INTEL-31: Access Is a Product

The INTEL  

Initial access to your network is now a commoditized product — bought pre-packaged from brokers, then handed downstream to whoever monetizes it. The attacker’s preparation happens upstream, off your clock, before your name ever enters the picture. That is why the reaction window has collapsed: the work that used to give defenders time has already been done, by someone else, and sold.

Rapid7’s 2026 Global Threat Landscape Report frames the year’s central shift as the industrialization of access. Initial Access Brokers (IABs) and specialized collectives now remove the operational friction that used to slow attackers down. Access to a target is a product — acquired, priced, and sold — feeding a separate downstream stage where ransomware operators do the extortion. Rapid7’s framing of ransomware as “downstream income” rather than a start-to-finish attack is the market-structure explanation for a threat landscape moving faster than defenders can react.

The victim-side data corroborates it. The 2026 Verizon DBIR found third-party involvement in breaches rose 60% year-over-year, now sitting behind 48% of all breaches — the same industrialized-supply-chain dynamic, measured from inside the breached organizations rather than from the criminal market.

Why It Matters  

The mental model most defenses are built on is a single adversary who has to build their way in against your specific environment: reconnaissance, tooling, foothold, escalation. That model comes with a gift — time. Recon is noisy, tooling takes effort, and a competent defender can intervene mid-campaign. It is the window every detection-and-response program is designed to exploit.

The access-broker economy erases that gift. When entry is a product someone else already produced and sold, the noisy preparation phase happened weeks ago, on infrastructure you can’t see, before you were even selected as the target. The operator who shows up in your environment isn’t building access — they bought it and are moving straight to monetization. There is no long campaign to detect, because the campaign’s hard part was completed and invoiced upstream.

This reframes third-party risk from a compliance topic into the core of the problem. If access is a commodity, the cheapest access to you often runs through a vendor with weaker controls — which is exactly why third-party involvement is now behind nearly half of all breaches. Your attack surface is no longer just your systems; it is every organization whose access to your environment can be brokered.

What To Do — One Key Action  

Treat your vendors’ access as your own attack surface, and make credential hygiene a contract term — not a courtesy. Mandate MFA, enforced credential rotation, and least-privilege for every third party with a path into your environment, and audit it, because the cheapest brokered access to your network increasingly runs through a vendor’s weaker controls.

This is a Board-and-CISO move with procurement teeth. The breach data now puts third-party involvement behind roughly half of all breaches, and remediation of vendor weaknesses routinely drags for months — so hoping your vendors are secure is not a control. Writing MFA and credential requirements into contracts, and verifying them, is. When access is an industrialized product, you cannot out-detect the moment of intrusion; you can only make sure the cheapest path to you — through a third party — is closed before it’s ever brokered.

MITRE ATT&CK  

• T1650 — Acquire Access: The defining technique of the access-broker economy — adversaries purchase existing access to a target rather than building it. The control posture shifts from detecting a build-up campaign (which no longer happens on your infrastructure) to hardening the credential and third-party paths that get brokered.
• T1078 — Valid Accounts: Brokered access is most often valid credentials, used to log in rather than break in. The control is mandatory MFA and credential hygiene — extended contractually to third parties.

Learn More  

• FIR Risk Tuesday E91 — The Window Closed — The full three-report synthesis
• FIR Risk Tuesday E90 — Refinement, Not Revolution — The Verizon DBIR third-party breach data
• Rapid7 2026 Global Threat Landscape Report — Primary source

Powered by FIR Risk Platform — AI-driven threat intelligence for enterprise risk leaders.