Default credentials are the finding nobody wants in a report, because there is no interesting story to tell about them. They are also still there.
The state of the evidence
The Verizon 2026 DBIR, covering November 2024 to October 2025 across more than 31,000 incidents and 22,000 confirmed breaches, records vulnerability exploitation as the leading initial access vector at 31% of breaches. Credential abuse fell to 13%, the first time in the report’s nineteen-year history that credential theft has been knocked off the top spot.
That is a real shift, and it is being read badly. A smaller share of a growing total is not an absence, and “credential abuse” as an initial access category does not capture the default password sitting on an internal admin console that turns a foothold into a domain.
CISA’s position has not moved either. Its Secure by Design alert asks manufacturers to eliminate default passwords from their products entirely, on the grounds that shipping them transfers a predictable, exploitable risk to every customer.
Where we still find them
- Administrative interfaces on appliances and management consoles that were racked, configured once, and never revisited.
- Databases, message brokers and caches deployed with vendor defaults on the assumption the network is private.
- Staging and demo environments holding a copy of production data, built from a template nobody hardened.
- Vendor or support accounts created during installation and left enabled after handover.
- Documentation, runbooks and infrastructure-as-code repositories containing the credential in plain text, which is the same finding by another route.
The common factor is not carelessness. It is ownership. Every one of these sits at a boundary where somebody assumed somebody else had it.
What to do about it this quarter
- Enumerate every appliance, console and service with an authentication prompt, including the ones that are “internal only”.
- For each, identify the account that existed before your team created any accounts. That is the one to check.
- Test the vendor default, not just your documented credential. The documented one being strong does not mean the default was removed.
- Search your own repositories and runbooks for the strings. If a credential is written down anywhere in your organisation, treat it as known.
- Make credential rotation a step in decommissioning and handover, not an annual exercise.
None of this is sophisticated work. That is exactly the argument for doing it before you pay anyone to find it.
