No More Defaults: The DBIR’s Warning to the IoT Industry Michael GreeneMichael Greene Verizon’s annual Data Breach Investigations Report (DBIR) is a bellwether of the latest cybersecurity threats. In line with the adage that “the only constant is change,” the 2026 edition documents numerous trends and vulnerabilities with IoT security implications. Most critically, it underscores that threat actors are increasingly abusing internet-facing systems and weakly governed environments, the exact risk profile that many IoT deployments unintentionally create. The DBIR found that software vulnerabilities are now the top initial access path in breaches. Attackers are shifting from social engineering campaigns that trick people into granting system access to exploiting existing exposures. If connected devices are reachable from the public internet, they can easily become the first foothold attackers use to move into more sensitive systems. This makes securing edge devices, sensors, and other IoT gateways crucial. Companies should immediately audit all connected devices, identify which are internet-facing, disable unused services, and remove public access where possible. In scenarios where devices require connection, enforcing strong authentication and restricting administrative access can help tighten security. Patch lag has long been an IoT security headache, and the DBIR reinforces that the pain isn’t going anywhere. Remediation still lags behind exploitation, with the median time to fully address known vulnerabilities rising to 43 days. This is almost two weeks more than 2025’s average resolution time! This upward trajectory is especially concerning for the IoT sector, where firmware updates, device uptime requirements, and vendor maintenance processes often slow patching. While it’s impossible to circumvent all of these issues, a risk-based patching program can address the most pressing. These initiatives prioritize externally exploitable vulnerabilities, actively used flaws, and the devices closest to critical operations. Third-party involvement is a growing risk factor for breaches. Device manufacturers, integrators, MSPs,