Key Insights from the Verizon 2025 DBIR

Cyber threats are evolving fast, with attackers focusing more on exploiting vulnerabilities—especially at the network edge—than stealing credentials. For 18 years, the Verizon Data Breach Investigations Report (DBIR) has helped make sense of this shifting landscape.

The 2025 report analyzed over 22,000 security incidents and 12,000 confirmed breaches to show how attacks are changing and where defenses are failing.

Key takeaways this year include a sharp rise in edge device attacks, increased third-party risks, and new trends in ransomware. Let’s break down what security leaders need to know from this essential report—and see if your defenses are ready for today’s threats.

The Headline Stat: Vulnerability Exploitation Skyrockets

For years, credential stuffing and phishing dominated initial access narratives. The 2025 DBIR signals a dramatic shift. Key findings include:

• Exploitation in 20% of Breaches: Vulnerability exploitation was identified as the initial access vector in a full fifth of all analyzed breaches.
• 34% Year-Over-Year Increase: This represents a significant surge compared to the previous year’s report, cementing exploitation as a top-tier threat closing in on credential abuse (presently at 22%).
• Edge Devices & VPNs are Prime Targets: The report specifically highlights that vulnerabilities in VPNs and other edge devices were implicated in 22% of all CVE-related breaches analyzed, a nearly eight-fold increase from the 3% reported in 2024. This underscores the critical exposure these devices present. This isn’t a random fluctuation; it’s a direct consequence of threat actors aggressively weaponizing flaws, especially in internet-facing assets.

This seismic shift demands a re-evaluation of defensive priorities, moving beyond solely user-focused threats to aggressively tackle infrastructure vulnerabilities, especially at the perimeter.

Tenable & DBIR Collaboration: Illuminating the Edge Vulnerability Crisis

Where is this exploitation focused? The data points overwhelmingly towards the network edge. Breaches involving VPNs and edge devices accounted for 22% of all vulnerability exploitations, a nearly eight-fold increase from the 3% reported in 2024. These devices – firewalls, VPN concentrators, load balancers – are highly valuable targets because they sit at the network boundary, offering a direct path into internal systems if compromised.

Tenable Research, collaborating with the DBIR, provided enriched data focusing on 17 specific edge-related CVEs added to CISA’s Known Exploited Vulnerabilities (KEV) list in the past year. These CVEs, impacting vendors like Cisco, Citrix, Fortinet, Ivanti, Juniper, Palo Alto Networks, and SonicWall, became focal points for attackers, including sophisticated APT groups leveraging campaigns like ArcaneDoor and financially motivated ransomware gangs.

The CVE Hit List: 17 Critical Edge Flaws Under the Microscope

The analysis zeroed in on vulnerabilities impacting widely used technologies from vendors including:

• Cisco: (e.g., CVE-2024-20359 - ASA/FTD RCE linked to ArcaneDoor)
• Citrix: (e.g., CVE-2023-6548, CVE-2023-6549’s NetScaler ADC/Gateway Zero-Days)
• Fortinet: (e.g., CVE-2023-48788 - FortiClientEMS SQLi, CVE-2024-21762, CVE-2024-23113 - FortiOS RCEs, CVE-2024-47575 - FortiManager Auth Bypass “FortiJump”)
• Ivanti: (e.g., CVE-2023-46805, CVE-2024-21887, CVE-2024-21893 - Connect Secure/Policy Secure Auth Bypass, RCE, SSRF Zero-Days)
• Juniper Networks: (e.g., CVE-2023-36844 to CVE-2023-36851 - Junos OS RCE chain)
• Palo Alto Networks: (e.g., CVE-2024-3400 - PAN-OS GlobalProtect RCE Zero-Day)
• SonicWall: (e.g., CVE-2024-40766 - SonicOS Improper Access Control)

(Refer to the Tenable blog/DBIR for the full list and specific CVSS/VPR scores).

The Patching Paradox: Remediation Lags Dangerously Behind Exploitation

Despite the clear and present danger, the DBIR analysis, supported by Tenable’s telemetry, reveals alarming delays in remediation. While organizations are prioritizing these critical edge vulnerabilities over the general pool (achieving full remediation in a median of 32 days for the DBIR’s edge subset vs. 38 days for the entire CISA KEV catalog), “prioritized” still means months in many cases.

• Slowest Sectors: For some vulnerabilities analyzed by Tenable (like specific Citrix or Fortinet flaws), industries like Education, Energy & Utilities, and Consulting took, on average, over 160 to 260 days to remediate.
• Zero-Day Exploitation Window: The DBIR highlights that the median time between CVE publication and inclusion in the CISA KEV list (indicating active exploitation) for the edge device subset was zero days. In fact, 9 of the 17 CVEs analyzed were added to the KEV list on or before their official CVE publication date, showing attackers exploit flaws before defenders are even widely aware.
• Incomplete Remediation: Worryingly, the DBIR notes that 30% of edge device vulnerabilities remained unremediated in affected organizations, suggesting a potentially binary approach where single, critical devices are either fully patched or left vulnerable.

The message is stark: attackers are exploiting edge flaws almost immediately, while defenders often take months to patch, leaving a vast window of opportunity.

The Expanding Blast Radius: Third-Party Risk Doubles

Another critical finding is the dramatic increase in breaches involving a third party. Present in 30% of breaches analyzed this year, this figure has doubled from approximately 15% in the 2024 report. This highlights the systemic risk inherent in interconnected digital ecosystems and complex software supply chains.

The report acknowledges the impact of major incidents involving service providers (implicitly referencing events like the MOVEit and Snowflake-related breaches) and the cascading effects on their customers. Whether it’s a vendor’s vulnerable software, compromised credentials accessed via a partner, or data leakage from a SaaS platform, organizations are increasingly exposed through their external dependencies. This underscores the urgent need for robust vendor risk management, secure-by-default configurations in shared platforms (like mandatory MFA, which was a factor in the Snowflake incidents), and clear delineation of responsibilities within the Shared Responsibility Model.

Industry Benchmarks: A Wide Spectrum

The analysis dug deeper, revealing vast differences in average remediation times across industries for specific vendor vulnerabilities:

• Cisco (CVE-2024-20359): Education, Energy/Utilities, Shipping/Transportation lagged (166-185 days). Government, Construction, Hospitality were faster (76-160 days).
• Citrix (CVE-2023-6548): Remediation was slow across the board. Biotech/Chemicals, Energy/Utilities, Education took the longest (271-288 days). Even the fastest sectors (Consulting, Banking/Finance/Insurance, Healthcare) averaged 160-183 days.
• Fortinet (CVE-2024-21762): Consulting, Banking/Finance, Energy/Utilities were slowest (250-261 days). Retail, Shipping, Software/Internet/Tech were fastest but still averaged a lengthy 172-196 days.
• Fortinet (CVE-2023-48788 - SQLi): A contrasting picture – Communications/Telco patched extremely fast (average 12 days). Healthcare next (71 days). Entertainment, Education, Legal Services took over 220 days.
• Fortinet (CVE-2024-47575 - FortiJump): Showed much faster remediation, potentially due to urgency. Even the slowest sectors averaged only 6-7 days, with Manufacturing/Machinery averaging just 2 days.
• Ivanti (CVE-2023-46805/CVE-2024-21887 - Zero-Days): Remediation was extremely slow. Manufacturing, Communications, Software/Internet averaged 287-294 days. Government password hygiene (reuse across sites) in fueling this. Analysis of infostealer logs revealed 46% of compromised systems, Retail, Banking were “faster” but still took 268-277 days.
• Juniper (CVE-2023-36844 - RCE Chain): Highly variable. Food/Beverage, Retail, Education were extremely slow (348-422 days). Shipping/Transportation, Construction, Healthcare were fastest (80-191 days).
• Palo Alto Networks (CVE-2024-3400 - Zero-Day): Software/Internet, Energy, Manufacturing were slowest (171-201 days). Shipping and Banking/Finance/Insurance were significantly faster (13 and 45 days respectively).
• SonicWall (CVE-2024-40766): Showed faster remediation overall. Consulting, Education, Healthcare slowest (34-52 days). Retail, Engineering were fastest (14 and 6 days respectively).

This granular data underscores that while awareness of edge threats is high overall, the operational reality of timely patching remains a significant hurdle across nearly all sectors for many critical flaws. Attackers only need one unpatched system.

Beyond Exploitation: Other Key DBIR 2025 Themes

While vulnerability exploitation surged, the human element remains deeply intertwined with breaches, involved in roughly 60% of cases.

• Credential Abuse: The use of stolen credentials remains a top action variety within both Basic Web Application Attacks and System Intrusion patterns. The report emphasizes the role of infostealers and poor password hygiene (reuse across sites) in fueling this. Analysis of infostealer logs revealed 46% of compromised systems with corporate logins were non-managed devices, highlighting BYOD risks.
• Social Engineering: Phishing and pretexting remain the primary social tactics. While the overall percentage might fluctuate slightly, these methods continue to be effective entry points, often leading directly to credential compromise or malware deployment. Prompt bombing (MFA fatigue attacks) also emerged as a notable technique.
• Errors: Unintentional actions, primarily misdelivery (sending data to the wrong recipient) and misconfiguration (often cloud storage), remain significant contributors, especially within internal threats.

Emerging Threats & Other Notables

• Espionage Motive: Espionage-motivated breaches saw significant growth, now representing 17% of the dataset, partly due to changes in data contributors but also reflecting geopolitical realities. These attacks heavily leverage vulnerability exploitation (70% of the time) and target specific data types (Internal, Secrets).
• GenAI Risks: The report touches on the emerging threat of sensitive corporate data leakage via GenAI platforms, noting that 15% of employees routinely access these tools on corporate devices, often using non-corporate emails or lacking integrated authentication, posing a risk of confidential data being uploaded or processed insecurely.

Strategic Imperatives: Key Takeaways for Defenders

The Verizon 2025 DBIR paints a clear picture of an evolving threat landscape demanding specific defensive priorities:

• Prioritize Edge Security & Patching: The surge in edge device exploitation is undeniable. Organizations must prioritize rapid patching for internet-facing VPNs, firewalls, and other network appliances. Given the zero-day reality, robust vulnerability management and compensating controls (like strict network segmentation and monitoring) are essential.
• Intensify Vendor & Third-Party Risk Management: With third-party involvement doubling, rigorous vetting, contractual security requirements, continuous monitoring, and clear understanding of shared responsibility models are critical.
• The Human Element Persists: Around 60% of breaches still involve a human element (similar to last year). However, the nature is shifting, with less emphasis purely on errors (though Misdelivery remains high) and more on social engineering leading to credential loss, which then enables hacking/system intrusion. Phishing remains a key tactic (present in 15% of breaches).
• Combat Credential Abuse: Continued focus on strong, unique passwords/passphrases, widespread MFA enforcement (and monitoring for bypass techniques like prompt bombing), privileged access management (PAM), and scrutinizing logins (especially via Conditional Access policies) is vital.
• Prepare for Ransomware Realities: Assume ransomware is a high probability threat. Focus on robust, tested backups, comprehensive incident response planning, network segmentation to limit lateral movement, and EDR/MDR solutions.
• Sustain Human Defenses: Ongoing security awareness training remains crucial to combat phishing and social engineering, emphasizing reporting suspicious activity.
• Embrace Automation: The speed and scale of modern attacks necessitate automation in detection (SIEM/SOAR/XDR), response, and especially vulnerability remediation.

Conclusion: Navigating the 2025 Threat Landscape

The Verizon 2025 DBIR delivers a data-driven mandate: adapt or fall behind. The dramatic rise in vulnerability exploitation targeting the network edge, coupled with the doubling of third-party risk, signals a critical need to reassess security priorities.

While familiar threats like ransomware, credential abuse, and social engineering persist, their manifestations evolve. Defenders must move beyond static defenses, embrace proactive vulnerability management (especially for edge devices), rigorously manage supply chain risk, and leverage automation and threat intelligence to keep pace.

The DBIR remains an invaluable tool, not just for understanding the “what” and “how” of breaches, but for informing the strategic decisions needed to build true resilience in the face of relentless cyber threats.

To further enhance your cloud security, contact me on LinkedIn Profile or [email protected]

Frequently Asked Questions (FAQ)

• What is the most significant finding in the Verizon 2025 DBIR? The dramatic 34% year-over-year increase in vulnerability exploitation as an initial access vector, now present in 20% of breaches, is arguably the most significant shift, particularly the heavy focus on edge devices and VPNs.
• Why is patching edge devices so critical according to the DBIR? Edge devices were targeted in 22% of vulnerability exploits analyzed. The report, supported by Tenable’s data, shows attackers exploit these flaws extremely quickly (median zero days between CVE publication and KEV listing for the subset), while defender remediation often lags, making rapid patching of these internet-facing systems paramount.
• How has third-party risk changed according to the 2025 DBIR? Breaches involving third parties (vendors, partners, suppliers) doubled, rising from ~15% in the previous report to 30% in the 2025 DBIR, highlighting increased supply chain and ecosystem risks.
• What are the latest ransomware trends from the DBIR? Ransomware remains prevalent (44% of breaches), disproportionately hitting SMBs (88% of their breaches). However, the median ransom payment decreased to $115k, and the percentage of victims not paying increased to 64%.
• Who contributes data to the Verizon DBIR? The DBIR aggregates anonymized data from numerous sources, including Verizon’s own VTRAC investigators, dozens of external contributing organizations (like incident response firms, law enforcement, security vendors - Tenable included), and publicly disclosed security incidents.

Resources

• Verizon 2025 Data Breach Investigations Report (DBIR) (Official Download Page)
• Tenable Blog: Verizon 2025 DBIR Collaboration - CVE Remediation Trends
• VERIS Framework (Vocabulary for Event Recording and Incident Sharing)
• CISA Known Exploited Vulnerabilities (KEV) Catalog