Bonus Episode with Special guest Alex Pinto | DBIR 2026

<p>In this special interview episode, <a href="https://www.linkedin.com/in/adrian-sanabria/" target="_blank" rel="noopener noreferer">Adrian</a> and <a href="https://www.linkedin.com/in/sieira/?skipRedirect=true" target="_blank" rel="noopener noreferer">Alexandre</a> sit down with <a href="https://www.linkedin.com/in/alexcpsec/" target="_blank" rel="ugc noopener noreferrer">Alex Pinto</a>, lead author of the Verizon Data Breach Investigations Report, to walk through the 2026 edition before the broader industry has fully digested it. </p><p><br></p><p>Pinto explains why the 2026 dataset, with 31,850 incidents and 22,624 confirmed breaches contributed by over 100 organizations in 145 countries — is the most statistically rigorous breach corpus in the industry.</p><p><br><a href="https://www.tenchisecurity.com/en?_gl=1*frc7uy*_ga*MTcwMjY3Mjk0Mi4xNzc2NzAzMTM2*_ga_Q6MBLVT4CZ*czE3NzkxMzg4NjIkbzgyJGcxJHQxNzc5MTQwNTQwJGo1MCRsMCRoMCRkVTViM29JR3Z5R19Ec29fbkFlb3NEOHMzNzczVkVsbUVUQQ.." target="_blank" rel="ugc noopener noreferrer">Tenchi Security</a> is a 2026 contributor, providing the survival-analysis dataset behind the report&#39;s new look at third-party MFA and cloud privilege exposures. Alex Sieira walks through what the curves actually mean: half of MFA findings get fixed in seven days, but 45% of cloud privilege management findings are still open a year after discovery.</p><p><br>The conversation digs into the headline shifts: vulnerability exploitation has now overtaken credential abuse as the most common initial access vector. Third-party involvement in breaches has climbed from 30% last year to 48% this year, and the median time to fully remediate CISA KEV findings slipped from 32 to 43 days.</p><p><br>will probably be the most-talked-about new section of the 2026 report: <em><strong>Verizon analyzed an anonymized dataset from Anthropic.</strong></em><strong> </strong>The data includes analysis of nearly 800 threat actors, maps their prompt activity to MITRE ATT&amp;CK techniques, and cross-references it against MITRE&#39;s software database. The DBIR folks immediately think to ask the data: “are attackers using LLMs for novel techniques, or for things every EDR already catches?”<br>The trio close out by debating Sieira&#39;s hypothesis that the metric to watch isn&#39;t total CVE volume — it&#39;s the percentage of vulnerabilities with reliable working exploits, which is the variable AI is most likely to move — and Pinto makes the case that vulnerability