As measured by the 2026 Verizon Data Breach Investigations Report, AI is raising the throughput of cyberattacks rather than the underlying capability of attackers, because AI-assisted intrusions overwhelmingly scale known techniques rather than generate novel ones; the more consequential 2026 shift is that vulnerability exploitation has overtaken stolen credentials as the leading initial-access vector, and together these redirect enterprise defensive priority toward patch velocity and identity hygiene over hunting novel AI-authored threats.

Anchored on the 2026 Verizon DBIR (published late May 2026), which draws in part on a collaboration covering 793 enforcement-actioned threat actors. Load-bearing figures from the report as reported: under 2.5% of observed techniques qualified as rare or novel; 44% of AI-assisted initial access was still phishing; vulnerability exploitation (around 31% of breaches) overtook stolen credentials as the leading initial-access vector for the first time; a large majority of privilege-escalation incidents involved no named CVE; shadow-AI use rose from 15% to 45% of workers (Verizon describes this as a fourfold rise in its data-loss dataset); third-party involvement in breaches climbed toward 48% of the total. Scope: a snapshot of attacker behaviour as measured in this report, NOT a claim that AI can never produce novel offensive capability; the defensive-priority inference (patch velocity + identity hygiene over novel-threat hunting) is editorial advisory built on the data. VERIFIED 2026-05-29: DBIR published 19 May 2026; vulnerability exploitation at 31% as the #1 initial-access vector (first time in 19 years), under 2.5% rare techniques, 44% of AI-assisted initial access still phishing, the 793-actor Anthropic collaboration (Mar 2025-Feb 2026), shadow-AI 15%->45% (fourfold), and third-party 48% all confirmed via the Verizon newsroom and PushSecurity/SpyCloud/SCWorld analyses. Canonical: verizon.com/business/resources/reports/dbir/. 90-day review cadence (27 Aug 2026). Trigger conditions to revisit before next cadence: (a) the 2027 DBIR or comparable incident data shows AI generating materially novel techniques at scale, which would move the claim toward Partial or Not holding; (b) stolen credentials retake the leading initial-access position, weakening the vulnerability-exploitation half of the claim; (c) a documented at-scale AI-native attack technique with no human-era analogue. Related published corpus: /approved-tool-unapproved-capability-shadow-ai/ (the shadow-AI discovery problem the 45% figure points at) and /owasp-agentic-ai-top-10-walkthrough/ (the agent-specific identity-hygiene controls).