Sophos State of Ransomware 2026 Report
Analysis based on 8 articles · First reported Jul 15, 2026 · Last updated Jul 21, 2026
The report highlights a shift in ransomware tactics toward identity-based attacks, which may increase demand for identity threat detection and response solutions. The rising recovery costs and encryption rates underscore the financial burden on organizations, potentially boosting spending on cybersecurity products and services.
Sophos released its seventh annual State of Ransomware report, based on a survey of 2,158 IT and cybersecurity decision-makers across 17 countries. The report reveals that compromised identities are now the dominant initial access vector for ransomware attacks, accounting for 79% of incidents, surpassing exploited vulnerabilities for the first time in four years. Malicious email (26%) and phishing (24%) are the top identity-related vectors. The report also notes that 56% of ransomware attacks succeeded in encrypting data, up from 50% in 2025. The average recovery cost per incident rose to $1.7 million, while median ransom demands dropped 65% over two years. The UK recorded the highest median ransom demand at $2.5 million. Sophos also introduced Sophos Fusion, an AI-native cybersecurity platform built on technology from Secureworks, which it acquired in 2025.
Set up alerts, explore entity relationships, search across thousands of events, and build custom intelligence feeds.
Open Dashboard