Running a security practice means staying ahead of what your clients don’t know to ask about. The 2026 Verizon Data Breach Investigations Report surfaces three findings that every service provider should be building client conversations around: AI governance has become a real data loss problem, third-party breach involvement jumped 60% year over year, and vulnerability remediation is falling further behind despite more effort.
Based on analysis of more than 22,000 breaches, the report makes clear that all three require a structured, ongoing response, and that most organizations are not there yet.
AI Governance: The Security Gap Nobody Budgeted For
The 2026 DBIR highlights that generative AI adoption has outpaced almost every organization’s ability to govern it. 45% of employees are now considered regular users of AI on their corporate devices, up from 15% just one year ago, and that tripling of usage happened without a matching investment in policy, controls, or visibility.
The data on what is flowing out of organizations into these systems is the part that should concern every service provider. Source code is the most common type of data being submitted to external AI models, by a wide margin, followed by images and structured data. In 3.2% of DLP events flagged in the report, researchers found technical documentation and internal research being uploaded to unauthorized AI systems, meaning proprietary knowledge (the kind organizations spend years building) is walking out the door through a tool most security teams have barely started to govern.
Shadow AI is now the third most common non-malicious insider action detected in DLP datasets, a fourfold increase from the prior year, and 67% of AI platform users are accessing those systems through personal accounts on corporate devices. The average company also has more than 15% of its users running unauthorized AI browser extensions that collect and retain browsing context, including content from internal sites.
The DBIR’s position is clear: just because a new tool is available does not mean organizations should abandon decades of data governance principles. Your clients need policies that define which AI tools are sanctioned, what data can and cannot be submitted to external models, and how violations are detected and managed. Most of them don’t have that in place, and in the absence of a framework, employees will keep making their own decisions about what is acceptable to share.
For service providers, this gap is a concrete service opportunity. An AI acceptable-use policy tied to access controls, DLP monitoring, and employee education is not a heavy lift to deliver, but it is a meaningful one for clients trying to get ahead of this before it becomes a breach notification exercise.
Third-Party Breaches: Your Clients Are the Target, Even When Their Vendor Is the Entry Point
Breaches involving third-party involvement increased 60% from the prior year, now reaching 48% of all breaches in the DBIR dataset. That figure deserves a moment: nearly half of all breaches analyzed now touch a vendor relationship somewhere in the chain, which means that even organizations doing everything right internally are absorbing significant risk through the tools and partners they depend on.
The 2026 DBIR identifies three distinct archetypes for how these breaches unfold. The first involves a vulnerability in a vendor product that creates the initial access vector into a client’s environment. The second involves a vendor that hosts client data getting compromised directly, with credentials to those vendor environments being stolen and used against them, much as happened in the Snowflake-related campaigns documented in last year’s report. The third involves a vendor with direct network connectivity to a client’s environment, where attackers move laterally from the vendor into the organization’s own systems once they have a foothold.
What makes this especially relevant for managed service providers is that you sit in exactly that third category for every client you serve. Your tools, your credentials, and your remote access represent a vector if not properly secured, and clients who rely on you also carry exposure to the first two archetypes through every SaaS platform, cloud service, and software product in their own stack. This is not a hypothetical concern: it is baked into the structure of how modern IT environments operate.
The remediation data reinforces how slowly organizations are closing these gaps. For weak passwords and permission misconfigurations in third-party cloud environments, the time to resolve half of all flagged findings was nearly eight months. Only 23% of third-party organizations fully remediated missing or improperly configured MFA on their cloud accounts, and the DBIR found that 37% of organizations had an admin account with MFA disabled on an infrastructure-as-a-service offering. These are not edge cases — they are widespread, persistent exposures that attackers are actively exploiting.
The fundamentals the report recommends come down to strong authentication, least-privilege enforcement, proper credential hygiene, and visibility into what access vendors actually have. For clients who have not gone through a formal third-party risk review, and most small and mid-market organizations have not, this is the year to start.
Vulnerability Management: The Gap Is Getting Worse, and It Is Not About Effort
Exploitation of vulnerabilities is now the most common initial access vector in breaches, reaching 31% of cases, up from 20% the prior year. That represents a 55% increase and pushes it past credential abuse to the top position for the first time. That shift alone would be noteworthy, but the underlying vulnerability management data makes the picture harder to read.
Only 26% of critical vulnerabilities on the CISA Known Exploited Vulnerabilities list were fully remediated in 2025, down from 38% the year before, while the median time to full remediation climbed from 32 days to 43 days. The average organization also had 50% more KEV vulnerabilities to address in 2025 than it did in 2024, which helps explain why the remediation numbers moved in the wrong direction despite security teams broadly investing more effort into patching.
What the DBIR makes clear is that falling behind is no longer a sign that an organization is not trying. It is increasingly a structural condition of the threat landscape. Between 60% and 70% of KEV vulnerabilities remain open at the seven-day mark regardless of organizational maturity, and that rate has barely moved despite years of additional tooling investment and regulatory pressure.
The volume flowing through patching pipelines has simply grown faster than capacity. Even the most proactive organizations are feeling it: the share of vulnerabilities remediated before their inclusion in the CISA KEV list dropped from 17% in 2024 to 12% in 2025, a sign that the organizations with the most mature processes are also being squeezed.
The implication for service providers is that the conversation with clients should shift from whether they are patching to how they are deciding what to patch. Organizations that manage this best aren’t trying to address everything simultaneously: they are making disciplined decisions about which vulnerabilities to prioritize based on exploit status, business impact, and network exposure, and they are tracking that prioritization against a consistent framework over time. Security programs with risk-prioritized remediation roadmaps and regular posture reviews give clients both better outcomes and better visibility into where they actually stand.
The Common Thread
AI governance, third-party risk, and vulnerability management are different problems with one thing in common: they all require an ongoing security program to manage, not a one-time project to solve. A policy written this quarter becomes outdated when the threat landscape shifts. A vendor risk assessment from 18 months ago does not reflect the tools added to the stack since then. A patching review done on an annual cycle does not match the pace at which new exploits are being weaponized.
That is precisely the gap Cynomi is built to close. Our platform gives service providers a structured way to run continuous security programs across their entire client portfolio, covering AI governance policies, third-party risk management, and risk-prioritized remediation roadmaps in a single system. Instead of managing each client’s posture in isolation, Cynomi makes it possible to standardize how you assess, prioritize, and report on risk at scale, without adding headcount.
The 2026 DBIR gives you the evidence base for these conversations, and Cynomi gives you the operational infrastructure to act on them. If you are looking to turn these findings into a repeatable service offering, book a demo to see how other MSPs and MSSPs are doing it.
Table of contents
