Sophos 2026: identity is now the way in, and backups are the way out

This is a survey of victims rather than a telemetry report, and the sample is worth stating: 2,158 IT and security leaders in 17 countries, organisations of 100 to 5,000 employees, interviewed between January and March 2026 about the preceding twelve months. That is a narrower and more useful population than the usual vendor headline.

Identity, not vulnerabilities

79% of attacks began with an identity-based approach. Broken down: malicious email 26%, phishing 24%, compromised credentials 23%, exploited vulnerabilities 18%, brute force 6%. Vulnerability exploitation still matters — the five advisories above exist for a reason — but it is now less than a fifth of the way in.

The finding that should reshape budgets is this one: 97% of organisations breached through compromised credentials had MFA enabled at the time. MFA is not failing as a concept. It is failing at the edges — legacy protocols, service accounts, VPN consoles, administrative interfaces — and attackers have industrialised finding those edges. Sophos pairs this with its own incident data showing MFA absent specifically where it was needed in 59% of cases.

The economics inverted

Median ransom demand fell to USD 698,000, down 65% over two years. Median payment was USD 769,000. Meanwhile average recovery cost rose 11% year on year to USD 1.7 million, encryption succeeded in 56% of attacks (up from 50%), and 48% of encrypted victims paid.

Read those together and the conclusion is that ransoms are getting cheaper while recovery is getting more expensive. The money is moving out of the extortion payment and into the rebuild — which means the return on investment sits with the controls that shorten the rebuild.

Backups are now the majority recovery path

66% of organisations with encrypted data recovered from backups, up from 54% the previous year. That is a genuine industry improvement and it is the number we would point a board at.

It comes with a caveat. Recovery took a week or less for 55%, a month or less for 83%, and averaged three weeks. Three weeks of degraded operations is a business-continuity event whatever your backup posture. A backup you have never restored at full scale is a forecast, not a control — and the gap between the forecast and the three-week average is where most of the USD 1.7 million lives.

One more figure for smaller organisations: they stopped 34% of attacks before encryption or extortion, against 46% at larger ones. The gap is monitoring coverage, not tooling.

A second data set points the same way

Coveware's Q2 2026 incident-response figures, published independently in July, show the average payment nearly tripling to USD 1,880,612 while the median halved to USD 150,000 — a handful of very large settlements on top of a market where most victims paid little or refused. The overall payment rate hit a record low, and only 15% of victims facing data-theft-only demands paid, which Coveware describes as historically low.

Read alongside Sophos, the direction is consistent across two different methodologies: extortion leverage is weakening, recovery capability is the variable that decides the outcome, and identity is the way in. Coveware also documented victims who paid being re-extorted, or finding their data had not been deleted — which is the argument for planning on the assumption of publication regardless of what you decide to pay.

← All advisories