2025 Verizon Data Breach Investigations Report

In 2024, the Verizon DBIR recorded over 10,000 confirmed data breaches—the highest ever. 68% involved human error, and 32% were tied to ransomware or extortion. These numbers show that threats are growing fast and becoming more targeted.

The DBIR is one of the most trusted cybersecurity reports in the world. CISOs, IT heads, and security teams use it every year to track attack trends, improve security training, and guide key decisions.

In this blog, we’ll look at what the 2025 Verizon Data Breach Investigations Report (DBIR) is expected to focus on—and why staying ahead of these trends is key to protecting your organization.

Why the 2025 Verizon DBIR Matters

The Verizon Data Breach Investigations Report is a leading source of breach intelligence used by cybersecurity professionals around the world. It analyzes thousands of real-world incidents each year and delivers data-driven insights that influence how organizations defend themselves against threats.

Security teams use the DBIR to benchmark performance, update security policies, and shape training based on the latest breach patterns. It’s especially useful for identifying risks specific to each industry.

For example, in the 2024 report, the healthcare sector reported 1,220 confirmed data breaches. 70% of those breaches came from internal actors, mainly due to errors like misdelivered information. The report also noted a sharp increase in Privilege Misuse, showing that insider threats are rising again after years of decline.

This level of insight helps healthcare organizations and others in high-risk industries know exactly where to focus their security efforts—and why ignoring internal risks is no longer an option.

Key Insights from the 2024 Verizon DBIR

The 2024 Verizon DBIR reveals how threat actors are adapting their methods and where organizations continue to fall short. From human error to zero-day exploits, the data offers a sharp view of today’s most pressing security gaps.

• 68% of breaches involved a human element—including errors, phishing, and social engineering. This excludes deliberate insider misuse, focusing on risks that security awareness can directly address.
• Ransomware and extortion were involved in 32% of breaches. Ransomware dropped to 23%, but pure extortion rose to 9%, showing a shift in attacker tactics. Together, these threats were present in 92% of industries.
• Exploitation of vulnerabilities increased by 180%, largely driven by zero-day attacks like MOVEit. Web applications were the primary access point.
• 15% of breaches involved third-party components, such as software supply chain weaknesses—up 68% from last year.
• 28% of breaches were caused by errors, like sending information to the wrong recipient or losing sensitive documents.
• Phishing remains a rapid risk. In 2023 simulations, 20% of users reported phishing attempts, while 11% reported after clicking. The median time to fall for a phishing email is under 60 seconds.

These patterns show why businesses need stronger Security Awareness Training, faster patch management, and more robust third-party risk controls. For a deeper look at how effective training reduces these risks, read Keepnet's article: How Security Awareness Training Reduces the Risk of Data Breaches and Security Incidents.

Comparison of the 2023 and 2024 Verizon DBIR Reports

The 2023 and 2024 Verizon DBIRs reveal major changes in how cyberattacks are carried out and how organizations are impacted. From the rise in total breaches to shifts in human error, ransomware tactics, and third-party risks, comparing both reports highlights exactly where threat actors are gaining ground—and where defenses are holding.

Table 1: Key Differences Between 2023 and 2024 Verizon DBIR Findings

One of the most important shifts is the drop in human element-related breaches—from 74% in 2023 to 68% in 2024. While still a dominant factor, this decline could reflect the positive impact of stronger security awareness training, better phishing simulations, and improved internal controls. However, errors such as misdelivery and lost data remain common, showing that user mistakes still create serious security gaps.

At the same time, breaches caused by third-party vulnerabilities and zero-day exploits have sharply increased. These trends show attackers are expanding their reach beyond direct targets, leveraging weak spots in supply chains and unpatched software. It’s a reminder that modern cybersecurity strategies must go beyond employee training—they must include vulnerability management, incident response planning, and third-party risk assessments.

The 2024 DBIR makes it clear: threat actors are adapting quickly, and defenders must keep pace by learning from year-over-year data shifts and adjusting security strategies accordingly.

Expected Key Themes in the 2025 DBIR

Based on the trends in the 2024 report, the 2025 Verizon DBIR is expected to focus on key threat areas that are rapidly evolving and increasingly critical for security teams.

Ransomware and Extortion Attacks

The DBIR will likely highlight a continued shift in ransomware tactics—from traditional encryption to data leak extortion. With ransomware present in 92% of industries in 2024, further growth is expected, especially in sectors with sensitive data. Organizations should prepare for more frequent and complex extortion threats, even without encryption.

Zero-Day Vulnerabilities and Exploits

After a 180% rise in vulnerability exploitation in 2024, the next report is expected to provide a deeper look into zero-day attacks like MOVEit. There will likely be more emphasis on the need for faster patching cycles, real-time detection, and automated vulnerability response.

The Human Element

We can expect updated data on phishing, misdelivery, and credential misuse, which continued to drive breaches in 2024. The report will likely reinforce the importance of ongoing Security Awareness Training to reduce errors and improve reporting behavior across all departments.

Industry-Specific Trends

The 2025 DBIR will likely expand its analysis by sector, including tailored threat patterns for healthcare, finance, education, and more. This reinforces the value of using tools like the Phishing Simulator and Quishing Simulator to prepare employees in high-risk industries.

Incident Response Insights

With threat actors moving faster, the 2025 report is expected to place greater focus on dwell time—how long attackers stay undetected—and the speed of incident detection and response. This aligns with the growing demand for tools like Incident Responder , which help teams detect and contain threats faster to minimize damage.

These expected themes suggest that the next DBIR will emphasize real-time defense, cross-industry insights, and a stronger push for human-centric risk management.

How to Prepare for the 2025 DBIR

To make the most of the upcoming 2025 Verizon DBIR, security teams should take proactive steps now:

• Join Verizon’s DBIR webinars to stay ahead of the latest findings and expert analysis. You can register here.
• Review the 2024 DBIR Report to understand breach patterns and how they’re expected to shift in 2025.
• Align your internal teams—including security, compliance, and awareness training leads—to ensure a coordinated response.
• Use tools like the Keepnet Human Risk Management Platform to benchmark your current risk posture and identify gaps before the next wave of threats hits.

What the 2025 DBIR Means for Your Security Strategy

The numbers in the Verizon DBIR aren’t just stats—they show where cyber threats are going. In 2024, breaches doubled, insider threats returned, and attackers leaned heavily on zero-day exploits and third-party weaknesses.

This tells us that attacks are getting faster, more targeted, and harder to detect. To keep up, security teams need to act now—not wait for the next incident.

That means:

• Improving incident response to catch threats early.
• Training employees to avoid common mistakes.
• Monitoring vendors and partners more closely.
• Using real data—like DBIR insights—to guide decisions.

The 2025 DBIR will be a key resource. If your team is prepared, it won’t just help you understand the threat landscape—it’ll help you stay ahead of it.

To build a long-term, people-focused defense, explore Keepnet’s guide on Security Behavior and Culture Program (SBCP).