CVE exploitation nearly tripled in 2023, Verizon finds

In 2023, the exploitation of software vulnerabilities nearly tripled as an initial access vector for cyber breaches, accentuated by incidents like the MOVEit breach, according to Verizon's Data Breach Investigations Report. Ransomware attacks increasingly leveraged zero-day vulnerabilities, with a third of all breaches involving extortion, notably via Clop ransomware's exploitation of MOVEit. The report further indicated a 68% increase in breaches involving third parties, underscoring the growing vulnerabilities within software and supply chains. The findings emphasize the urgent need for enterprises to improve software vulnerability remediation, which takes an average of 55 days for half of critical vulnerabilities, and enhance cybersecurity education among workers. The report, analyzing a record 30,458 security incidents and 10,626 confirmed breaches, highlighted the significant role of human error and social engineering in breaches, demonstrating the critical need for comprehensive cybersecurity strategies that include both technological and human elements.

Opens on Cybersecurity Dive