Verizon: How enterprises can close the access control modernization gap

Credential-Based Attacks Dominate as Cybercriminals Exploit Identity Vulnerabilities

The 2025 Verizon Data Breach Investigations Report reveals a stark shift in cyberattack tactics: 88% of basic web application breaches now involve stolen credentials, often serving as the sole entry point for attackers. This trend underscores a critical weakness in enterprise security identity has become the primary attack surface, with legacy access controls failing to keep pace.

Human behavior remains a key enabler. 63% of employees admit to bypassing privileged access controls to avoid cumbersome authentication processes, highlighting how high-friction security measures inadvertently create workarounds that attackers exploit. Despite recognizing the risks, many organizations delay modernizing access systems due to concerns over cost and operational disruption.

Why Legacy Credentials Are a Prime Target

Attackers favor credential-based breaches because they provide stealthy, low-effort access to sensitive systems. Common attack vectors include:

• Infostealer malware and phishing/social engineering to harvest credentials.
• Cloning or theft of low-security proximity cards, which grant physical access to facilities, shared workstations, and printers escalating into broader network breaches.
• Unattended endpoints, where stolen credentials enable lateral movement without triggering security alerts.

Modern Solutions Exist but Adoption Lags

Advancements in access control technology offer stronger protections, yet many organizations hesitate to adopt them:

• Mobile credentials leverage encrypted, device-bound authentication, making cloning nearly impossible while improving user convenience.
• FIDO authentication eliminates phishable passwords by using cryptographic keys stored on user devices, paired with biometrics or PINs aligning with Zero Trust principles.
• Dual-technology readers allow gradual migration from legacy systems, reducing disruption during upgrades.

Despite these options, misconceptions about modernization costs and complexity persist, leaving organizations exposed.

A Phased Approach to Reducing Risk

To bridge the gap between security needs and operational realities, experts recommend three key strategies:

1. Assess the Current Environment
   Conduct a comprehensive audit of physical and logical access controls to identify high-risk vulnerabilities. For example, proximity cards used for single sign-on (SSO) pose a greater threat than those limited to door access, due to their broader attack surface.

2. Align Stakeholders on a Phased Rollout
   Secure buy-in from physical security, IT, and cybersecurity teams to prioritize upgrades. Deploying dual-technology readers that support both legacy and modern credentials allows for incremental adoption while minimizing disruption.

3. Prioritize Employee Experience
   Pilot new solutions with small user groups, focusing on streamlined authentication (e.g., mobile credentials for doors, workstations, and SSO). Gather feedback on usability and vendor support to refine the rollout.

The Cost of Inaction

With the average data breach costing $4.4 million, delaying access control modernization is a growing liability. As attackers refine credential-based tactics, organizations clinging to outdated systems face unnecessary exposure while phased, strategic upgrades can reduce risk without derailing operations. The shift to modern identity security is no longer optional; it’s a necessity for defending against evolving threats.

Source: https://www.cybersecurity-insiders.com/how-enterprises-can-close-the-access-control-modernization-gap/

Verizon cybersecurity rating report: https://www.rankiteo.com/company/verizon

"id": "VER1772112429",
"linkid": "verizon",
"type": "Breach",
"date": "2/2026",
"severity": "60",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'type': 'Enterprise Organizations'}],
 'attack_vector': ['Stolen Credentials',
                   'Phishing/Social Engineering',
                   'Infostealer Malware',
                   'Proximity Card Theft',
                   'Unattended Endpoints'],
 'data_breach': {'personally_identifiable_information': 'Potential'},
 'date_publicly_disclosed': '2025',
 'description': 'The 2025 Verizon Data Breach Investigations Report reveals '
                'that 88% of basic web application breaches now involve stolen '
                'credentials, often serving as the sole entry point for '
                'attackers. This trend highlights identity as the primary '
                'attack surface, with legacy access controls failing to keep '
                'pace. Human behavior, such as employees bypassing privileged '
                'access controls, further exacerbates the risk. Attackers '
                'favor credential-based breaches for stealthy access, using '
                'infostealer malware, phishing, and proximity card theft. '
                'Modern solutions like mobile credentials, FIDO '
                'authentication, and dual-technology readers exist but '
                'adoption lags due to misconceptions about cost and '
                'complexity. A phased approach to modernization is recommended '
                'to reduce risk.',
 'impact': {'financial_loss': '$4.4 million (average data breach cost)',
            'identity_theft_risk': 'High',
            'operational_impact': 'Lateral Movement in Networks, Unauthorized '
                                  'Access',
            'systems_affected': ['Web Applications',
                                 'Physical Access Systems',
                                 'Shared Workstations',
                                 'Printers']},
 'lessons_learned': 'Identity has become the primary attack surface, and '
                    'legacy access controls are insufficient. Human behavior, '
                    'such as bypassing security measures, increases risk. '
                    'Modern solutions like mobile credentials and FIDO '
                    'authentication exist but require phased adoption to '
                    'minimize disruption.',
 'motivation': 'Financial Gain, Data Theft',
 'post_incident_analysis': {'corrective_actions': ['Adopt Mobile Credentials',
                                                   'Implement FIDO '
                                                   'Authentication',
                                                   'Upgrade to Dual-Technology '
                                                   'Readers',
                                                   'Phased Rollout of Modern '
                                                   'Access Controls'],
                            'root_causes': ['Legacy Access Controls',
                                            'Human Behavior (Bypassing '
                                            'Security Measures)',
                                            'Lack of Modern Authentication '
                                            'Solutions']},
 'recommendations': ['Conduct a comprehensive audit of physical and logical '
                     'access controls to identify high-risk vulnerabilities.',
                     'Secure buy-in from physical security, IT, and '
                     'cybersecurity teams for a phased rollout of modern '
                     'access controls.',
                     'Prioritize employee experience by piloting new solutions '
                     'with small user groups and gathering feedback.',
                     'Deploy dual-technology readers to support both legacy '
                     'and modern credentials for incremental adoption.',
                     'Align access control upgrades with Zero Trust '
                     'principles.'],
 'references': [{'date_accessed': '2025',
                 'source': 'Verizon Data Breach Investigations Report'}],
 'response': {'remediation_measures': ['Mobile Credentials',
                                       'FIDO Authentication',
                                       'Dual-Technology Readers']},
 'title': 'Credential-Based Attacks Dominate as Cybercriminals Exploit '
          'Identity Vulnerabilities',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Legacy Access Controls, Identity Vulnerabilities'}