Verizon’s DBIR Shows Third-Party Breaches Scaling Upstream
Verizon’s DBIR shows third-party risk has become a high-speed breach vector, pushing security teams toward continuous vendor, software, and identity control.
What is this trend?
Third-party breaches are accelerating upstream as attackers chain flaws in widely used vendors, software, firmware, and embedded components before enterprises can contain them.
- Third-party breaches rose 60% YoY and now account for nearly half of all breaches.
- Attackers are chaining flaws in common vendors like Ivanti, Palo Alto, and Cisco.
- Embedded components in telecom and IoT supply chains are widening exposure.
- Regulators are pushing continuous third-party oversight and audit-grade controls.
- Value is shifting to platforms that unify exposure, identity, and supply-chain governance.
What’s the latest?
Verizon’s 2026 DBIR shows the third-party problem has moved up another gear: breaches involving third parties rose 60% year over year and now make up 48% of all breaches.
How it developed
- Runtime Governance Tightens, Hack-for-Hire Networks Face Export Scrutiny, and Third-Party Risk Turns Remedial
- Third-Party Risk Becomes a Remediation Workflow
- Agent Access Tightens, Offense Accelerates, Sovereignty Hardens, and PQC Becomes Procurement Deadline
- Managed Security and Third-Party Risk Automation
Go deeper
Curated long-form picks on this trend — podcasts, videos, and analysis, by vantage.
If you operate in this industry
Supply chain risk: Strategies to manage third-party exposure
An explainer on managing third-party exposure as upstream dependencies create broader security and resilience risks.
TechTarget · News
Read →
Govern Standing Privileges and Third‑Party Risk in Security Tools
Analysis on Substack: how third-party security platform breaches grant upstream access, citing DBIR scaling trends.
CISO Talk by James Azar · Substack
Read →Vicarius finds 79% hit by known vulnerability incidents
News analysis interview with Roi Cohen on 79% known-vuln incidents and remediation “ticket trap” workflow gaps.
IT Brief UK · News
Read →If you sell into this industry
Neglected Infrastructure Fuels Cyber Disruption and AI‑Accelerated Threats
A cybersecurity analysis of overlooked infrastructure and vendor dependencies as upstream attack paths.
CISO Talk by James Azar · Substack
Read →Infrastructure Trust Risks Prompt Urgent Patch and Automation Measures
How-to Substack post on infrastructure trust risks, mapping upstream third-party breaches and zero-day exploitation.
CISO Talk by James Azar · Substack
Read →
Supply‑Chain Weaknesses Undermine Visibility and Response
Analysis on Substack linking DBIR-style third-party breach scaling to hidden open-source/AI supply-chain dependencies.
☁️ The Cloud Security Guy 🤖 · Substack
Read →If you invest in this industry
Third-party data breaches rose 60% in a year. Most vendor reviews still happen once.
News explainer on Verizon’s DBIR: third-party breaches up 60%, and why static vendor reviews miss risks.
Lee News Central · News
Read →
Post-Breach Forensics Isn't Enough For Software Supply Chain Security
News analysis featuring Javed Hasan on why post-breach forensics falls short as third-party breaches scale up.
Forbes · News
Read →NTT DATA: Supply Chains Are Manufacturing's Cyber Risk
News analysis featuring Sheetal Mehta on how third-party supply-chain breaches are scaling upstream.
Manufacturing Digital · News
Read →