Verizon DBIR 2026: AI Vulnerabilities Now Outpace Stolen Credentials in Breaches

Verizon has released its 2026 Data Breach Investigations Report, drawing on a review of more than 31,000 security incidents across 145 countries. Its central finding marks a significant shift in the threat landscape: vulnerability exploitation now accounts for 31% of all breaches, surpassing stolen credentials as the leading initial access vector for the first time in the report's 19-year history.

The report found that threat actors are actively deploying generative AI across all stages of the attack cycle, including targeting, initial access, and the development of malware and other offensive tools. Threat actors typically used AI assistance across 15 different techniques during attacks, with some employing as many as 50 distinct AI-assisted techniques within a single campaign.

The Speed Imperative Has Changed

Perhaps the most operationally significant finding for security teams is the compression of response windows. Verizon warns that AI is being used by threat actors to accelerate the exploitation of known vulnerabilities, reducing the time defenders have to act from months to mere hours. Organisations patched only 26% of vulnerabilities on the CISA Known Exploited Vulnerabilities catalogue last year, down from 38% the prior year, and the median time to patch grew by 11 days in the same period.

This is not a theoretical future risk. It is the current operating reality for organisations running unpatched systems, including the enterprise environments across the Gulf region where legacy infrastructure across financial services, government, and critical sectors remains common.

Operational, Not Yet Transformational, But the Gap Is Closing

Verizon's analysts characterise AI's current primary impact as operational rather than transformational: automating and scaling attack techniques that defenders already know how to detect, rather than unlocking genuinely novel attack surfaces. However, the report cautions that this assessment may become obsolete rapidly as AI capabilities continue to advance.

For security leaders, this framing matters. The threat is not yet the scenario of AI autonomously discovering unprecedented zero-days. It is the far more immediate problem of adversaries using AI to execute known techniques faster, at greater scale, and with lower operational cost. This assessment is consistent with Google Threat Intelligence Group's finding that it had, for the first time, identified a threat actor using a zero-day exploit believed to have been developed with AI assistance.

Fight AI with AI

Verizon Chief Information Security Officer Nasrin Rezai offered a direct assessment of what the findings require in practice. Organisations must incorporate AI into security operations at a scale that has not been attempted before, embedding it into software development life cycles, testing processes, and cyber defence operations.

"We need to fight AI with AI. We need to incorporate them into our practices," Rezai told Reuters. "We need to bring them into our software development life cycle, in our testing processes, in our cyber defence processes at a scale that we have never done before."

This is consistent with the growing consensus among GCC security leaders that AI-augmented detection and reduced dwell time are now the defining measures of a mature security posture, not perimeter controls alone.

Mythos Excluded From This Year's Dataset

The 2026 DBIR explicitly notes that it does not cover data from Anthropic's Mythos model, which was announced on 7 April and is being deployed under Project Glasswing, a controlled initiative through which select organisations are using the unreleased Claude Mythos Preview for defensive cybersecurity purposes, including vulnerability identification.

Mythos's advanced coding capabilities have given it an ability to identify and reason about cybersecurity vulnerabilities that experts describe as potentially unprecedented. Its exclusion from the DBIR dataset means the 2026 report may already be conservative in its AI threat assessment. The 2027 DBIR, which will cover a period in which Mythos and similar models are more widely deployed, is expected to show materially different findings.

What GCC Organisations Should Do Now

For GCC organisations reviewing security postures, the Verizon DBIR provides a clear directive: AI-assisted vulnerability exploitation is the dominant breach vector now, and the response must match it in kind. Patching velocity, AI-augmented detection, and reduced dwell time are the immediate priorities.

The full Verizon 2026 Data Breach Investigations Report is available via the Verizon DBIR portal. For Gulf-specific cybersecurity risk guidance, the UAE Cyber Security Council and Saudi Arabia's National Cybersecurity Authority both publish advisory frameworks aligned with current threat trends.