Verizon DBIR claims that only 28 percent of observed data breaches involve the use of malware for the initial intrusion. Verizon says only 28% of observed breaches are driven by zero-day exploits or outlandishly complex intrusion paths. Phishing, use of stolen credentials, backdoors or compromised web applications are common entry points for attackers. MSPs rely heavily on third-party software and services, so when a business-critical app is discovered to have multiple severe vulnerabilities, it introduces a wide-open channel for further exploitation.”]
Source: https://blog.malwarebytes.com/opinion/2020/01/securing-the-msp-their-own-worst-enemy/