--- title: Verizon DBIR Reveals Third-Parties Involved in 30% of Breaches description: Verizon DBIR 2025 “found third-party involvement of some sort in 30% of all breaches we analyzed, up from roughly 15% last year.” Double the rate of last year. image: https://vorlon.io/hubfs/Verizon%20DBIR%202025.webp --- [Saas Security Blog](https://vorlon.io/saas-security-blog) > Verizon DBIR Reveals Third-Parties Involved in 30% of Breaches # Verizon DBIR Reveals Third-Parties Involved in 30% of Breaches [Amir Khayat, CEO](https://vorlon.io/saas-security-blog/author/amir-khayat-ceo) | Apr 24, 2025 [![Share on linkedin](https://vorlon.io/hubfs/ll-assets/Images/Icons/LinkedIn.svg) ](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fverizon-dbir-reveals-third-party-risk%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://vorlon.io/hubfs/ll-assets/Images/Icons/X.svg) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fverizon-dbir-reveals-third-party-risk%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fverizon-dbir-reveals-third-party-risk%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=Verizon+DBIR+Reveals+Third-Parties+Involved+in+30%25+of+Breaches) [![Share on email](https://vorlon.io/hubfs/ll-assets/Images/Icons/envelope.svg) ](mailto:?subject=Check%20out%20https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fverizon-dbir-reveals-third-party-risk%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fverizon-dbir-reveals-third-party-risk%3Futm_medium%3Dsocial%26utm_source%3Demail) Verizon DBIR Reveals Third-Parties Involved in 30% of Breaches 7:42 ![Verizon DBIR Reveals Third-Parties Involved in 30% of Breaches](https://vorlon.io/hs-fs/hubfs/Verizon%20DBIR%202025.webp?width=1200&height=820&name=Verizon%20DBIR%202025.webp) Verizon’s 2025 [Data Breach Investigations Report (DBIR)](https://www.verizon.com/business/resources/reports/dbir/) puts a spotlight on the third-party risk security teams face every day. As the report puts it: > “For this year, we found third-party involvement of some sort in 30% of all breaches we analyzed, up from roughly 15% last year.” > — Verizon 2025 Data Breach Investigations Report That’s double the rate from last year. It’s a clear sign that third-party risk is moving from the sidelines to the center of cybersecurity strategy. At Vorlon, we saw this shift coming. For years, we’ve focused on the everyday realities of SaaS integrations, API tokens, and vendor connections that most security teams can’t easily track or control. [Vorlon’s SaaS ecosystem security platform](https://vorlon.io/vorlon-platform) was built to help organizations manage the real risks that now show up in the DBIR’s numbers. We give you the visibility and control to respond quickly and with confidence. That’s how you stay ahead of the third-party problem, no matter what the statistics say. ## The third-party problem is more than a vendor checklist The “third-party problem” goes far deeper than vendor selection or onboarding questionnaires. Today, every organization runs on a complex SaaS ecosystem—CRM, billing, HR, DevOps, marketing, analytics, and more—all interconnected, all exchanging sensitive data, often automatically. The DBIR puts it plainly: > “On the more hands-off side of third-party relationships, we find a proliferation of specialized software as a service (SaaS) providers supporting specific industries and automating some of their critical processes. And although those can be beneficial from a cost-reduction and business efficiency analysis, they bring the Venn diagram overlap of cybersecurity risk and operational risk uncomfortably close to a single circle.” > — Verizon 2025 Data Breach Investigations Report These suppliers are operational lifelines. A single over-permissioned OAuth token, a dormant API key in a public repo, or an outdated integration can quietly expand your attack surface in ways traditional security tools weren’t designed to see. ## Why traditional tools aren’t enough Legacy approaches like SaaS Security Posture Management (SSPM), Third-Party Risk Management (TPRM), and even SIEMs can help with configuration and policy, but they struggle with the dynamic, fast-moving nature of SaaS ecosystems. Here’s why: - SSPM checks settings, but not behavior. It can’t tell you when a third-party token is suddenly used for something new, or by someone new. - TPRM relies on point-in-time assessments, not real-time monitoring. Most breaches don’t wait for your next vendor review. - SIEM only works with logs you actually have. Many SaaS apps don’t give you the detail or context you need, or charge extra for those logs. - Shared responsibility doesn’t mean shared visibility. Most organizations can’t see what their vendors are doing with access, or if that access has changed. As the DBIR notes, “third parties not only act as custodians to customers’ data, but they also underpin critical parts of organizations’ operations.” The overlap of cybersecurity risk and operational risk has never been tighter. ## Real incidents, real lessons These trends aren’t hypothetical. At Vorlon, we’ve analyzed multiple third-party incidents in the past year that mirror the DBIR’s findings: - [Oracle Health breach](https://blog.vorlon.io/oracle-health-breach): PHI exposure through token misuse and third-party access. - [Silk Typhoon supply chain attack](https://blog.vorlon.io/silk-typhoon-supply-chain-attack-how-hackers-exploit-third-party-access): Attackers leveraged trusted vendor relationships for deeper access. - [Grubhub data breach](https://blog.vorlon.io/grubhub-data-breach-a-costly-meal): Vendor compromise led to downstream exposure. - [GitHub CI/CD pipeline attack](https://blog.vorlon.io/tj-actions-github-attack-exposes-saas-pipelines-targets-coinbase): Secrets and tokens exfiltrated via a poisoned GitHub Action. - [OAuth phishing at scale](https://blog.vorlon.io/new-oauth-phishing-attack-github-security): Full repo access granted via a fake OAuth app. Each of these attacks started as a “trusted” connection, integration, or credential—until it wasn’t. ## Secrets, tokens, and the 94-day exposure window The DBIR also highlights a quietly alarming stat: > “The median time to remediate discovered leaked secrets on a GitHub repository is 94 days.” > — Verizon 2025 DBIR Three months is a long time for a credential to remain exposed, especially when that secret might provide access to production databases, customer records, or critical infrastructure. The DBIR found: - JWTs made up 66% of web app secrets found - GitLab tokens represented 50% of all leaked CI/CD secrets - 43% of cloud infrastructure secrets were Google Cloud API keys These are real-world entry points often missed by traditional controls. ## The Vorlon approach: Context-driven, ecosystem-wide visibility The DBIR is legendary for its rigor and reach, but even it acknowledges what’s missing: “managing credentials will likely be harder in an environment you don’t control.” That’s the SaaS ecosystem today—sprawling, fast-changing, and full of invisible, machine-to-machine interactions. Vorlon’s[DataMatrix™ technology](https://vorlon.io/vorlon-datamatrix-opens-saas-ecosystem-black-box) was built for this challenge. We create a live, algorithmic model of your SaaS ecosystem by: - Continuously mapping data flows, tokens, secrets, and permissions - Monitoring SaaS-to-SaaS, User-to-SaaS, and third-party API behavior in real time - Detecting drift, dormant tokens, permission changes, and anomalous activity—across all your apps and integrations - Enabling fast, context-rich remediation (revoke, rotate, or alert) with confidence As more breaches start with a legitimate vendor, integration, or token rather than a direct attack, you need to know what’s happening across your SaaS ecosystem in real time. That’s where Vorlon makes the difference: We help you spot risky third-party activity, so you can act with confidence, no matter how the threat evolves. ## The real risk is what you’re not seeing This year’s DBIR makes it clear that third-party risk is now a core theme for organizations of every size and sector: > “Possibly the most obvious and noteworthy among them is the role that third-party relationships play in how and why breaches occur.” > — Verizon 2025 Data Breach Investigations Report As third-party breach incidents increase, the most dangerous risks are the ones that don’t fit neatly into a log file, a vendor questionnaire, or a compliance checkbox. That’s why Vorlon exists: to give you the context, clarity, and confidence to protect your SaaS ecosystem as it really operates. If your third-party risk program ends at onboarding, it’s time to upgrade. If your visibility ends at your firewall, it’s time to expand your view. Ready to see your SaaS ecosystem as it really is? Book a demo to see it in action. [ See how it works ](https://vorlon.navattic.com/demo) with a self-serve tour. [ Follow us on LinkedIn ](https://www.linkedin.com/company/vorlon) for the latest SaaS security insights.   About the author ![Amir Khayat, CEO](https://vorlon.io/hs-fs/hubfs/Amir%20Khayat%20headshot%20clear%20bg.png?width=120&height=120&name=Amir%20Khayat%20headshot%20clear%20bg.png) [Amir Khayat, CEO](https://vorlon.io/saas-security-blog/author/amir-khayat-ceo) [Follow me on LinkedIn ](https://www.linkedin.com/in/amir-khayat/) Amir Khayat is the CEO and co-founder of Vorlon. Amir has over 17 years of cybersecurity experience, including software development, and GTM roles. Amir served in the Israeli Defense Forces as a commander and combat soldier at the Paratrooper’s ... [Read Full Bio](https://vorlon.io/saas-security-blog/author/amir-khayat-ceo) Blog tags - [Breach Response](https://vorlon.io/saas-security-blog/tag/breach-response) [![ShinyHunters Sidebar Ad](https://vorlon.io/hs-fs/hubfs/Images%20-%202026/2026%20CISO%20Report%20Banner%20Ad%20Final.png?width=350&height=520&name=2026%20CISO%20Report%20Banner%20Ad%20Final.png) ](https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLIFqhHbvMXr9sCtLg3SjGyxucXLDGAEZ6p7hVq%2FHj73J5jIl21ntspuXck0FDhLa5AoCVIiV6UPoFdmfyoCgk5gZhyQN0vNpJbQcKsyBPMqUuCsA79wUgKn%2BCq0jST2BYpRcl6MQO1nqRSUKrW04CR0pGt7umY8qquGOnnq3HJ0%2FYgVqp01i6ughr1Bd0ujJd4m2N8PUt6sJyfXCE46FwKHWOIg3dceObp%2BtoycGA%3D%3D&portalId=24426272) ### Related blogs [View all blogs](https://vorlon.io/blog) [![The Vercel Incident: OAuth Tokens and the AI Supply Chain Attack](https://vorlon.io/hs-fs/hubfs/vercel%20breach%20blog.png?width=400&height=300&name=vercel%20breach%20blog.png) Breach Response ### The Vercel Incident: OAuth Tokens and the AI Supply Chain Attack 7 min read Read More ](https://vorlon.io/saas-security-blog/vercel-incident-oauth-tokens-ai-supply-chain) [![Anodot Breach Exposes Snowflake Customer Data, Including Rockstar Games](https://vorlon.io/hs-fs/hubfs/anodot%20breach.png?width=400&height=300&name=anodot%20breach.png) Breach Response ### Anodot Breach Exposes Snowflake Customer Data, Including Rockstar Games 3 min read Read More ](https://vorlon.io/saas-security-blog/anodot-snowflake-breach-shinyhunters-data-theft) [![Mandiant Research on ShinyHunters Vishing: Why MFA-enabled Doesn’t Mean Protected](https://vorlon.io/hs-fs/hubfs/mandiant%20research%20shinyhunters%20vishing.png?width=400&height=300&name=mandiant%20research%20shinyhunters%20vishing.png) Breach Response ### Mandiant Research on ShinyHunters Vishing: Why MFA-enabled Doesn’t Mean Protected 5 min read Read More ](https://vorlon.io/saas-security-blog/mandiant-research-shinyhunters-vishing-mfa) [![How the Gainsight Breach Exposed a Growing SaaS Supply Chain Threat](https://vorlon.io/hs-fs/hubfs/Gainsight%20Breach.webp?width=400&height=300&name=Gainsight%20Breach.webp) Breach Response ### How the Gainsight Breach Exposed a Growing SaaS Supply Chain Threat 9 min read Read More ](https://vorlon.io/saas-security-blog/the-gainsight-breach-and-saas-supply-chain-attacks) ## Featured resources [![CISO Report Resource Tile](https://vorlon.io/hs-fs/hubfs/CISO%20Report%20Resource%20Tile.webp?width=1548&height=1046&name=CISO%20Report%20Resource%20Tile.webp) WHITE PAPERS AND RESEARCH ### The Agentic Ecosystem SecurityGap: 2026 CISO Report Why 99% of Organizations Were Breached Through Their SaaS and AI Ecosystem Despite Record Security Investment Read more ](https://go.vorlon.io/vorlon-2026-ciso-report-agentic-ecosystem-security-gap) [![blog 451 why saas and ai are converged (1)](https://vorlon.io/hs-fs/hubfs/Images%20-%202026/blog%20451%20why%20saas%20and%20ai%20are%20converged%20(1).png?width=329&height=222&name=blog%20451%20why%20saas%20and%20ai%20are%20converged%20(1).png) SaaS Security ### 451 Research: Why AI and SaaS Security Are Converging 451 Research highlights how AI and SaaS security are converging. Learn why integrations, OAuth, and ecosystem-level risk now define enterprise security. Read more ](https://vorlon.io/saas-security-blog/451-research-ai-saas-security-convergence) [![datamatrix patent blog](https://vorlon.io/hs-fs/hubfs/datamatrix%20patent%20blog.png?width=1548&height=1046&name=datamatrix%20patent%20blog.png) ### DataMatrix™: Vorlon's Patented Approach to Agentic Ecosystem Security Vorlon's DataMatrix™ technology is now patented. Learn how this intelligent simulation engine secures the agentic ecosystem by mapping AI agents, SaaS integrations, and data in motion. Read more ](https://vorlon.io/saas-security-blog/datamatrix-vorlons-patented-technology) ## Get Proactive Security for Your Agentic Ecosystem Book a Demo [![Vorlon_Logo_Large_White](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/Vorlon_Logo_Large_White.png?width=139&height=33&name=Vorlon_Logo_Large_White.png) ](https://vorlon.io) ## Sign up for industry insights and Vorlon news Start Here - [The Agentic Ecosystem Security Gap](https://vorlon.io/problems-we-solve) - [The Agentic Ecosystem Signal to Action Layer](https://vorlon.io/our-solution) Platform - [Platform](https://vorlon.io/platform) - [AI Agent Runtime Security](https://vorlon.io/ai-runtime-security) - [Total Identity Security](https://vorlon.io/total-identity-security) - [Data-Centric SaaS Security](https://vorlon.io/data-centric-saas-security) - [Compliance Automation](https://vorlon.io/compliance-automation) - [Apps Directory](https://vorlon.io/app-directory) - [SecOps Integrations](https://vorlon.io/integrations) Company - [About](https://vorlon.io/about) - [Careers](https://vorlon.io/careers) - [Press Room](https://vorlon.io/press-room) - [Resources](https://vorlon.io/resources) - [Blog](https://vorlon.io/blog) Let's Connect - Talk to Sales ![soc-type-2](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/soc-type-2.jpg?width=105&height=50&name=soc-type-2.jpg)![aws logo cropped](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/aws%20logo%20cropped.png?width=50&height=50&name=aws%20logo%20cropped.png)![latio innovators on black](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/latio%20innovators%20on%20black.png?width=52&height=50&name=latio%20innovators%20on%20black.png)![2025-CRN-Stellar-Startups](https://vorlon.io/hs-fs/hubfs/Logo/2025-CRN-Stellar-Startups.webp?width=29&height=50&name=2025-CRN-Stellar-Startups.webp)![FS-ISAC-Seal_Affiliate_onblack](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/FS-ISAC-Seal_Affiliate_onblack.png?width=156&height=50&name=FS-ISAC-Seal_Affiliate_onblack.png) © 2026 Vorlon Inc. All rights reserved. - [Terms of Use](https://vorlon.io/terms-of-use) - [Privacy Policy](https://vorlon.io/privacy-policy) - [Sitemap](https://vorlon.io/sitemap) [![ClickCease](https://monitor.clickcease.com/stats/stats.aspx)](https://www.clickcease.com) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Amir Khayat, CEO", "url" : "https://vorlon.io/saas-security-blog/author/amir-khayat-ceo" }, "dateModified" : "2026-02-09T07:27:07.999Z", "datePublished" : "2025-04-24T17:02:21.000Z", "headline" : "Verizon DBIR Reveals Third-Parties Involved in 30% of Breaches", "image" : [ "https://vorlon.io/hubfs/Verizon%20DBIR%202025.webp" ], "mainEntityOfPage" : { "@id" : "https://vorlon.io/saas-security-blog/verizon-dbir-reveals-third-party-risk", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://vorlon.io/hubfs/Logo/Vorlon%20logo_two%20tone%20light.svg" }, "name" : "Vorlon Inc." } } ```