Many breaches now begin in places where no software vulnerability exists to patch, and an increasing share of them run through a vendor, partner, or external dependency.Verizon’s 2026 Data Breach Investigations Report, which examined more than 22,000 confirmed breaches from a dataset of over 31,000 incidents across 145 countries, places the shift in clear numbers.
Exploitation of software vulnerabilities was the single largest initial-access vector, accounting for 31 percent of breaches with a known entry point—the first time in the report’s 19-year history that this vector has led.
At the same time, the combination of phishing, stolen credentials, and pretexting still represented roughly 35 percent of initial access when viewed together.
More strikingly, a third party was involved in 48 percent of breaches, a sharp rise from 30 percent the prior year and from 15 percent only two years earlier.
These figures underscore a structural change.
Organizations no longer face threats solely at their own perimeter. Software supply chains, managed services, cloud-hosted data, and interconnected partner environments have expanded the attack surface so that nearly half of confirmed breaches now touch an external party.
Many of these incidents leave no classic “bug to patch” on the victim’s own systems; the weakness lies in a dependency, a connection, or a trust decision made elsewhere.
The defensive model that email security adopted roughly twenty years ago remains relevant precisely because it addresses this class of problem.
Incoming material is held at a gateway, opened and executed in a controlled sandbox (often called detonation), and checked for the true identity and reputation of the sender before it is released to a user or quarantined.
The approach does not rely on the presence of a known vulnerability in the organization’s own code; it treats the external artifact as untrusted until proven otherwise.
Today the same problem appears across a much wider set of channels.
Packages arrive through language package managers.
Extensions and plugins are pulled from marketplaces. Browsers fetch content that can contain both data and executable logic. Vendor APIs and connected applications exchange credentials and data.
Most significantly, AI agents now retrieve skills, tools, documents, and web pages on their own initiative.
In that setting a document is not merely information; it can function as an instruction that the agent will attempt to follow.
The practical response is to apply the same three checks—hold, detonate, and verify provenance—under a single policy across every one of these channels.
Incoming material, whether a package, an extension, a browser-fetched page, a vendor payload, or an agent-retrieved document, is intercepted before it reaches the consuming process or person.
It is executed or rendered in an isolated environment that can observe its behavior.
Its origin, signature, and chain of custody are validated.
Only then is a release or quarantine decision made.
This uniform treatment recognizes that the distinction between “data” and “code,” or between “content” and “instruction,” has largely collapsed for modern systems and especially for autonomous agents.
By enforcing the three checks at a common policy layer, organizations can reduce the window in which untrusted material influences a human, a build pipeline, or an AI agent.
The approach does not eliminate the need for vulnerability management or identity controls, but it addresses the large and growing share of breaches that begin outside any patchable flaw on the organization’s own systems.
As third-party involvement continues to rise and AI agents expand the set of autonomous retrieval paths, the email-security pattern of holding, detonating, and verifying provenance offers a practical, channel-agnostic foundation for containing risk before it reaches the point of impact.
