Verizon DBIR 2024: privileged access risk and what to do

The Verizon DBIR 2024 privileged access message is simple: attackers and insiders mostly got in and moved with access that already existed. The 2024 Data Breach Investigations Report found stolen credentials in 31% of breaches over ten years, a 180% rise in vulnerability exploitation, third parties involved in 15% of breaches and a separate pattern for insiders who misuse the rights they were given. This post sets out what each finding measures, what it means for privileged accounts, and which controls to review. It is for security leaders and engineers who want to use the report to set PAM priorities, without reading more into the numbers than Verizon does.

The Verizon Data Breach Investigations Report (DBIR) is an annual analysis of security incidents and confirmed data breaches contributed by Verizon and partner organisations, classifying each by actor, action, asset and attribute.

What did the Verizon 2024 DBIR analyse?

Verizon “analyzed 30,458 real-world security incidents, of which 10,626 were confirmed data breaches (a record high!), with victims spanning 94 countries” (2024 DBIR, page 5). Verizon’s release of 1 May 2024 describes this as the 17th edition and the incidents as analysed “in 2023”.

These are counts of cases in the dataset, not a census of every breach and not a probability for your organisation. Percentages depend on Verizon’s definitions and on what contributors shared. Read each figure below as “in the DBIR dataset”.

Finding	2024 DBIR figure	Where in the report	Privileged access question
Use of stolen credentials over 10 years	31% of breaches	Page 43	Which credentials would give an attacker admin rights today?
Stolen credentials as an initial action	Top action, 24%	Page 18	Do admin sign-ins need MFA and an approval?
Basic Web Application Attacks via stolen credentials	77% of that pattern	Page 43	Are admin consoles reachable with a password alone?
Exploitation of vulnerabilities as the way in	Up 180%	Pages 7 and 11	What can the exploited service’s account reach?
Time to remediate half of CISA KEV vulnerabilities	Around 55 days	Page 21	Who administers the exposed system while it is unpatched?
Breaches involving a third party	15%, up from 9%	Pages 8 and 13	Is vendor access named, time-bound and recorded?
Ransomware or extortion	32% of breaches	Page 7	Who can delete backups or change identity policy?
Human element (excluding malicious misuse)	68% of breaches	Page 8	Does the access workflow make the safe choice the easy one?
Privilege Misuse pattern	897 incidents, 854 with confirmed disclosure	Page 53	Would you see an insider using legitimate rights to take data?

What does the DBIR 2024 say about stolen credentials?

Credentials remain the most reused key in the dataset. The report states that “over the past 10 years, stolen credentials have appeared in almost one-third (31%) of breaches.” In 2024 the use of stolen credentials fell as a share of initial actions but “is still our top action at 24%”, just ahead of ransomware at 23%. In the Basic Web Application Attacks pattern, attackers got in by “the Use of stolen credentials (77%), Brute force (usually easily guessable passwords) (21%) or the Exploit vuln action (13%).”

For privileged accounts the implication is that a known password should never be enough. If an administrator’s password is phished or found in a dump, it should not open a production server or a cloud console on its own.

• Take passwords out of people’s hands. Store admin, service and shared credentials in a vault and inject them into the session through a proxy, so there is nothing for the user to leak. See credential vaulting.
• Rotate after use. A credential that changes when it is checked back in is worthless to anyone who copied it.
• Require MFA at the privileged entry point, not only at the corporate sign-in page.
• Remove standing rights. A stolen account with no admin rights by default gives an attacker little, which is the case for zero standing privileges.

Why does the 180% rise in vulnerability exploitation matter for privileged access?

The report found that exploitation of vulnerabilities “as the critical path to initiate a breach” almost tripled, a 180% increase, driven largely by MOVEit and similar zero-day vulnerabilities used by ransomware and extortion groups. Verizon’s release adds that exploitation accounted for 14% of all breaches. The report also found that it takes “around 55 days to remediate 50% of” critical CISA KEV vulnerabilities once patches are available.

PAM does not patch software. What it changes is what an attacker inherits after an exploit. If the compromised service runs as a local administrator, or if the server holds long-lived cloud keys, one exploit becomes wider access. Map each internet-facing system to the accounts on it, the rights those accounts hold, and the systems they can reach, then remove what is not needed while the patch is pending.

How should PAM address third-party and supply chain access?

Verizon introduced an expanded third-party metric in 2024 that includes partner infrastructure and “direct or indirect software supply chain issues.” It saw this “at 15% this year, a 68% increase” from 9% the previous year. Not all of these involve vendor logins; some are vulnerabilities in third-party software. But vendor remote access is the part a PAM programme directly controls.

The third-party access solution page describes how SWOT handles vendor sessions. In SWOT PAM, contractors can work in a browser tab with nothing to install, the proxy injects credentials so they never reach the vendor’s device, and grants end on their own when the window closes.

What does the DBIR say about insiders and privilege misuse?

Two findings concern internal actors. First, Internal actors were involved in 35% of breaches, up from 20%, though Verizon notes that “73% of those Internal actor breaches were in the Miscellaneous Errors pattern”, that is, mistakes rather than malice. Second, the Privilege Misuse pattern covers people abusing access they legitimately hold: 897 incidents, 854 with confirmed data disclosure, with internal actors in almost all of them and personal data the main target.

Verizon also changed how it counts the human element: the 68% figure now excludes malicious Privilege Misuse, and including it “would have brought the percentage to 76%.” Neither figure means administrators caused 68% of breaches; it covers errors and social engineering by anyone.

For PAM the lesson is that legitimate access needs watching too. Session recording, command logging and alerts on unusual use are how misuse of valid rights becomes visible. In SWOT PAM, PAMGuard scores commands and queries during a live session and can block a dangerous command, freeze input or end the session. For databases, SWOT DAM scores each identity from 0 to 100 against its own 30-day baseline, read from native audit trails.

What does ransomware and extortion mean for administrator accounts?

Ransomware and other extortion techniques were part of 32% of breaches, with pure extortion at 9% and ransomware at 23%. Ransomware was a top threat in 92% of industries. The report does not say what share used privileged credentials, so do not claim it.

What you can test is the recovery path. Check whether backup consoles, hypervisors, identity providers and security tools are administered by separate accounts, whether destructive actions such as deleting backups or audit trails need a second approval, and whether you can revoke all privileged sessions and rotate credentials quickly. In the cloud, SWOT Cloud PAM denies dangerous cloud API calls at its gateway before they reach the cloud, and a revoked grant stops working within 60 seconds.

Verizon DBIR 2024 privileged access review checklist

Use the findings as prompts, not a scoring formula. Each item produces evidence with an owner and a date.

1. Inventory privileged identities: human admins, service accounts, cloud roles and keys, vendor accounts and break-glass accounts, each with an owner.
2. List every credential that grants admin rights and is known to a person; vault it and set rotation after use.
3. Confirm MFA on every privileged entry point: SSH, RDP, database clients and cloud consoles.
4. Replace standing admin group membership with time-bound, approved grants on your highest-impact systems.
5. Map internet-facing systems to the accounts on them and what those accounts can reach.
6. Give every vendor engineer a named, time-limited, recorded route in; remove shared vendor logins.
7. Record privileged sessions and alert on high-risk commands and unusual activity by legitimate users.
8. Separate recovery authority (backups, identity, audit logs) from routine administration and test emergency revocation.

Next steps

The Verizon DBIR 2024 privileged access findings point to stolen credentials, unpatched exploits, third-party connections and misuse of legitimate rights as the paths to examine first. The report does not test controls, so use it to set the order of your review and measure the result in your own environment. See how SWOT PAM removes standing access and records every privileged session, or book a demo.