Ransom demands are down, email is the top way attackers get in

State of Ransomware 2026 (Sophos) reports that phishing and stolen credentials now account for about half of ransomware incidents and that nearly eight in ten attacks opened with an identity-based action; exploited software flaws declined to 18% but may rebound with AI-driven discovery. The survey of 2,158 victims found average cleanup costs around $1.7M, encryption in 56% of cases, falling ransom demands/payments, greater reliance on backups for recovery, and significant operational impacts on security teams including stress and leadership turnover.