Sophos has released its seventh annual ‘State of Ransomware 2026’ report, based on a survey of IT and cyber security leaders across 17 countries whose organizations had experienced ransomware during the previous 12 months. The research examines the impact of ransomware on organizations and their ability to defend against it. The report finds that identity-based approaches were the dominant initial access route, with four in five (79%) ransomware attacks beginning this way.
The findings underscore the role of identity in ransomware delivery. For the first time in four years, exploited vulnerabilities were no longer the most commonly reported root cause. Malicious email, at 26%, and phishing, at 24%, occupied the top two positions, while compromised credentials accounted for 23%.
However, exploited vulnerabilities remained associated with high-value ransom demands: 59% of demands following attacks that began with the exploitation of a firewall vulnerability were for US$1 million or more, compared with 48% of all demands.
Other findings include:
- Two-thirds of ransomware victims (67%) reported that their ransomware incident was also their most significant identity attack, demonstrating a strong overlap between ransomware and identity compromise.
- More than half of ransomware attacks (56%) resulted in data encryption, including 16% in which data were both encrypted and stolen. The encryption rate rose from 50% in 2025 but remained below the 76% recorded in 2023.
- Among organizations whose data were encrypted, 48% paid the ransom, bringing the four-year average payment rate following encryption to 50%.
- Only 34% of small organizations with 100 to 250 employees stopped attacks before encryption or extortion, compared with 46% of organizations with 3,001 to 5,000 employees.
- Among incidents in which compromised credentials were identified as the root cause, 97% involved organizations that had MFA enabled in some capacity. This indicates that deploying MFA does not, by itself, guarantee protection and suggests that incomplete coverage or evolving bypass techniques may leave exploitable gaps.
- The UK recorded the highest median ransom demand among the countries surveyed, at US$2.5 million.
While organizations continue to face prevention challenges as threat actors evolve their techniques, the findings indicate some potential improvements in recovery. More than half of organizations (55%) fully recovered within one week, including 16% in less than a day.
Many organizations that paid a ransom secured a settlement below the attackers’ initial demand: 51% paid less than the amount originally demanded. Median ransom demands fell by 65% over two years, while the proportion of organizations paying a ransom to recover encrypted data fell to 48% – the lowest rate in the last three years.
Despite the decline in ransom demands, the mean cost of recovering from an attack increased to US$1.7 million per incident, excluding any ransom paid.
Sophos recommends the following practices to help organizations build integrated, AI-driven defences that bring together technology, people, and processes:
- Treat identity as a foundational security layer: organizations should prioritize identity threat detection and response (ITDR), enforce phishing-resistant MFA across all relevant access points, and regularly audit human and non-human identities.
- Invest in backup and recovery infrastructure: backups should be tested regularly, stored offline or in immutable formats, and integrated into a documented incident response plan that can be executed under pressure.
- Maintain exposure management programmes: organizations should maintain rigorous patching schedules, prioritize internet-facing assets, and consider how emerging AI-assisted tools can accelerate vulnerability identification and remediation.
- Reduce exposure through firewalls and use firewall telemetry to detect attacks early: ensure that firewalls receive rapid – ideally automated – updates and minimise internet-facing services such as administrator access and user portals. Connect firewalls to extended detection and response (XDR) and managed detection and response (MDR) solutions so that firewall telemetry can help detect ransomware attacks before payloads are deployed.
Methodology
The survey was conducted by Vanson Bourne on behalf of Sophos during the first quarter of 2026. It involved 2,158 IT and cyber security decision-makers from organizations that had experienced ransomware during the previous 12 months. Respondents were based in 17 countries: the US, Brazil, Chile, Colombia, Mexico, the UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and the UAE. They represented organizations with 100 to 5,000 employees across 15 industry sectors.
