OSec 2026 Year in Review Finds the Year’s Biggest Compromises Came from Default Passwords, Not AI

OSec’s experts validated 32,485 vulnerabilities in 2026. Just over 5% were critical or high risk, and remediation hit 97% when teams saw the full attack chain.

NEW YORK, NY, UNITED STATES, October 6, 2026 /EINPresswire.com/ — OSec, the offensive security firm led by attacker-minded experts and powered by its continuous security testing platform, Incenter, today released The Boring AI Apocalypse, its 2026 year-in-review report. The report is built on 32,485 vulnerabilities that OSec’s security experts found and validated this year across their internal research and testing more than 100 client environments. Nearly every successful compromise relied on basic failures: default credentials, missing protections, or features working as documented.

Only 1,689 of those validated findings, just over 5%, were rated critical or high risk. The report highlights how security teams are struggling because they are buried in low-risk noise, much of it generated by AI, and not because they face a flood of critical vulnerabilities.

“Every conversation I had this year included AI, but most of what we did to compromise client systems didn’t need it,” said Mark Stamford, Founder and CEO, OSec. “That doesn’t mean the work was easy. A scanner sees a printer, an anonymous directory session, and a default community string as three low-risk findings. Our team saw a route to a client’s industrial controllers. Finding that chain requires an attacker mindset driven by curiosity that isn’t replicable by AI yet.”

Key findings from the report:
– Noise outweighs severity. Only 1,689 findings were critical or high risk. Just 43.4% of those were fixed within SLA, and 23.1% saw no remediation, mitigation, or risk acceptance at all.
– Context drives remediation. When OSec demonstrated that a vulnerability led to critical data, alone or chained with others, remediation rose to 97%.
Supply chain attacks became the default for large-scale impact. Compromised security scanners, code pipelines, and open-source packages turned trusted tools into routes into downstream environments.
– AI lowered the floor. AI gave low-skilled attackers more workable tooling to run complex operations, but those operations weren’t sophisticated, which meant they were easily detected.
– Where AI risk actually surfaced. The largest area of AI risk was the fragility of AI infrastructure: exposed LLM endpoints, unauthenticated MCP servers, and agents with repository access created real exposure.

The report closes with six recommendations for 2027, including building an accurate external attack surface inventory, hardening identity controls before network controls, and testing how vulnerabilities chain together.

“A lot of 2027 security budgets are being written around AI, but most teams struggle with context,” said Stamford. “When we showed teams how a medium-rated vulnerability led to critical data or systems access, they fixed it almost every time. Before anyone buys an AI defense tool, they should know what’s exposed and where it leads.”

The Boring AI Apocalypse is available now at https://www.osec.com/resources/ai-cybersecurity-report-2026/

About OSec
OSec is an offensive security firm built on attacker-minded, hands-on security testing, spanning red, blue, and purple teaming, penetration testing, vulnerability research, and testing across hardware/firmware, cloud and AI, OT/ICS, and application security. OSec’s continuous testing platform, Incenter, extends that same expert-led rigor to organizations that cannot staff an expert bench of their own. Over 15 years, OSec has tested 480,000+ endpoints continuously, surfaced critical issues in 92% of engagements, and maintained a 99% client retention rate. For more information, visit www.osec.com.

Jinal Shah
OSec
+1 925-365-9033
email us here
Visit us on social media:
LinkedIn
YouTube
X

Media gallery