Sophos Active Adversary Report 2026: “Identity attacks dominate”

The findings highlight how attackers continue to exploit compromised credentials, weak or missing multifactor authentication (MFA) and poorly protected identity systems, often without needing to deploy new tools or techniques.

There has been a shift from exploited vulnerabilities towards compromised credentials, with brute force activity (15.6%) drawing almost level with exploitation (16%) as an initial access method.

Median dwell time has declined to three days. This was driven by attackers’ movements, but also by defenders reacting more swiftly. This was particularly notable in MDR environments.

Attackers are becoming faster at reaching Active Directory (AD). Once an attacker is inside an organisation, it takes them just 3.4 hours to reach the AD server.

Ransomware remains a firmly off-hours activity. 88% of ransomware payloads are deployed during non-business hours. Similarly, 79% of data exfiltration actions take place in off-hours periods.

The lack of telemetry undermines defence efforts. Missing logs due to data retention issues doubled over last year. This rise was largely driven by firewall appliances where the default was only seven days (and, in some cases, 24 hours).

Identity attacks accelerate

The Sophos report shows a continued rise in attacks rooted in identity compromise, including stolen credentials, brute force activity and phishing. While exploited vulnerabilities remain a factor, attackers increasingly rely on valid accounts to gain initial access, allowing them to bypass traditional perimeter defences.

There was also a lack of MFA in 59% of cases, facilitating the abuse of stolen and compromised credentials to penetrate an organisation.

“The most concerning finding in the report has actually been years in the making,” said John Shier, field Chief Information Security Officer at Sophos and lead author of the document. “It’s the dominance of identity-related root causes for successful initial access. Compromised credentials, brute force attacks, phishing and other tactics leverage weaknesses that cannot be addressed by simple patch hygiene. Organisations must take a proactive approach towards identity security.”

Sophos researchers have observed the highest number of active threat groups recorded in the report’s history, expanding the overall threat landscape and increasing the challenge of attribution.

Akira (GOLD SAHARA) and Qilin (GOLD FEATHER) were the most active ransomware brands observed, with Akira dominating across 22% of incidents. 51 ransomware brands appeared across cases, including 27 returning brands and 24 new ones. Only four brands or techniques (ie LockBit, MedusaLocker, Phobos and abuse of BitLocker) have persisted continuously since 2020, which was the first year of Active Adversary Report data.

“Law enforcement action continues to cause disruption in the ransomware ecosystem,” added Shier. “Although we still see activity from LockBit, the dominance and reputation it once had has clearly been impacted. However, it means we are seeing a raft of other groups vying for dominance and many more emerging groups. For defenders, it’s important to understand the groups and their TTPs in order to best protect their organisation.” 

AI hype meets reality

Despite widespread predictions, Sophos found no evidence of a major Artificial Intelligence (AI)-driven transformation in attacker behaviour. While generative AI has increased the speed and polish of phishing and social engineering, it has not yet produced fundamentally new attack techniques.

“AI is adding scale and noise, but not yet replacing attackers,” affirmed Shier. “While in the future GenAI could be the next accelerator, right now the fundamentals still matter: strong identity protection, reliable telemetry and the ability to respond quickly when something goes wrong.”

Based on the findings of the 2026 Active Adversary Report, Sophos recommends that organisations:

*deploy phishing-resistant MFA and validate its configuration

*reduce the exposure of identity infrastructure and Internet-facing services

*patch known vulnerabilities promptly (and notably so on edge devices)

*ensure 24/7 monitoring through MDR or equivalent capabilities

*preserve and retain security logs to support rapid detection and investigation

The 2026 Sophos Active Adversary Report analysed 661 IR and MDR cases handled between 1 November 2024 and 31 October last year spanning organisations across 70 countries and 34 separate industries.

*Further information is available online at www.sophos.com