Two-thirds of security incidents are now traced back to identity-related weaknesses as attackers move faster and strike after hours.
Sophos, a global leader in innovative security solutions, has released its 2026 Active Adversary Report, revealing that 67% of all incidents investigated by Sophos Incident Response (IR) and Managed Detection and Response (MDR) teams last year were rooted in identity-related attacks.
These findings highlight how attackers exploit compromised credentials, weak or missing multifactor authentication (MFA), and poorly protected identity systems without needing to deploy new tools.
Several critical trends emerged from the analysis of 661 cases across 70 countries. There is a visible shift from exploited vulnerabilities toward compromised credentials, with brute-force activity now nearly as common as software exploitation for initial access. Once inside an organization, attackers are reaching Active Directory (AD) servers in just 3.4 hours. Furthermore, the median dwell time for intruders has declined to only three days.
The timing of these attacks remains a significant factor for defenders. Ransomware is firmly an “off-hours” activity, with 88% of payloads deployed and 79% of data exfiltration occurring outside of standard business hours. Defense efforts are also being undermined by a lack of telemetry, as missing logs due to short data retention periods on firewall appliances doubled over the last year.
Despite the known risks, 59% of investigated cases showed a total lack of MFA, which facilitated the abuse of stolen credentials.
John Shier, Field CISO at Sophos, noted that the dominance of identity-related root causes has been years in the making. He emphasized that tactics like phishing and brute-force attacks leverage human and systemic weaknesses that simple patch hygiene cannot fix.
The report observed the highest number of active threat groups in its history. While law enforcement has disrupted major players like LockBit, a raft of other groups is now vying for dominance. Sophos identified 51 different ransomware brands, with Akira and Qilin being the most active. Regarding the role of Artificial Intelligence, researchers found that while GenAI has increased the speed and polish of phishing, it has not yet produced fundamentally new attack techniques.
To counter these evolving threats, Sophos recommends that organizations prioritize several key security measures. First, they should strengthen identity by deploying phishing-resistant MFA and reducing the exposure of identity infrastructure. It is also essential to maintain vigilance by ensuring 24/7 monitoring through MDR services to catch off-hours ransomware activity. Additionally, organizations must improve visibility by preserving and retaining security logs to support rapid detection and investigation. Finally, security teams should continue to patch known vulnerabilities quickly, particularly on edge devices.