The Vulnerability Era: Why Your Next Breach Probably Won’t Start With a Stolen Password

There’s a quiet shift happening in how companies get broken into, and most security programs are still aimed at the wrong target.

For two decades, the standard breach story has been the same: someone clicks a phishing link, hands over credentials, and the attacker walks through the front door. Defenders built their entire playbook around that story — email filters, password policies, multi-factor authentication, annual phishing training. Those controls still matter. They just aren’t where the action is anymore.

According to Verizon’s 2026 Data Breach Investigations Report, 31% of breaches now start with the exploitation of a software vulnerability — a known, patchable weakness in a system the company was already running. That number has climbed steadily, and this year it overtook stolen credentials as the most common initial access vector. Stolen passwords dropped to second place. Phishing dropped to third.

For a small or mid-sized business owner, the practical takeaway is uncomfortable: the thing most likely to get you this year is not a clever email in someone’s inbox. It’s a forgotten VPN appliance, an unpatched firewall rule, or a content management system that hasn’t been updated since the Biden administration.

The SMB Reality Is Worse Than the Headline

Verizon’s overall numbers understate the risk for smaller organizations. The same report found that 88% of breaches at small and mid-sized businesses involved ransomware, compared to just 39% at large enterprises. Translation: when attackers pick on a small company, they’re almost always doing it to lock the place down and demand money. They aren’t interested in quiet espionage. They want cash, and they want it by Friday.

The financial asymmetry is brutal. The average breach for a company under 500 employees now costs around $3.31 million (per IBM’s 2024 Cost of a Data Breach report, still the most recent benchmark). About 40% of small businesses hit by a $100,000 incident never recover. The attackers know this. It’s why the small-firm ransomware business model works: the targets are soft, the payout pressure is enormous, and the perpetrators are often halfway around the world, beyond the reach of local law enforcement.

The Microsoft 365 Problem

Walk into almost any SMB and the technology stack looks roughly the same: Microsoft 365 for email and documents, a remote-access VPN, a cloud-hosted file share, maybe a managed firewall from a local MSP. That homogeneity is convenient for IT and convenient for attackers. They only have to learn the soft spots in a handful of products to reach hundreds of thousands of businesses.

The October 2026 Microsoft Digital Defense Report describes a phishing-as-a-service operation called RaccoonO365 that Microsoft and Cloudflare jointly disrupted earlier this year. The group sold subscription access to ready-made credential-harvesting kits targeting Microsoft 365 logins — meaning a would-be criminal didn’t need technical skill, just a credit card and a target list. The kit handled everything: lookalike domains, MFA bypass, inbox rules that hid security alerts from the victim. Investigators tied the operation to at least 145 million attempted attacks in a single twelve-month window.

That’s a single crew. They aren’t the only one.

The implication is that “secure your email” and “enforce MFA” remain important, but they’re no longer sufficient on their own. MFA-bypass techniques have been commoditized. Phishing kits now handle the bypass for the buyer. The marginal attacker is no longer deterred by a basic security hygiene program.

Where the New Front Door Is

The Verizon report’s emphasis on vulnerability exploitation lines up with what incident responders have been seeing for two years. Three categories account for the majority of vulnerability-driven breaches:

• **Edge devices.** VPN concentrators, firewalls, and remote-access gateways. These are exposed to the public internet by design, often run outdated firmware because nobody wants to touch the thing that handles the VPN, and frequently have default or shared administrator credentials. A handful of CVEs in widely deployed products have been exploited at scale since 2024.
• **Content management systems and web apps.** WordPress, Drupal, custom-built portals, and the long tail of plugins. SMBs in particular tend to run sites that nobody has touched in years. When a critical CVE drops, weeks can pass before anyone notices.
• **File transfer and collaboration tools.** The MOVEit, GoAnywhere, and similar breaches of 2023–2024 set the template, and the same pattern keeps repeating with smaller vendors. These tools sit on the network perimeter, handle sensitive data, and are notoriously hard to patch without downtime.

The common thread: systems that need to be reachable from the internet, that handle sensitive data, and that the organization has no real ability to take offline for maintenance.

What Actually Helps

The good news is that the new threat pattern has a well-understood defensive playbook. It’s just different from the one most SMBs are executing.

1. Asset inventory is the prerequisite. You can’t patch what you don’t know you have. A surprising number of breach investigations start with the discovery of a server nobody remembers standing up. Start with an authoritative list of every internet-facing system, who owns it, what software version it runs, and when it was last patched. If you don’t have that list, your patch management program is theater.

2. Patch for exploitability, not just severity. Not every CVE matters to your environment. The ones that do are the ones being actively exploited in the wild — CISA’s Known Exploited Vulnerabilities catalog is the cleanest reference. Build a 14-day-or-faster remediation cycle for anything on that list. Critical CVEs that aren’t yet being exploited can wait a bit longer, so your team doesn’t burn out chasing ghosts.

3. Get rid of the edge devices you don’t need. Every internet-exposed VPN, every forgotten RDP endpoint, every open management port is a potential entry. If a system doesn’t have a current business owner, take it off the network. The cleanest SMB breaches I’ve read about this year all involved an appliance the company had stopped using three years earlier.

4. Assume your email tenant will be probed. Set up phishing-resistant MFA — hardware keys, passkeys, or platform-bound authenticator apps. Disable legacy authentication protocols. Audit inbox rules quarterly. The RaccoonO365 takedown proves that commodity phishing kits will keep coming; the only durable defense is making the credentials worthless to an attacker who somehow gets them.

5. Have an incident response plan that fits your size. Verizon’s data shows only about a third of small businesses have any formal plan at all. You don’t need a 40-page document. You need three things: a list of who to call (legal, cyber insurance carrier, a pre-vetted IR firm), a list of where your critical data lives and how it gets restored, and a written decision framework for the ransom question — made before the crisis, not during it.

The Closing Argument

The 2026 threat landscape is the least forgiving one small businesses have ever faced, and the tools the attackers use are more accessible than at any point in the history of the industry. A person with a few hundred dollars and a weekend can rent access to a phishing empire capable of compromising Microsoft 365 tenants at scale. The same person can scan the entire internet for unpatched VPNs in under an hour.

The defense isn’t glamorous. It doesn’t involve buying a new product. It involves knowing what you have, patching it on a schedule that reflects how attackers actually operate, and being honest with yourself about which systems still need to be on the network.

The companies that came through 2025 intact mostly did so because somebody, somewhere, decided to do the boring work of running an accurate asset inventory and a real patch program. That’s the story. It’s not exciting. It’s the one that works.