Two pieces of software caused 63.5% of vulnerability-based breaches. That is the year's real finding.

In March we argued that third-party risk has two shapes, weakness and concentration, and that assurance only addresses the first. This is the second shape, measured, and it is larger than we expected.

Published

December 16, 2025

Period covered

October 1, 2025 – December 31, 2025

Documentary cut-off

December 16, 2025

Executive perspective

Six conclusions that close the first year

1. 1

   The third party is now the primary attack path, not a secondary one

   35.5% of all breaches in 2024 originated from a third-party compromise, up 6.5 percentage points year over year, and the researchers call the figure conservative. More pointedly, 41.4% of ransomware attacks now begin through a third party. The supply chain is not a parallel risk to ransomware; it is the majority route into it.

2. 2

   Concentration, not supplier weakness, produced the year's largest single effect

   Two file transfer products accounted for 63.5% of vulnerability-based breaches. No questionnaire, audit or certification would have changed that outcome for any affected organisation, because the failure was not in their supplier's diligence. It was in everyone depending on the same software at once.

3. 3

   Exfiltration has become the default, not a variant

   Microsoft observed data collection in 80% of reactive engagements. In September we forecast that theft-only extortion would become the majority case. It is now the norm across incidents generally, whether extortion follows or not. The question has inverted: not whether an intrusion involved data theft, but whether you can establish that it did not.

4. 4

   The most basic identity attack still works, because the most basic control is still missing

   More than 97% of identity attacks are password spray or brute force, and modern multifactor authentication blocks over 99% of unauthorised access attempts. The gap between those two numbers is not a technology problem. It is a deployment problem, and closing it remains the highest-yield action available to most mid-market organisations.

5. 5

   Cloud is now a destruction target, not only a theft target

   Microsoft recorded an 87% increase in campaigns aimed at disrupting Azure customer environments. A destroyed cloud tenancy does not produce a disclosure event; it produces an outage the organisation cannot resolve from its own datacentre, because there is no datacentre.

6. 6

   Regional readings diverge sharply, and the divergence is informative

   ENISA reports phishing as the dominant EU intrusion vector at 60%, while global breach telemetry shows phishing declining for three years. Both are correct: ENISA counts recorded incidents dominated by public administration and hacktivist denial of service, global telemetry counts confirmed breaches. Adopt EU control frameworks; do not import EU threat priorities unadjusted.

The board agenda

Five questions your board should be able to answer this quarter

They follow directly from the findings above. The full edition carries, for each one, the evidence behind it and the prioritised action that answers it.

1. What software do our suppliers have in common, and which single product could reach us through more than one of them?

   Two exploits, 63.5% of vulnerability-based breaches.

2. Who owns the overlap between our ransomware plan and our third-party programme?

   41.4% of ransomware starts with a supplier.

3. How many accounts still lack multifactor authentication, and what is the date?

   97% of identity attacks are spray or brute force.

4. If our cloud tenancy were deliberately destroyed rather than breached, what is the plan?

   Cloud disruption campaigns up 87%.

5. Do we have a procedure for notifying regulators and customers about a breach that happened at a supplier?

   35.5% of breaches originate with a third party.