Verizon DBIR (Data Breach Investigations Report)

The 2024 Data Breach Investigations Report, the 17th edition, analyzed 30,458 security incidents, of which 10,626 were confirmed data breaches. Two numbers made the rounds in underwriting meetings. Exploitation of vulnerabilities as the initial access vector almost tripled (up 180%), driven by the Cl0p campaign against MOVEit. And 68% of breaches involved a non-malicious human element: a click on a booby-trapped link or a misconfiguration. The DBIR is Verizon's annual report on data breaches, built from its own incident response caseload and from dozens of contributors (law enforcement, CERTs, security vendors). Each case is coded under the VERIS framework: actor, action, asset affected, attribute compromised. The 2025 edition, the 18th, covered 22,052 incidents and 12,195 breaches. Third-party involvement doubled to 30% of breaches, ransomware showed up in 44% of breaches, the median ransom paid was $115,000, and 64% of victims did not pay. For an underwriter, the report is a frequency baseline by attack vector: what share of breaches starts with a stolen credential, an exposed vulnerability, an email. Cyber applications follow the same order of priority, and the rise in third-party breaches feeds the questions about vendors that handle data. The report has blind spots, since it counts what its contributors see, and a set of investigation files says little about an insured portfolio; it gives no usable loss amounts. Not to be confused with the IBM and Ponemon Institute Cost of a Data Breach Report, which puts a price on the average breach. The DBIR measures how often breaches happen and how attackers get in.