Vulnerability exploitation costs $4.24M, the lowest of the six principal attack vectors.

When an attacker exploits a known software vulnerability, the intrusion leaves a recognisable signature: a malformed request to a public-facing application, an exploit payload matching a published CVE, a crash or anomaly in a service that vulnerability scanners and intrusion-detection tooling are specifically tuned to catch. Compared with a supply-chain compromise that arrives on a trusted vendor channel, or a malicious insider using legitimate access, a CVE exploit is comparatively noisy. Noisier intrusions get found sooner, and IBM's data is unambiguous that a shorter breach lifecycle means a lower cost.

That lifecycle relationship is the whole story of this vector's cost. Breaches contained in under 200 days averaged $3.87M in 2025; those that ran beyond 200 days averaged $5.01M, a $1.14M (29%) premium. Because exploited-vulnerability breaches skew toward the faster-contained end of that distribution, their average lands below the mean. The catch is that this only holds when the flaw is known and being watched for. A zero-day, exploited before any patch or signature exists, inverts the advantage entirely: it behaves like the stealthy vectors, and MOVEit is the case that proves it.

Unpatched or zero-day software flaws. The spread across these six vectors is narrow, from $4.24M to $4.92M, so the ranking reflects containment speed and detection difficulty more than any inherent difference in the damage a breach does once it succeeds. IBM's full Figure 9 also ranks non-malicious causes that cost less still, such as physical theft ($4.07M), human error ($3.62M), and system error ($3.61M); among the six deliberate attack vectors, vulnerability exploitation is the cheapest.

In the IBM Cost of a Data Breach Report 2026 (released 29 July 2026) the overall global average rose to a record $4.99M and the US average to $11.5M, while the mean time to identify and contain a breach lengthened to 247 days, reversing five years of improvement. For a vector whose cost advantage rests entirely on fast containment, that lengthening clock matters: the same AI tooling that helps attackers weaponise a disclosed CVE faster also, on IBM's numbers, cuts breach cost by about $1.93M when defenders deploy it in security operations. The $4.24M figure on this page is the 2025 report's per-vector average, the edition in which IBM ranked initial vectors most explicitly; the lever it points to, patching known flaws before they are exploited and containing fast when they are, is the same one both cases on this page confirm.