Verizon DBIR: Security Incident Analysis Guide

The Verizon Data Breach Investigations Report (DBIR) is an annual empirical cybersecurity benchmark published by Verizon Business. Built on real-world telemetry contributed by computer emergency response teams (CERTs), law enforcement agencies, and incident response organizations worldwide, the DBIR provides macro-level analysis of confirmed data breaches and security incidents. In academic and industrial security research, DBIR data enables investigators to validate threat models, assess real-world attack vectors, and examine epidemiological trends using standardized statistical taxonomies.

What it is used for in research

Empirical cybersecurity research requires structured, reproducible datasets that reflect actual adversary behavior rather than theoretical threat vectors. The Verizon DBIR addresses this need by categorizing security incidents according to the open-source VERIS (Vocabulary for Event Recording and Incident Sharing) framework. Researchers leverage DBIR telemetry and VERIS data to address several core analytical objectives:

• Macro-Epidemiological Threat Modeling: Quantifying shifts in adversary tactics over multi-year horizons, such as the transition from brute-force credential stuffing to automated exploitation of edge software vulnerabilities.
• Threat Actor Profiling: Evaluating distributions across external criminal syndicates, nation-state espionage groups, and internal actors abusing privileges or committing operational errors.
• Asset and Impact Evaluation: Mapping attack patterns to compromised asset varieties (including cloud servers, end-user workstations, and database repositories) to evaluate data protection mechanisms and cryptography vs cybersecurity controls against unauthorized disclosure.
• Academic Threat Landscape Studies: Formulating empirical baselines presented at peer-reviewed cybersecurity venues, such as the NDSS Symposium, to validate whether newly proposed defense algorithms address historically prevalent threat vectors.

Central to the DBIR methodology is the VERIS A4 Grid, which decomposes each security incident across four orthogonal dimensions:

1. Actors: Who conducted or caused the incident (External, Internal, Partner, or Unknown).
2. Actions: What tactics or mechanisms affected the assets (Hacking, Malware, Social, Misuse, Error, Physical, or Environmental).
3. Assets: Which infrastructure components or data stores were impacted (Server, User Device, Media, Network, Person, or Kiosk/Terminal).
4. Attributes: How security properties were affected, mapped across the classic CIA triad (Confidentiality, Integrity, Availability) plus Possession.

Install or access

Researchers access Verizon DBIR findings and the underlying VERIS dataset through three official distribution channels:

1. Official DBIR Reports and Interactive Portals: Verizon Business publishes annual PDF reports, executive summaries, and interactive data filtering dashboards at its official portal (https://www.verizon.com/business/resources/reports/dbir/). These publications offer macro-level percentage breakdowns across industry sectors defined by North American Industry Classification System (NAICS) codes.
2. VERIS Community Database (VCDB): An open-source repository containing thousands of publicly disclosed and validated security incidents formatted as individual JSON documents under the VERIS schema. The repository is publicly accessible on GitHub at https://github.com/vz-risk/VCDB.
3. The verisr R Analysis Package: The official statistical package maintained by the Verizon RISK team on GitHub at https://github.com/vz-risk/verisr. The package ingests raw VERIS JSON files into structured data tables and applies specialized Bayesian statistical models.

To prepare an analytical environment in R, install the required development tools and the verisr package using R console commands:

# Install devtools if not already available
install.packages("devtools")

# Install the official verisr package directly from GitHub
devtools::install_github("vz-risk/verisr")

# Load analytical and visualization libraries
library(verisr)
library(data.table)
library(ggplot2)

Step-by-step task

The following step-by-step workflow demonstrates how to ingest public VERIS Community Database records, filter by specific threat characteristics, and calculate statistical confidence intervals using R.

1. Clone the VERIS Community Database Repository:
   Clone the validated incident records from the official VCDB repository using terminal commands:

   git clone --depth 1 https://github.com/vz-risk/VCDB.git

   The validated JSON incident files are located under the directory path VCDB/data/json/validated/.

2. Load and Ingest Incident JSON Files into R:
   In R, point the json2veris() function to the validated directory. The function parses each JSON record and constructs an analytical object inheriting from verisr, data.table, and data.frame:

   # Define directory containing validated VERIS JSON records
   vcdb_dir <- "VCDB/data/json/validated"
   
   # Ingest JSON files into an analytical verisr object
   vcdb <- json2veris(dir = vcdb_dir)
   
   # Confirm object class and dataset dimensions
   class(vcdb)
   dim(vcdb)
   

3. Generate an Initial 4A Summary:
   Call the summary() method to inspect incident counts distributed across the core VERIS dimensions (Actors, Actions, Assets, and Attributes):

   # Print high-level incident distribution across the A4 grid
   summary(vcdb)
   

4. Calculate Proportions and Confidence Intervals for External Actors:
   Use getenumCI() to aggregate incident counts, calculate frequencies, and derive Bayesian confidence intervals for external threat actor varieties:

   # Calculate proportion and credible intervals for external actor varieties
   ext_actors <- getenumCI(vcdb, "actor.external.variety")
   print(ext_actors)
   

5. Cross-Tabulate Actions Against Assets (A2 Grid Analysis):
   Execute a multi-enumeration query to construct a cross-tabulated contingency matrix comparing attack actions against targeted asset types:

   # Compute multi-enumeration cross-tabulation of Actions by Assets
   action_asset_grid <- getenumCI(vcdb, c("action", "asset.variety"), na.rm = TRUE)
   head(action_asset_grid, 10)
   

6. Filter by Confirmed Data Breach and Vulnerability Exploitation:
   Because the verisr object flattens nested enumerations into logical columns, filter incidents using standard Boolean operations to isolate records where data disclosure was confirmed and a specific exploit vector was utilized:

   # Identify incidents with confirmed data disclosure
   confirmed_loss <- vcdb[["attribute.confidentiality.data_disclosure.Yes"]]
   
   # Identify incidents involving web application hacking vectors
   web_vector <- vcdb[["action.hacking.vector.Web application"]]
   
   # Combine filters with Boolean AND
   web_breaches <- confirmed_loss & web_vector
   
   cat("Total confirmed data disclosure incidents:", sum(confirmed_loss, na.rm = TRUE), "
   ")
   cat("Confirmed web application breaches:", sum(web_breaches, na.rm = TRUE), "
   ")
   

   When tracking vulnerability exploits against known system weaknesses, researchers cross-reference these incident vectors with standardized vulnerability metrics; for a detailed evaluation of vulnerability scoring systems, see our comparison of CVE vs CVSS. Similarly, for empirical investigations involving malicious binaries identified in breach telemetry, researchers correlate VERIS malware attributes with external repositories such as MalwareBazaar or execute dynamic detonation traces via Cuckoo Sandbox.

Output and how to read it

The primary analytical output produced by verisr queries is a structured table containing point estimates and confidence intervals for each enumerated category.

When executing getenumCI(vcdb, "actor.external.variety"), the returned table contains five primary columns:

• enum: The specific taxonomy label defined in the VERIS schema (for example, Organized crime, Nation-state, Activist, or Former employee).
• x: The absolute count of incidents within the dataset exhibiting this specific enumeration.
• n: The total sample size of the parent enumeration class (in this case, total incidents where an external actor was identified).
• freq: The relative proportion or frequency of occurrence, calculated as x / n.
• low and high: The lower and upper boundaries of the 95% confidence interval, derived via Bayesian binomial estimation (binom::binom.bayes()) or Markov chain Monte Carlo (MCMC) simulations.

For multi-enumeration queries such as getenumCI(vcdb, c("action", "asset.variety")), the output expands to include:

• enum: The primary enumeration value (e.g., Hacking, Malware, Social).
• enum1: The secondary enumeration value (e.g., Server, User Device, Person).
• x, n, freq: Joint occurrence metrics indicating how frequently a specific action targeted that particular asset category relative to total recorded incidents.

In addition to raw schema paths, verisr synthesizes several derived convenience fields during ingestion:

• actor: Top-level actor categories (External, Internal, Partner, Unknown).
• action: Top-level action categories (Hacking, Malware, Social, Misuse, Error, Physical, Environmental).
• asset.variety: Top-level asset categories.
• attribute: Top-level impact dimensions (Confidentiality, Integrity, Availability).
• victim.industry2: First two digits of the victim’s NAICS code, enabling macroeconomic sector comparison.
• victim.orgsize: Standardized organizational scale classifications (Small vs. Large).
• pattern: The DBIR incident classification pattern (e.g., System Intrusion, Basic Web Application Attacks, Miscellaneous Errors, Privilege Misuse, Lost and Stolen Assets).

Troubleshooting

Researchers working with VERIS datasets and the verisr package frequently encounter several common operational and statistical challenges:

1. Missing Proportions or NA Values in getenumCI():
   Symptom: The x and freq columns return NA for certain categories, or expected low-frequency rows are omitted from the output.
   Root Cause: In version 2.3 and later, verisr incorporates small-sample guardrails. When the total sample size n for a category is less than 30, the function replaces x and freq with NA to prevent researchers from drawing statistical conclusions from wide credible intervals. Furthermore, any row with n < 5 is automatically omitted.
   Resolution: For small corpora, aggregate granular sub-categories into higher-level parent enumerations (for example, analyzing action rather than granular action.hacking.variety), or pool records across multiple observation years.
2. Memory Exhaustion During JSON Ingestion:
   Symptom: The R process slows down significantly or triggers out-of-memory errors when calling json2veris() on a large directory.
   Root Cause: Ingesting tens of thousands of deeply nested JSON records simultaneously requires significant temporary memory allocation.
   Resolution: Target only the data/json/validated/ subdirectory rather than unvalidated or raw scrapers, run the command in a clean 64-bit R session with at least 8 GB of available RAM, or split directory paths into discrete batches and concatenate the resulting data tables.
3. Schema Validation Warnings on Custom Records:
   Symptom: json2veris() reports parsing warnings or drops custom fields.
   Root Cause: Newly authored or non-standard incident records may deviate from the expected JSON schema version.
   Resolution: Explicitly specify the path to the official schema file using the schema parameter: vcdb <- json2veris(vcdb_dir, schema = "VCDB/vcdb-merged.json").
4. Obsolete Retrieval Functions (getenum() / getenumby()):
   Symptom: Legacy code using getenum() or getenumby() fails or produces deprecation warnings.
   Root Cause: In newer versions of verisr, getenum() and getenumby() have been superseded by getenumCI() and getenumCI2020().
   Resolution: Update analysis scripts to call getenumCI(), which provides confidence intervals alongside point frequencies.

Free alternatives

While the Verizon DBIR and VERIS framework represent the primary standard for epidemiological breach research, several alternative frameworks and databases provide complementary analytical capabilities in cybersecurity research:

Framework / Tool	Primary Focus	Taxonomic Model	Official Tooling & Data Format	Best Research Use Case
Verizon DBIR / VERIS (VCDB)	Empirical breach analysis, loss outcomes, and demographic risk	VERIS A4 Grid (Actors, Actions, Assets, Attributes)	verisr R package, JSON incident schema, GitHub repository	Macro-level statistical studies of real-world breach frequencies, industry exposure, and organizational impact
MITRE ATT&CK	Technical adversary tactics, techniques, and procedures (TTPs)	Matrix structure (Tactics, Techniques, Sub-techniques, Mitigations)	mitreattack-python, STIX/TAXII feeds, ATT&CK Navigator	Procedural threat modeling, intrusion emulation, and detection engineering across host and network telemetry
CISA Known Exploited Vulnerabilities (KEV)	Actively exploited software flaws with binding remediation timelines	CVE mapping with exploitation confirmation and required action dates	CISA AIS API, JSON/CSV public catalogs	Prioritizing patch management research and tracking adversary weaponization velocity of known software defects
Privacy Rights Clearinghouse (PRC)	Historical chronology of publicly disclosed US data breaches since 2005	Entity type, breach type, records exposed, and regulatory disclosures	Downloadable CSV/Excel public datasets	Legal, compliance, and consumer privacy research tracking total sensitive record exposures over time
MISP (Malware Information Sharing Platform)	Operational threat intelligence and indicator sharing	MISP core taxonomy and galaxy clusters (Threat Actors, Tools)	PyMISP Python library, REST API, open-source server instances	Real-time collaborative threat intelligence sharing and correlation of technical indicators of compromise (IoCs)

Whereas MITRE ATT&CK excels at granular procedural decomposition of in-flight attacker actions, it does not track organizational losses, victim demographics, or macroeconomic distributions. Conversely, the Verizon DBIR and VERIS model emphasize epidemiological outcomes: how many organizations were impacted, who the threat actors were, which assets were compromised, and whether data confidentiality was breached.

FAQ

What is the difference between a security incident and a data breach in the Verizon DBIR?

The DBIR and the VERIS framework maintain a strict technical distinction between an incident and a breach. A security incident is defined as any observable event that compromises the confidentiality, integrity, or availability of an information asset. A data breach is a confirmed subset of incidents where data disclosure is verified—specifically, an incident that results in the confirmed unauthorized disclosure, exfiltration, or exposure of sensitive data to an unauthorized party.

What is the VERIS A4 Grid, and why is it used in cybersecurity research?

The A4 Grid is the core threat taxonomy underlying the VERIS framework, organizing every recorded incident across four orthogonal axes: Actors (who caused it), Actions (how they did it), Assets (what systems were affected), and Attributes (how security properties were altered). This standardized classification ensures that incident datasets from disparate organizations, industries, and countries can be statistically compared and synthesized without semantic ambiguity.

Can researchers analyze VERIS incident data using Python instead of R?

Yes. Because the VERIS Community Database consists of standardized, open-schema JSON files, Python researchers can directly ingest incident files using the standard json library and normalize them into pandas dataframes via pandas.json_normalize(). While Python does not natively include the pre-built verisr helper functions, equivalent Bayesian binomial confidence intervals can be computed using libraries such as scipy.stats or statsmodels.

How does the verisr package handle small sample sizes?

In verisr version 2.3 and later (via getenumCI2020()), the package applies explicit statistical guardrails. When the sample size n for a given category falls below 30, verisr sets the observed count x and frequency freq to NA to prevent researchers from relying on point estimates with overly wide confidence intervals. Additionally, the function automatically drops rows where n < 5.

Is the VERIS Community Database (VCDB) free to use for academic research?

Yes. The VERIS Community Database is an open-source, community-driven project maintained under open data licensing on GitHub (vz-risk/VCDB). Researchers, educators, and enterprise analysts are permitted to download, analyze, and cite the dataset for scholarly publications, empirical benchmark evaluations, and threat modeling exercises.

Sources

• Verizon Business. Data Breach Investigations Report (DBIR) Official Portal. URL: https://www.verizon.com/business/resources/reports/dbir/. Read date: 2026-11-09.
• VERIS Framework Consortium. Vocabulary for Event Recording and Incident Sharing (VERIS) Schema and Documentation. URL: https://verisframework.org/ (and http://veriscommunity.net/). Read date: 2026-11-09.
• Verizon RISK Team. VERIS Community Database (VCDB) Repository. URL: https://github.com/vz-risk/VCDB. Read date: 2026-11-09.
• Verizon RISK Team. verisr: R Package for Analyzing VERIS Data. URL: https://github.com/vz-risk/verisr. Read date: 2026-11-09.