached 48% of breaches, a 60% year-on-year rise.

Fewer people are paying and the payments are smaller, but encryption succeeds more often and the clean-up still costs far more than the ransom. The money has moved from the ransom line to the recovery line.

If you run a small or mid-sized business in Pakistan

CISA’s advisory on Akira ransomware, updated in November 2025, is the single most relevant document we can point you at, because Akira “primarily target small- and medium-sized businesses” and has claimed around US$244 million in proceeds. Its way in, in CISA’s own words, is “obtaining initial access to organizations through a virtual private network (VPN) service without MFA configured”, along with exposed RDP, spearphishing, valid credentials, and - new in the 2025 update - SSH on a router’s IP address.

The named CVEs are not exotic. Cisco ASA issues going back to 2020, Veeam Backup & Replication, and SonicWall CVE-2024-40766. These are things an external test finds in an afternoon.

The four-item list

• Inventory what is reachable from the internet. Not what you think is published - what answers. Most organisations we test are wrong about this.
• MFA on the VPN and every remote access path. Not “most users”. The 58% figure exists because of the accounts that were exceptions.
• Patch the edge on a different, faster clock than your servers. A negative time-to-exploit means your monthly window is not a window, it is a gap.
• Keep logs for longer than 90 days and make sure the VPN, firewall and identity provider are among the things you keep.

Reading the numbers