Great news: Verizon has released its 2025 Data Breach Investigations Report (DBIR). And just like the previous 17 iterations, this year’s report is jam-packed with valuable cybersecurity insights.
What sort of security breaches are most common? What’s creating vulnerabilities? And which specific areas are threat actors exploiting? Verizon analyzed 22,052 security incidents (across 139 countries) to answer those questions.
For Intelisys Sales Partners, the DBIR is an invaluable resource. Not only does it show you which security concerns are most pressing for your customers, but it also gives you talking points for discovery conversations.
Below, we’ll highlight the most meaningful findings from the 2025 DBIR – and explain how these insights can help you deliver for customers.
The DBIR as a Sales Tool
As Derek Boxdell, Verizon’s Senior Director of Cybersecurity Sales, explains, the DBIR:
“isn’t just data; it’s a sales tool. The single most important insight to convey to customers is that cybersecurity is now a business risk conversation, not a technical one. Partners who lead with risk, who help customers understand their exposure, what it could cost, and how they can quantify the value of protection stand out.”
“Verizon’s solutions like MxDR, Identity & Access Management, and risk quantification services are built to answer the real questions boards and CFOs are asking: Are we doing enough? Is it working? And how do we know? Use the DBIR briefing as an opening to elevate the conversation… then follow with a solution that directly maps to risk reduction and outcome delivery.”
2025 DBIR – Three Key Findings
The 2025 DBIR offers 115 pages of data, from general trends to regional and industry-specific insights. Should you look at all of it? Honestly, it wouldn’t hurt – but for now, we’ve pulled out 3 key takeaways that will definitely enhance your conversations with customers.
#1 – More “Third Parties” Are Involved in Breaches
For years, the percentage of security breaches involving “third parties” has been increasing – and in 2024, it reached an astonishing 30%. This figure is twice as high as it was the previous year, when third parties were involved in just 15% of breaches.
This danger is commonly referred to as “vendor risk.” Vulnerable third parties can include:
- SaaS applications that host company data
- Private Cloud and Public Cloud services that host company servers and data
- MSPs that provide support services and have access to company data
Among the data breaches with third-party involvement, 81% involved “system intrusion,” and several notable incidents involved credential reuse in a third-party environment.
In light of these statistics, Intelisys Sales Partners should remind organizations that, when they partner with a third party, they have to consider the third party’s security limitations. It isn’t always easy. As Verizon states in the DBIR, “Managing credentials will be harder in an environment you don’t control.” But with the right strategy, you can limit the risk.
Here’s a three-pronged approach for addressing third-party vulnerabilities:
- Risk Assessment. Identify the critical third parties an organization might invite into their enterprise environment. Then, determine (a) how much of a risk they pose and (b) how much risk the organization is willing to accept. If the third-party uses security measures like mandatory multifactor authentication (MFA), it lowers the risk of a breach.
- Contractual accountability. Third parties should be held responsible when they create undue risks in enterprise environments.
- Independent security assessments. It’s better to partner with third parties that maintain a cybersecurity certification like SOC II Type 2 or ISO 27000, and that conduct their own penetration testing (and share the results with customers).
Ultimately, what happens on other people’s watch is always difficult to control – but organizations can reduce risk by taking the steps above.
#2 – The Use of AI Is Producing Vulnerabilities
Data from the 2025 DBIR points to a significant emerging threat: corporate-sensitive data leakage through generative AI programs.
According to the report, 15% of employees regularly access generative AI on their corporate devices. Of those employees, 72% accessed the AI platforms through non-corporate email accounts, and 17% used corporate emails but without integrated authentication systems (like SAML – “Security Assertion Markup Language”). This is referred to as Shadow AI, a subcategory of Shadow IT. (For more information see our Shadow AI training.)
These statistics reveal a dangerous situation. Lots of employees are using AI, but not in accordance with sound cybersecurity practices or within the confines of established corporate AI policies. This is especially dangerous given the nature of the typical AI use case, which often involves uploading confidential data for the sake of completing a task.
Intelisys Sales Partners can help customers mitigate risk by guiding them through the process of mindful AI implementation.
Here are 3 steps all organizations should take as we head full-steam into the AI era:
- Create an AI policy. This policy should answer three essential questions for employees: (a) What AI tools are we allowed to use? (b) What data can I upload into those AI tools? (c) If I accidentally use sensitive data with an AI tool, how do I report it?
- Increase IT visibility. The more an organization can see into users’ tech activity, the better it will be at spotting unauthorized AI usage (a.k.a. “shadow AI”).
- Implement an AI-enhanced Security Operations Center (SOC). Bad actors are already using AI to launch attacks; it’s time for organizations to fight fire with fire, leveraging AI to bolster their defenses.
Employees are outpacing their employers in the rush to adopt AI. To maintain data security, organizations need to catch up.
#3 – Increased Exploitation of Edge Devices and VPNs
Every year, the DBIR tracks “initial access vectors” to see where data breaches begin. In 2024, 20% of non-error, non-misuse breaches stemmed from the “exploitation of vulnerabilities” (as opposed to other causes like phishing attacks or credential abuse). And among those “exploitation of vulnerabilities” breaches, 22% stemmed from targeted attacks on edge devices and virtual private networks (VPNs) – up from just 3% the year before.
In other words, edge devices and VPNs are becoming an increasingly common initial access vector.
According to the 2025 DBIR, “both ransomware operators and espionage-motivated threat actors” are launching these types of attacks “with great success.” The good news is that organizations are recognizing the danger, with the 2025 DBIR finding that 54% of edge device vulnerabilities had been fully remediated in the previous year.
Intelisys Sales Partners should recognize that patching edge device vulnerabilities has become a major priority for organizations, and adjust the discovery process accordingly.
For example, in the area of SD-WAN, Sales Partners often assume an organization’s main concern is network optimization – but, given the current threat environment, security may actually be the main priority. That means Sales Partners should consider leading with security when discussing SD-WAN.
How Sales Partners Can Leverage the DBIR
As an Intelisys Sales Partner, your goal is to act as a trusted advisor to your customers. The 2025 DBIR gives you an in-depth understanding of the current cybersecurity environment, allowing you to maintain “expert status” and guide customers towards the right IT solutions. It’s also a well-known resource that customers trust, giving you common ground for security conversations.
Armed with insights from the 2025 DBIR, you can help customers:
- Avoid third-party involvement in data breaches
- Create a sound AI policy
- Patch edge device vulnerabilities
During the process, you’ll encounter countless cross-selling opportunities while cementing your status as a trusted advisor in the cybersecurity space.
Next Steps (and Additional Resources)
Now you know what’s new in the world of cybersecurity. What’s next?
Start by identifying customers or prospects who would be especially interested in the key findings from the 2025 DBIR. Then, reach out with pointed questions related to the specific vulnerabilities highlighted in the report.
And be sure to leverage the additional resources at your disposal. Download the complete 2025 DBIR, access the customer conversation guides on Intelisys University, and schedule a DBIR briefing with an Intelisys Solutions Engineer.
