Identity Compromise Overtakes Vulnerabilities As Primary Ransomware Attack Vector, Sophos Finds

Four in five ransomware attacks now begin with a compromised identity rather than an exploited software vulnerability, according to the seventh annual State of Ransomware report from cybersecurity firm Sophos.

The vendor-agnostic survey of 2,158 IT and cybersecurity leaders across 17 countries found that malicious email (26 per cent) and phishing (24 per cent) have displaced exploited vulnerabilities as the primary root causes of ransomware attacks. Exploited vulnerabilities – which held the top position for three consecutive years – dropped 14 percentage points to 18 per cent. Compromised credentials remained the third most common root cause at 23 per cent.

In total, 79 per cent of ransomware attacks started with an identity-based approach, either securing credentials for abuse or exploiting credentials that had already been obtained.

Australian organisations reflect the trend

The Australian data mirrors the global shift. According to Sophos, 73 per cent of ransomware attacks on Australian organisations started with an identity-based attack. Malicious email, phishing and exploited vulnerabilities each accounted for 24 per cent of incidents, while compromised credentials were behind 19 per cent.

Two-thirds of ransomware victims globally (67 per cent) confirmed that their ransomware incident was also their most significant identity attack, establishing identity compromise as a primary ransomware delivery mechanism.

MFA alone not enough

One of the more striking findings from the report is that multi-factor authentication was deployed in some capacity for 97 per cent of incidents where compromised credentials were the root cause. One-time passwords (52 per cent), push-based applications (51 per cent) and passkeys (51 per cent) were the most widely deployed MFA methods, with respondents reporting an average of 2.5 MFA methods in use.

The high percentage of victims that had MFA deployed at the time of the attack indicates it may not have been fully deployed across all relevant systems, creating gaps for attackers to exploit. The report suggests MFA remains an important element of cyber defence strategies but is not sufficient on its own to prevent credential-based attacks as bypass techniques continue to evolve.

Encryption rates climb again

Over half of ransomware attacks (56 per cent) succeeded in encrypting data, reversing a two-year downward trend. The rate is up from 50 per cent in 2025 but remains below the 76 per cent peak recorded in 2023. Of those attacks, 16 per cent involved data being both encrypted and stolen, giving attackers multiple leverage points for extortion.

Encryption outcomes varied by organisation size. The largest organisations surveyed (3,001 to 5,000 employees) were most likely to stop attacks before encryption or extortion at 46 per cent, compared to just 34 per cent for the smallest organisations (100 to 250 employees).

“As we see ransomware criminals experiment with AI, it has the potential to accelerate their ability to steal valuable assets, hold them hostage and do it at a scale that exceeds their previous capability,” Sophos Chief Information Security Officer Ross McKerchar explained.

“This speed requires careful round-the-clock monitoring of the most exploited means of entry, which our data shows to be stolen and compromised valid accounts. However, the improvement of unguarded open-weight AI models will give attackers a growing advantage in finding and exploiting software vulnerabilities. Defenders cannot rely on patching alone to keep pace, so reducing external exposure and maintaining strong endpoint protection is essential.”

Where attacks start

For the first time, the report examined where within organisational environments attacks originated. Across incidents that started with an exploited vulnerability, compromised credentials or a brute force attack, exposed applications and systems were the most common entry point at 38 per cent, followed by user devices (30 per cent) and firewalls (21 per cent).

Compromised credential attacks were particularly dominant in exposed applications and systems at 59 per cent, while brute force attacks targeted firewalls at a rate of 44 per cent.

Firewalls played a role in detection: 61 per cent of victims reported their firewall detected the ransomware attack before the payload was deployed. Where firewalls failed to detect the attack at all (7 per cent of cases), encryption rates reached 71 per cent, compared to 50 per cent when detection occurred before deployment.

Firewall-based attacks also carried higher financial consequences. Some 59 per cent of ransom demands from attacks that started with an exploited vulnerability on the firewall were for US$1 million or more, compared to 48 per cent of all attacks.

Ransom demands and payments declining

Median ransom demands fell to US$698,000, continuing a multi-year downward trend that represents a 65 per cent drop over two years. The mean demand also fell to US$3,126,372, a 28 per cent reduction since 2024.

Demands scale with organisational revenue. Organisations with revenue under US$50 million faced median demands of approximately US$140,000, while those with revenue above US$5 billion faced median demands of US$5.7 million, suggesting attackers conduct reconnaissance to calibrate demands based on perceived ability to pay.

The UK recorded the highest median ransom demand for any country at US$2.5 million.

The median ransom payment dropped to US$769,000, down from US$1 million the previous year. Just under half (48 per cent) of payments were for US$1 million or more, down from 52 per cent in 2025. Among those that chose to pay, 51 per cent negotiated a settlement below the attackers’ initial demand, while 30 per cent paid the full amount and 18 per cent paid more.

The proportion of organisations paying the ransom to recover data fell to 48 per cent, the second-lowest rate on record after 2023 (46 per cent). Local and state government organisations (72 per cent) and media, leisure and entertainment organisations (64 per cent) were most likely to pay, while retail was least likely at 32 per cent.

Recovery costs rise despite other improvements

While organisations have improved in several areas, the average cost to recover from a ransomware attack has increased. The mean recovery cost, excluding any ransom paid, now stands at US$1,700,200 per incident, an 11 per cent increase from the US$1,525,716 average in 2025. The median recovery cost sits at US$375,000.

Recovery times, however, have improved. Over half of organisations (55 per cent) recovered within one week, with 16 per cent recovering in less than a day. Some 83 per cent recovered within one month.

Backup-based recovery surged to 66 per cent of attacks where data was encrypted, up from 54 per cent in 2025, suggesting organisations have renewed their investment in backup infrastructure.

Security gaps and skills shortages persist

Security gaps – whether known or unknown – were the most cited operational root cause for the second year running at 62 per cent, followed by lack of people or skills (58 per cent) and lack of or poor-quality protection (57 per cent).

Human error (35 per cent) was the only operational factor that increased year on year. All other factors declined.

Lack of capacity was cited heavily by small organisations in the 100-250 employee range (43 per cent), but four in 10 enterprises with 3,001 to 5,000 employees also cited capacity challenges at a rate only three percentage points lower, indicating that resourcing does not always improve with scale.

Human toll on cybersecurity teams

Almost all organisations that had data encrypted (99 per cent) reported lasting repercussions on their IT and cybersecurity teams. The most cited impacts were increased anxiety or stress about future attacks (41 per cent) and increased pressure from senior leaders (40 per cent). For more than one in five victims (21 per cent), the leadership team was replaced as a direct result of the attack.

Staff absence due to stress or mental health issues was reported by 29 per cent of affected organisations.

The only impact that rose year on year was increased recognition from senior leaders, climbing from 31 per cent to 36 per cent. Every other measured repercussion declined.

“Organisations have strengthened their ransomware resilience in the past year, and those investments are largely paying off,” McKerchar added. “However, ransomware continues to cost organisations millions. As AI becomes more capable, attackers will be able to enumerate identity misconfigurations and weak points across organisations far more cheaply and quickly than before.”

“Organisations can no longer rely on complexity or obscurity to hide gaps in their environment. The same technology also gives defenders an opportunity to find and fix those gaps faster, but only if prevention, detection and response work together as part of a unified cybersecurity strategy.”

Methodology

The survey was conducted by Vanson Bourne on behalf of Sophos in Q1 2026. Respondents were 2,158 IT and cybersecurity decision-makers from organisations hit by ransomware in the previous 12 months, drawn from 17 countries and organisations with 100 to 5,000 employees across 15 industry sectors. All financial data points are in US dollars.

The full State of Ransomware 2026 report is available at www.sophos.com.

Last Updated on July 19, 2026 by Nick Ross