Vulnerability exploitation rising as the root cause of many breaches

LevelBlue’s Q3 findings show vulnerability exploitation accounted for 14% of initial access cases, up from 4% in Q2, after a Q1 rate of 20% where security flaws in edge devices were the prime target. Verizon’s 2026 Data Breach Investigations Report placed exploitation at the center of nearly a third (31%) of breaches, surpassing credential abuse for the first time. Scott Doerr, experienced CISO turned founder of ForeGuard Advisory Group, said the biggest driver is exploitation of internet-facing edge devices such as VPNs, firewalls and remote access appliances, noting that LevelBlue’s most-exploited CVE lists this year are dominated by those appliances from SonicWall, Fortinet, Palo Alto, Ivanti and BeyondTrust. Mitchell Spicer, co-founder and COO of Revelion AI, added that unpatched, misconfigured or forgotten internet-facing services give attackers a direct route without needing phishing or MFA prompts, and AI is making vulnerability discovery cheaper and more accessible. ¹