Verizon report says software vulnerabilities, not stolen credentials, are now biggest weak point