Verizon's 2025 DBIR: Almost Half of Those Infostealer Logins Sat on Unmanaged Devices
The report's most useful device finding is not a slogan. It is a percentage of infostealer logs that came from machines nobody was managing.
Verizon's 2025 Data Breach Investigations Report puts stolen credentials next to exploits again. Use of stolen credentials accounted for 22% of breaches, down from 31% in the prior period. Exploitation of vulnerabilities was present in 20% of breaches, a 34% increase from the year before. Phishing sat at about 15%.
The device finding is the one Spearstone keeps handing to operations leaders. In infostealer credential logs, 30% of compromised systems could be identified as enterprise-licensed devices. Of the compromised systems that held corporate logins, 46% were non-managed and held both personal and business credentials. Verizon's reading is direct: that looks like bring-your-own-device, or a company device used outside policy. The report adds that if you do not choose a BYOD policy, one gets chosen for you.
Ransomware victims were already in the dumps
Verizon correlated infostealer logs and marketplace postings with domains of victims named by ransomware actors in 2024. Fifty-four percent of those victims had their domains in the credential dumps. Forty percent had corporate email addresses in the compromised credentials. That is not proof every ransomware case started with a stolen laptop. It is evidence that device-stolen logins and later intrusions are showing up on the same organizations.
A non-managed laptop is one you cannot wipe. That single fact should end the argument about whether a personal machine may hold the VPN. If the answer is yes, enroll it or keep corporate logins off it. DriveStrike is how enrolled machines get remote wipe, lock, and locate. The DBIR numbers are why passwords on unmanaged phones keep showing up in breach write-ups.
Move one policy this quarter
- Count machines that have corporate mail or SSO and are not enrolled. That count is your 46% problem, locally.
- Block or tightly limit corporate logins on devices you cannot wipe.
- Pair that with unique passwords. Verizon's infostealer analysis found that, in the median case, only 49% of a user's passwords were distinct.
Spearstone's data-security work starts from this kind of primary source. Enroll a pilot in DriveStrike or contact us to scope it.
Keep reading
- UK Retail's Spring Attacks Started Where Help Desks Get Talked Into a Reset
- Change Healthcare's Figure Settled Near 192.7 Million People
Questions worth answering directly
What share of breaches in the 2025 DBIR started with stolen credentials?
Verizon reported use of stolen credentials in 22% of breaches, down from 31% in the prior period. Vulnerability exploitation was at 20%, up 34% year over year.
What did the report say about unmanaged devices?
Among compromised systems in infostealer logs that contained corporate logins, 46% were non-managed and held both personal and business credentials. Thirty percent of compromised systems overall were identified as enterprise-licensed.