No More Defaults: The DBIR’s Warning to the IoT Industry

Verizon’s annual Data Breach Investigations Report (DBIR) is a bellwether of the latest cybersecurity threats. In line with the adage that “the only constant is change,” the 2026 edition documents numerous trends and vulnerabilities with IoT security implications. Most critically, it underscores that threat actors are increasingly abusing internet-facing systems and weakly governed environments, the exact risk profile that many IoT deployments unintentionally create.

Internet-Facing Exposure Risk

The DBIR found that software vulnerabilities are now the top initial access path in breaches. Attackers are shifting from social engineering campaigns that trick people into granting system access to exploiting existing exposures. If connected devices are reachable from the public internet, they can easily become the first foothold attackers use to move into more sensitive systems. This makes securing edge devices, sensors, and other IoT gateways crucial.

Companies should immediately audit all connected devices, identify which are internet-facing, disable unused services, and remove public access where possible. In scenarios where devices require connection, enforcing strong authentication and restricting administrative access can help tighten security.

Growing Patch Lag

Patch lag has long been an IoT security headache, and the DBIR reinforces that the pain isn’t going anywhere. Remediation still lags behind exploitation, with the median time to fully address known vulnerabilities rising to 43 days. This is almost two weeks more than 2025’s average resolution time!

This upward trajectory is especially concerning for the IoT sector, where firmware updates, device uptime requirements, and vendor maintenance processes often slow patching. While it’s impossible to circumvent all of these issues, a risk-based patching program can address the most pressing. These initiatives prioritize externally exploitable vulnerabilities, actively used flaws, and the devices closest to critical operations.

Third-Party Security

Third-party involvement is a growing risk factor for breaches. Device manufacturers, integrators, MSPs, and cloud platforms all expand the number of systems, credentials, and update paths, with any compromise in the chain introducing risk to the IoT environment. Mitigating these threats is a complicated process, but an important first step is making vendor governance a security issue, rather than a procurement responsibility.

This allows companies to determine which vendors can access which devices and telemetry and enforce least-privilege access for third-party accounts. Regularly auditing the environment to identify and remove unneeded vendor access is also critical. Finally, organizations should review Software Bill of Materials (SBOMs) to understand interdependencies and eliminate security blind spots.

Mobile and IoT Overlap

The DBIR found that hackers are increasingly targeting mobile phones, warning that unmanaged personal devices “represent a risky gap in your visibility.” This statement also applies to many IoT environments, as they feature the same blend of users, applications, administrative tools, and operating systems found in BYOD. In these scenarios, visibility drops and enforcement becomes inconsistent, opening up a pathway for hackers to exploit. Companies should heed this warning and ensure mobile and IoT are effectively managed to reduce these governance gaps.

Credential Abuse Remains

Across the breach chain, credential abuse remains the most common action at 39%. This “attacker favorite,” as the DBIR puts it, is even more attractive in the IoT sector as many connected devices still rely on default, shared, or weak administrative credentials. Companies should immediately replace vendor passwords upon activation and enforce unique ones for every device and account.

According to the DBIR, people are four times more likely to use a credential exposed on the Dark Web than a weak one. As such, when devising IoT password policies, organizations should adopt NIST’s guidance and focus on exposure rather than complexity. This means replacing archaic rules that mandate a mix of special symbols with threat intelligence on the latest exposure data.

Focus on the Basics

The 2026 DBIR acknowledges the threat landscape’s continuous evolution, but stresses “…the importance of the fundamentals of cybersecurity as the best way to brave all of this change.” The considerations outlined can help IoT companies build a solid foundation primed to withstand the challenges already shaping the 2027 report.