Identity Attacks Overtake Exploits as Top Ransomware Cause

Sophos' State of Ransomware 2026 survey of 2,158 IT and security leaders across 17 countries finds identity-based attacks — malicious email, phishing, and compromised credentials — are now the dominant root causes of ransomware (accounting for roughly half of cases), with many victims reporting successful encryption despite MFA being deployed; Sophos recommends prioritizing identity threat detection and response, enforcing MFA broadly, inventorying credentials, and implementing defense-in-depth measures like segmentation, ZTNA, and 24/7 detection.