Cybersecurity threats have reordered themselves in a way that invalidates most advice written in the last two years, because the attack path that mattered most has changed. Guidance built on the assumption that attackers mainly walk in through stolen credentials now points teams at the second most common route rather than the first, which is an expensive place to concentrate a budget.
The Verizon breach investigations report analysed more than 31,000 incidents and over 22,000 confirmed breaches across 145 countries. Exploitation of vulnerabilities is now the most common initial access vector at 31 percent, while credential abuse, the previous leader, fell to 13 percent. Third-party involvement reached 48 percent of breaches and ransomware was present in 48 percent.
What are the biggest cybersecurity threats right now?
The threats that most often produce a breach are unpatched exploitable vulnerabilities, compromise reaching you through a third party, ransomware, and the human element, which appears in 62 percent of breaches. Credential abuse still matters but no longer leads. Ranking them this way matters because defensive budgets follow the published narrative, and that narrative is a year behind.
The uncomfortable detail sits in the remediation figures. The median time to fully resolve a critical vulnerability listed in the known-exploited catalogue rose to 43 days, and only 26 percent of those were fully remediated at all. Attackers did not become more sophisticated. Defenders simply did not close the holes that were already catalogued and publicly known.
| Threat | Share of breaches | What it actually means |
|---|---|---|
| Exploited vulnerabilities | 31% as initial access | Known, catalogued flaws left open past their window |
| Third-party involvement | 48% | Your blast radius includes every supplier's weakness |
| Ransomware | 48% | Present in nearly half of breaches, not a niche event |
| Human element | 62% | Error and manipulation still touch most incidents |
| Credential abuse | 13% as initial access | Still real, no longer the dominant route |
Why did exploitation overtake stolen credentials?
Credential defences got better while patching did not. Multi-factor authentication, conditional access and token binding became normal, which raised the cost of a credential-based intrusion. Meanwhile the volume of disclosed vulnerabilities grew and the time to exploit them shrank, so the easier path moved from logging in to breaking in.
The practical consequence is a reallocation rather than a reversal of priorities. Identity controls are working and should be maintained, not dismantled. What needs new investment is the speed of the patch cycle, particularly for anything on a known-exploited list, where a 43 day median means an organisation is exposed for six weeks on flaws attackers are already using.
How do you make threat intelligence actually useful?
Threat intelligence earns its cost only when it changes a detection rule, a block, or a training module within a week of arriving. Intelligence that generates a report nobody acts on is a subscription, not a defence. Tie each feed to a named owner and a required output, then retire the feed if it produces nothing actionable for a quarter.
Mapping observed attacker behaviour to a shared framework makes the output comparable over time, which is what lets you notice that a technique is becoming more common against your sector. Equally important and far more neglected is retiring stale rules, because a detection set that only grows eventually produces more noise than signal and trains your team to ignore it.
What does Zero Trust actually require?
Zero Trust requires that every request is authenticated, authorised and encrypted regardless of where it originates, with access granted per session and scoped to the minimum needed. It is an architectural stance rather than a product, which is why organisations that buy a Zero Trust tool without changing their access model get the cost and not the benefit.
Adopt it in layers rather than as a programme. Start with administrative access, because that is where a single compromise does the most damage, then service-to-service authentication, then user access to internal applications. Each layer delivers independent value, which matters when a multi-year security programme meets a budget cycle.
The layers worth sequencing:
- Administrative and privileged access first, with session-scoped grants
- Service-to-service authentication with short-lived credentials
- Application access decoupled from network location
- Continuous verification rather than one check at login
How does exposure management change your cadence?
Exposure management replaces the point-in-time audit with a rolling view of which exploitable paths exist right now, ranked by whether an attacker could realistically use them and what they would reach. The shift matters because an annual assessment cannot survive a 43 day remediation median. By the time the report is written, the exposure set has turned over.
Ranking by exploitability rather than severity is the part that changes outcomes. A critical-rated flaw with no reachable path matters less than a medium-rated one on an internet-facing service holding customer data. The scanning and testing techniques that feed this view are covered in our guide to security testing techniques.
The question exposure management answers that an audit cannot. Not "were we compliant in March" but "which of today's open paths would an attacker take, and what would they reach". Only the second question has a defensible answer in front of a board.
Which security metrics belong in a board report?
Report exposure and consequence, not activity. A board needs the number of known-exploited vulnerabilities currently open past their window, the share of critical systems covered by your identity baseline, the concentration of risk across suppliers, and tested recovery times. Counting blocked attacks or tickets closed tells a board nothing about whether the organisation would survive.
Keep the set small and stable across quarters, because the value is in the trend rather than the snapshot. A metric introduced because it looks good this quarter destroys comparability, and boards reasonably lose confidence in a dashboard whose shape changes every time it is presented.
| Metric | What it tells leadership |
|---|---|
| Known-exploited flaws open past window | Direct exposure to what attackers use today |
| Identity baseline coverage on critical systems | Whether the control that is working is applied everywhere |
| Supplier concentration | How much of the business one third party could stop |
| Tested recovery time | Whether the plan has been proven, not written |
How much risk comes from your suppliers?
Nearly half of breaches now involve a third party, which means your effective attack surface includes every organisation holding your data or your access. The risk model that matters is blast radius rather than vendor count, since one supplier embedded in a critical process represents more exposure than twenty peripheral ones.
Concentration is the under-examined part. Organisations map their direct suppliers and rarely map the suppliers those suppliers depend on, so a single widely used provider can appear once on your register while sitting under six of your vendors. The commercial and contractual side of managing this is covered in our guide to vendor due diligence.
Which compliance obligations apply to distributed teams?
Distributed engineering work brings data residency rules, access control evidence and audit obligations that follow the data rather than the team. Frameworks like ISO 27001, SOC 2 and the NIST cybersecurity framework provide the structure, but the operational burden is proving control rather than declaring it.
Three controls carry most of the evidentiary weight across all of them: role-based access reviewed on a fixed cadence, immutable logging of administrative actions, and documented data residency for anything regulated. Build those properly and most framework requirements become reporting exercises rather than remediation projects.
Matching with security specialists
Security work is unusually hard to evaluate from outside, because the output of a weak engagement looks much like the output of a strong one until something happens. The differentiator worth probing is whether a prospective partner asks about your exposure and recovery posture before describing their tooling.
Our network includes vetted cybersecurity experts matched against your environment, your regulatory obligations and the specific exposure you are trying to reduce.
