AI Accelerates Exploit Delivery: Defensive Lines for 74% of Critical Vulnerabilities Are Failing | Verizon DBIR 2026 Analysis ①

Vulnerability exploitation, after consecutive years as the second largest entry point for data breaches, officially took the crown this year.

On 19 May 2026, Verizon released the 19th edition of the Data Breach Investigations Report (DBIR), which analysed 31,000 real-world security incidents globally, of which 22,000 were confirmed breaches, covering 145 countries. This is the largest analytical scale in the report's 19-year history.

There is only one core conclusion: vulnerability exploitation, accounting for 31%, significantly surpassed credential abuse (13%) for the first time, becoming the primary initial entry point for data breaches, representing a 55% increase from the previous year's 20%.

What does this number mean?

The rise in the ranking of vulnerability exploitation itself is not unexpected. The trends over the past few years have already been heading in this direction, and the rapid development of AI over the last two years has quickly propelled it to the top. However, what should really make people pause and think is what has been happening on the remediation side during the same period.

Chart 12 shows that in 2025, only 26% of high-severity vulnerabilities were completely remediated by enterprises, a significant drop from 38% the previous year. The median time to complete remediation extended from 32 days to 43 days. Meanwhile, the median number of high-severity vulnerabilities faced by each organisation rose to 16, a 50% increase from the previous year.

Attackers are increasingly relying on vulnerability exploitation, yet enterprises' remediation capabilities are regressing. This is not a problem unique to one company, but an industry-wide structural dilemma—the growth rate of vulnerabilities has already outpaced the rate at which teams can address them, with 74% of high-severity vulnerabilities remaining unremediated for the long term.

This year, the DBIR specifically recorded a shift that deserves close attention: attackers are systematically using AI to accelerate the entire attack lifecycle.

The report data reveals that the median number of techniques used by attackers with AI assistance has reached 15, with some attackers using as many as 40 to 50. AI is being utilised to select targets, find initial entry points, develop malicious tools, and discover 0-day vulnerabilities, among other stages. The current reality is that the window of time from the public disclosure of a vulnerability to its weaponisation has compressed from months in the past to mere hours.

The logic here is that the widespread use of AI by hackers has drastically lowered the threshold and time costs for vulnerability discovery and exploitation. Exploit chains that previously required experienced attackers days or even longer to research can now be analysed and weaponised by AI within hours.

Consequently, those 74% of unremediated high-severity vulnerabilities are each exposed to lower-threshold attacks within a much shorter time window. Remediation speeds were already failing to keep up, but attack speeds are accelerating, narrowing the window from both ends simultaneously.

The issue is not just about remediating fast enough; the defense side also needs AI

Faced with this situation, the intuitive response is to "speed up remediation". However, the issues revealed by the DBIR run deeper than just remediation speed.

Vulnerability scanning can tell you "what is there," but it cannot tell you "how it is"—is there a reachable attack path for this vulnerability within your actual network topology? How would existing security defenses along the attack path, such as firewalls, WAF, EDR, and HIDS, react to a real attack pattern? Will they trigger an alert or let it straight through? Do the detection rules in the SIEM cover the latest techniques currently used by attackers?

The answers to these questions can only be obtained through real-world adversarial validation, rather than waiting for an attack to occur. Without validation, prioritising remediation is just guessing based on experience, and whether your line of defense is effective will forever remain in the stage of "it should be fine".

Gartner, in its 2026 Market Guide for Adversarial Exposure Validation (AEV), predicts that by 2027, 40% of enterprises will have established formal exposure validation mechanisms. The reasoning behind this is that in today's landscape where vulnerability exploitation has become the number one entry point, the effectiveness of defenses built solely on scanning and patching has never been tested in real-world conditions.

If attackers are already using AI to compress the time to discover vulnerabilities and weaponise them, defenders' validation capabilities cannot afford to remain at the pace of manual coordination.

The approach of the Pyxis Adversarial Validation Platform is to get the defense-side validation loop up and running as well. The platform tracks over 440 APT groups, covering more than 26,000 attack techniques. Based on first-hand threat intelligence, it launches continuous adversarial validation on your defense systems within your environment, without disrupting business operations. The validation results are linked with SIEM/SOC, and for missed attack behaviors, CyriAI automatically generates deployable detection rules and provides specific mitigation recommendations, while simultaneously triggering next steps in your workflow.

The entire workflow is driven by embedded AI. With a single command inputted by the user, the system completes the entire closed loop, from intelligence analysis and scenario orchestration to adversarial execution and detection rule output. This is not about turning AI into a mere feature button, but about ensuring the speed of validation itself matches the rhythm of threat intelligence updates, making remediation and mitigation as automated as possible.

The value of the DBIR is not just to provide an annual leaderboard of the causes of data breaches. Its more critical role is to use real-world data to show us how much of a gap exists between the current trends in the offensive and defensive landscape and what we assume them to be.

Without continuous validation, our assessment of the effectiveness of our defenses is, most of the time, merely an assumption. Without AI-driven security operations, you simply cannot keep up with the speed of hackers today.

References

– Verizon 2026 Data Breach Investigations Report, published on 19 May 2026

Verizon's "2026 Data Breach Investigations Report" was officially released on 19 May. You can click Read Original at the end of the article to download the full PDF.