05/19/2026
For the 8th consecutive year, Apura is among the contributors to the Verizon Data Breach Investigations Report. The DBIR 2026 is out.
Few institutions in this industry held their bar that long. The DBIR did. Operational evidence, real cases, real investigations behind every data point. The contributor list doesn't get padded. A small number of CTI and DFIR companies worldwide make it. Fewer still from the Global South. Apura is there again, built from Brazil, with clients across multiple continents and a partner network delivering services and expertise on the ground in multiple sectors and cultures.
Apura was founded by professionals whose first incident response work goes back more than three decades. That continuity shaped how the company operates today as a regional leader in Threat Intelligence and Anti-Fraud SaaS. The position only holds up because clients keep renewing and partners keep delivering. Anything else is a slide.
A few numbers from the 2026 edition worth pausing on:
• Vulnerability exploitation took the top spot as initial access vector, 31% of breaches. Credential abuse moved to second.
• Ransomware appears in 48% of analyzed breaches.
• Third-party related breaches grew 60% year over year. Supply chain risk stopped being a buzzword some time ago.
• Generative AI is operational on the attacker side. Reconnaissance, initial access, malware development. The use case is here.
• Only 26% of critical vulnerabilities got fully remediated. Median time to fix climbed to 43 days.
Speed and scale shifted. The fundamentals stayed put. Visibility, continuous intelligence, vulnerability management, third-party monitoring, response capability. Same list as a decade ago. Ex*****on is what separates serious work from theater.
Thanks to Verizon Business and to everyone in the contributor community. The room where evidence drives the conversation is the room worth showing up to.