Verizon has recently determined that exploiting vulnerabilities surpassed stolen credentials to become the number one data breach entry point in 2025, thanks to the use of AI by threat actors.
In the 19th edition of its annual Data Breach Investigations Report, the US operator stated software flaws rather than stolen passwords had become the dominant entry point. In a review of more than 31,000 incidents, Verizon found 31% started with vulnerability exploitation.
Verizon stated attackers are using AI to spot and exploit known vulnerabilities at machine speed, with the technology accelerating attacks from months to hours.
It also noted hackers are “demonstrably using GenAI to help at different stages of attack including targeting, initial access, and development of malware and other tools”.
“AI’s primary impact is currently operational: automating and scaling techniques defenders already know how to detect, not yet unlocking these novel or rare attack surfaces”.
Employees are also not waiting for IT approval before adopting AI tools.
Unapproved AI usage at work tripled from 15% to 45% of the workforce, making “shadow AI” the third most common source of non-malicious data leakage.
Third-party breaches rose 60% to account for nearly half of all incidents, a direct consequence of organisations outsourcing more critical functions to external vendors.
Meanwhile, AI bot crawlers are flooding the internet at a 21% month-on-month growth rate, dwarfing human-led traffic which was flat.
Daniel Lawson, SVP global solutions for Verizon Business, said although cyber threats are accelerating due to AI and rapid vulnerability exploitation, “the foundational principles of security and strong risk management remain the most effective defence”.
Verizon stated more than 22,000 of the 31,000 security incidents were data breaches and involved organisations in 145 countries.
Source: Mobile World Live
Image Credit: Stock Image
