The short version:

Unpatched software is now the top way attackers get in, ahead of stolen passwords (Verizon 2026 DBIR).
Vendor-related breaches doubled in one year. Your vendor’s security is your security.
Untested backups and an unpracticed response plan decide whether an attack is an inconvenience or the end of a company.

Cybercriminals don’t kick in doors. They slip through the ones you forgot to lock.

Unpatched Software Is Now the Top Way In

For the first time in the 19-year history of Verizon’s Data Breach Investigations Report, exploiting unpatched software beat stolen credentials as the top way attackers get in. Not phishing or a clever con. A software update that sat unapplied just long enough.

I think about a client whose attack started exactly this way. They’d done what many companies do. They hired someone to handle their security, someone they trusted completely.

What they didn’t know was that the vendor was badly behind on patching and hadn’t properly segmented its network. Our client was sharing a network neighborhood with several other businesses and the fences between the neighbors weren’t solid.

Then the vendor got breached. Cybercriminals walked straight through the gap into our client’s network. They paid the ransom. And, still, 20 years of data… gone!

Outsourcing your technology does not mean outsourcing your risk.

Third-Party Vendor Risk Has Doubled

This isn’t rare. Verizon’s 2025 report found third-party involvement in breaches doubled in a single year, from 15% to 30%. Your vendor’s security is your security.

If you’re in healthcare, the stakes climb even higher. Every vendor that touches patient data is a business associate under HIPAA. Their gap can become your breach notification.

HIPAA already requires you to perform a risk analysis. The question is whether yours would hold up.

Untested Backups and the Missing Decryption Key

Paying the ransom doesn’t buy your business back. Neither do backups, unless someone has actually tested them.

I watched a company learn this at the worst possible moment. We were helping them restore when they discovered they didn’t have the decryption key for the servers they’d been backing up.

The backup existed. The data was completely inaccessible.

Why Your Incident Response Plan Decides the Damage

One more thing isn’t technically an open door, but it decides how bad the damage gets once a cybercriminal finds one: your incident response plan. If yours is gathering dust in a file cabinet, or sitting on a server that can be encrypted along with everything else, it won’t save you.

The companies that survive aren’t smarter than anyone else. They’ve practiced the plan more.

Ransomware Hit. Zero Ransom Paid.

Now, a success story. A client we work with at IT Architeks was hit with ransomware right before the holidays, through a business email compromise.

Here’s where the story changes. Months earlier, the company got an independent risk assessment. It uncovered blind spots they couldn’t see on their own and they committed to closing every gap.

They practiced their incident response plan. They proved their backups could be restored under pressure, on the clock.

When the attack came, our technicians detected it immediately. Systems were isolated and contained.

After a short forensics investigation by our security team, they were back up and running in eighteen hours, with data recovered to within fifteen minutes of the attack.

Zero encryption. Zero data loss. Zero ransom paid!!

That company is still in business today and it’s more profitable than ever.

Make no mistake. That wasn’t luck. That’s what happens when a company stops asking “are we prepared?” and starts asking “can we prove it?”

Not sure which of these doors is open at your company? A short strategy session is the easy next step. BOOK A CALL

4 Things Worth Doing This Month

Don’t ask if patching is current. Ask for the report. A verbal yes isn’t proof.
Pull your vendor access list. What can each vendor touch? What are they doing with your data? Who shouldn’t still be on the list?
Test a full backup restore with the clock running. Know your real recovery time before an attacker tells you.
Ask when your incident response plan was last practiced with the people who’d actually run it.

How IT Architeks Closes These Doors

Every step that company took, we take with our clients. Here’s what that looks like:

Unpatched software: IT Architeks Managed IT Services keeps your systems maintained proactively. Our vulnerability scanning shows you what’s still exposed. You get proof, not a verbal yes.
Vendor risk: our Cyber Risk Assessment maps every vendor’s access to your systems and data. Zero Trust security limits what any vendor can reach, so their breach doesn’t become yours.
Untested backups: IT Architeks Business Continuity and Disaster Recovery (BCDR) protects your data and builds the continuity plan around it, so you know your recovery time before an attacker tests it.
A plan in a drawer: our Incident Response and Recovery team builds your plan with you, practices it with your people and answers the call when ransomware hits.
Healthcare: IT Architeks HIPAA Compliant IT supports the risk analysis HIPAA already requires. We work alongside you as your Business Associate, not just another vendor on the list.

Want to talk through what that looks like for your company?

A short strategy session is the easy next step. BOOK A CALL

Want these lessons presented to your team, your association or your conference? I’d welcome that conversation too.

Not ready for a conversation yet? Subscribe to our newsletter and get each new lesson in your inbox. CLICK HERE.

Dedicated to your security,

Melanie Padron
VP of Strategic Growth, IT Architeks | Legacy Defender, Cybersecurity Truth Teller

About IT Architeks

IT Architeks is a veteran-owned managed IT and cybersecurity firm with more than 20 years of experience. Headquartered in Dallas with an office in Houston, we work with organizations nationwide, offering a 24/7 US-based Security Operations Center, incident response and recovery, HIPAA compliant IT and C-level advisory for transportation and logistics, healthcare, manufacturing, energy, finance and more. We help companies prove their security, not assume it. Learn more at itarchiteks.com.

Sources: Verizon 2026 Data Breach Investigations Report; Verizon 2025 Data Breach Investigations Report; HIPAA Security Rule, 45 CFR 164.308(a)(1)(ii)(A).

Related reading: Your Best Employee Is Your Biggest Risk