The Verizon 2025 DBIR: Insights from Enzoic

Now in its eighteenth year running, the Verizon Data Breach Investigations Report (Verizon 2025 DBIR) continues to occupy its usual place at the forefront of cybersecurity research analysis and reporting. Covering a record 22,052 security incidents, it provides an unparalleled view of the cybersecurity climate that many researchers, security professionals, and businesses rely on to drive decision-making and cybersecurity practices. This year, Enzoic is proud to be an official contributor to the report, having provided data and analysis regarding the effects of infostealer malware on the compromised credential ecosystem.

A quick note: all following in-text citations and graphics/figures are from the 2025 DBIR unless otherwise noted.

Once More, From The Top: Credential Abuse in the Place of Honor/Shame

The very first report summary figure (DBIR pg 10) confirms that credentials are still the top initial access vector overall. The number of incidents involving credentials did decline slightly year-on-year. Unfortunately, while credential attacks decreased slightly, the exploitation of vulnerabilities for initial access saw a whopping 34% increase, partly due to the exploitation of edge device or VPN software vulnerabilities. This is a critical finding that should serve as a call to action for organizations of all sizes to secure these devices. Indeed, this first chart from the report lays out three pillars for a strong cybersecurity posture: secure your credentials, patch/update your devices, and educate your employees/users.

Understanding Credential Attacks: Verizon 2025 DBIR Data

At Enzoic, our research primarily concerns the role of compromised credentials in the threat landscape. An initial access vector is the first opportunity that threat actors exploit in perpetrating a cybercrime. Credentials are often likened to keys, and it’s easy to see how simple breaking into a house would be if you already have the keys. Credentials make their biggest showing in the Basic Web Application Attack (BWAA) pattern. This type of attack targets publicly accessible login pages. Threat actors may have a verified credential or may use automated scripts to guess credentials until they find a valid one. DBIR Figure 56 below shows how frequently these categories are used.

It would be hard to talk about BWAAs from 2024 without discussing the data breaches affecting Snowflake customers. Subsequent research showed that “approximately 80% of the accounts leveraged by the threat actor in this attack had prior credential exposure” (DBIR pg 16).

Examples of Snowflake customer account credentials found in infostealer data traded by threat actors. Source: Enzoic

At Enzoic, we process large amounts of data from infostealers, typically focused on credential extraction. One concerning finding was the rate of infections of enterprise devices. Evidence suggests 30% of the analyzed infections were on enterprise devices (DBIR pg 56).

Ransomware

Another fascinating finding was the co-occurrence of ransomware victimization and domains in infostealer logs. The report states that “54% of the victims had their domains show up in at least one infostealer log” (DBIR pg 57). This aligns with common sense, as credentials are an increasingly favored initial access vector in ransomware deployment.

“When discussing Ransomware, it is important to note that around 42% of breaches involve compromised credentials, an exploited vulnerability or the use of phishing.” – DBIR pg 40

This year, ransomware “accounts for 75% of breaches in [the System Intrusion] attack pattern” (DBIR pg 40).

MFA: One Size Fits Nobody

Public and organizational attitudes about multi-factor authentication (MFA) seem to range from ‘a useless pain in the neck’ to ‘once it’s enabled, we need never worry about security again.’ Neither of these perspectives is particularly accurate. MFA bypass is a risk that cannot be ignored. Let’s include the chart of Microsoft 365 MFA bypass attacks:

It's essential to provide authentication friction for critical services often targeted by fraud. This is also a use-case for compromised credential intelligence, where signal intelligence can alert on activity that may otherwise not constitute sufficient risk.

“…having [MFA] enabled should not make your detection and monitoring processes complacent.” DBIR pg 47

What Did I Miss in the Verizon 2025 DBIR?

It is always a challenge to summarize the DBIR. That said, not everyone has the time to dedicate to reading and data analysis. Here are a few other sections worth noting:

The Industry Breakdowns: Grouped by organization's industry for relevant data security insights.

Focused Analyses: Reviewing data breaches by organization size or type, especially regarding how badly malware and ransomware affect SMBs.

Regional Analyses: Security incidents by region across five global divisions.

Outlook for Cybersecurity Teams and Researchers

Last year we talked about financial motives reigning supreme for threat actors, but we see a notable increase in Espionage as a motive.

“We also saw significant growth in Espionage-motivated breaches in our analysis, which are now at 17%.” – DBIR pg 11

Outlook for Organizations and Users

Enzoic remains dedicated to helping organizations achieve strong credential security. Users need to improve password hygiene and organizations must incorporate credential monitoring, MFA, and user education against scamming and phishing. It’s crucial for organizations to take these threats seriously to minimize unnecessary risk and expense.