Sophos, a global leader of innovative security solutions for defeating cyberattacks, has released the 2026 Sophos Active Adversary Report. The report analysed 661 Incident Response and Managed Detection and Response cases handled between November 2024 and October 2025, spanning organisations across 70 countries and 34 industries. It reveals that 67% of all incidents investigated by Sophos Incident Response and Managed Detection and Response teams last year were rooted in identity-related attacks.
Key findings include:
- A shift from exploited vulnerabilities toward compromised credentials, with brute-force activity (15.6%) drawing almost level with exploitation (16%) as an initial access method
- Median dwell time declined to three days. This was driven by attackers’ movements but also by defenders reacting more swiftly. This was particularly notable in Managed Detection and Response environments.
- Attackers are getting faster at reaching Active Directory. Once an attacker is inside an organization it takes them just 3.4 hours to get to the Active Directory server.
- Ransomware remains a firmly off-hours activity. 88% of ransomware payloads are deployed during non-business hours. Similarly, 65% of data exfiltration actions take place in off-hours.
- Lack of telemetry undermines defence efforts. Missing logs due to data retention issues doubled over last year. This rise was largely driven by firewall appliances where the default was only seven days and in some cases 24 hours.
Identity attacks accelerate while MFA gaps persist
The report shows a continued rise in attacks rooted in identity compromise, including stolen credentials, brute-force activity and phishing. While exploited vulnerabilities remain a factor, attackers increasingly rely on valid accounts to gain initial access, allowing them to bypass traditional perimeter defences. There was also a lack of MFA in 59% of cases, facilitating the abuse of stolen and compromised credentials to penetrate an organization.
John Shier, Field CISO and lead author of the report, said: “The most concerning finding in the report has actually been years in the making: The dominance of identity-related root causes for successful initial access. Compromised credentials, brute-force attacks, phishing, and other tactics leverage weaknesses that can’t be addressed by simple patch hygiene. Organizations must take a proactive approach to identity security.”
More threat groups, broader risk
Sophos researchers observed the highest number of active threat groups recorded in the report’s history, expanding the overall threat landscape and increasing the challenge of attribution.
Shier said: “Law enforcement action continues to cause disruption in the ransomware ecosystem. Although we still see activity from LockBit, the dominance and reputation it once had has clearly been impacted. However, it means we are seeing a raft of other groups vying for dominance and many more emerging groups. For defenders, it’s important to understand the groups and their TTPs in order to best protect your organization.”
AI hype meets reality
Despite widespread predictions, Sophos found no evidence of a major AI-driven transformation in attacker behaviour. While Generative AI has increased the speed and polish of phishing and social engineering, it has not yet produced fundamentally new attack techniques.
Shier said: “AI is adding scale and noise but not yet replacing attackers. While in the future GenAI could be the next accelerator, right now the fundamentals still matter: strong identity protection, reliable telemetry, and the ability to respond quickly when something goes wrong.”
Defensive takeaways
Based on the findings of the 2026 Active Adversary Report, Sophos recommends organisations:
- Deploy phishing-resistant MFA and validate its configuration
- Reduce exposure of identity infrastructure and Internet-facing services
- Patch known vulnerabilities promptly, especially on edge devices
- Ensure 24/7 monitoring through Managed Detection and Response or equivalent capabilities
- Preserve and retain security logs to support rapid detection and investigation
