The 2026 Verizon DBIR marks the first time in 19 years that vulnerability exploitation has overtaken stolen credentials as the leading breach initial access vector, driven by AI-accelerated exploitation tooling compressing patch grace periods. This finding has direct operational implications for every security program that relies on CVSS base scores as the primary patch prioritization signal or treats identity controls as its primary defensive layer.