Verizon has published the 19th edition of its Data Breach Investigations Report (DBIR), based on more than 31,000 security incidents recorded between October 2024 and November 2025 across 145 countries. Several figures deserve a careful read by small and mid-sized companies, because they point at a plain conclusion: the most common weakness is not the absence of expensive technology.
Four numbers worth noting
- Ransomware was involved in 48% of analysed breaches, up from 44% the year before. This is no longer a large-enterprise problem.
- 69% of victims did not pay the ransom. The share keeps rising — a sign that companies with usable backups do not need to negotiate.
- Exploitation of vulnerabilities accounted for 31% of breaches, while credential abuse fell to 13%. More worrying: only 26% of critical vulnerabilities in the CISA Known Exploited Vulnerabilities catalogue were fully remediated during 2025, and the median time to remediate rose to 43 days.
- Third parties featured in 48% of breaches, and supply-chain-related incidents rose by 60%. Software vendors, accounting partners and logistics providers are all a way in.
One more figure to sit with: the human element was involved in 62% of breaches. And on AI, the report notes that 67% of users accessing AI services on corporate devices did so with non-corporate accounts — meaning company data is moving through accounts the company does not control.
What this means for a company of 50–300 people
Read as actions rather than statistics, the four numbers lead to three conclusions.
First, backups are the most effective anti-ransomware measure — not an expensive firewall. The condition is that the backup sits beyond the reach of the main system administrator account, and that a restore has actually been tested at least once. A backup never restored is a belief, not a plan.
Second, patching is routine work, not a project. The 43-day median in the report comes from large organisations with dedicated security teams. A company without one needs something simpler: one maintenance window per month for servers, libraries and edge devices, prioritising whatever is exposed to the internet.
Third, your vendors are part of your attack surface. If a partner holds a VPN account or system access, treat it like an employee account: limited scope, an expiry date, and revocation when the contract ends.
Five things to do this month
- List what is exposed to the internet: web servers, VPN, cameras, NAS devices. Turn off what is not needed.
- Enable two-factor authentication for email, VPN and administrator accounts.
- Check the backups: schedule, location, and one timed restore test.
- Review the account list: leavers, shared accounts, service accounts whose password nobody remembers.
- Set an AI rule: which tools staff may use, and what data must never be pasted into them.
Most incidents do not start with sophisticated technique. They start with something ordinary: a postponed patch, an account never revoked, a backup nobody has tried to restore.
Sources
- Verizon — 2026 Data Breach Investigations Report
- Help Net Security — Lessons for organizations from the Verizon 2026 DBIR
Figures are taken from the DBIR 2026 and the Help Net Security summary; the commentary and recommendations are NinePlus's own.
