Sophos' State of Ransomware 2026 report, based on a survey of 2,158 IT and cybersecurity leaders across 17 countries, finds identity — not vulnerability exploitation — is now the dominant root cause of ransomware incidents. Malicious email (26%) and phishing (24%) together account for half of all root causes, while vulnerabilities have fallen to 18% from 32%. The data also exposes a hard truth about MFA: compromised credentials drove 23% of attacks even though MFA was deployed in 97% of those cases.

Email and phishing dethrone a three-year vulnerability streak

According to the survey, malicious email (26%) and phishing (24%) displaced vulnerabilities as the top initial access vectors, ending what had been a three-year run of vulnerability exploitation leading the list. Vulnerabilities now account for 18% of root causes, down from 32% a year earlier. Two-thirds (67%) of victims said the ransomware attack they experienced was the most significant identity attack they suffered over the past year.

The report also tracks attack success and economics: 56% of ransomware attacks successfully encrypted victim networks, while ransom demands and payments declined.

Compromised credentials and the MFA gap

The third most common root cause was also identity-related — compromised credentials, used in 23% of cases. The most startling figure concerns the security control meant to stop exactly this: MFA was deployed in 97% of instances where compromised credentials were the root cause of a ransomware attack, and the attackers still got in.

One-time passwords, push-based applications, and passkeys were the most commonly deployed secondary authentication mechanisms, according to the survey. FIDO2 tokens — widely regarded as the gold standard for phishing-resistant authentication — ranked only fourth.

Sophos offered two explanations for why MFA failed:

"The high percentage of ransomware victims that had MFA deployed at the time of the attack indicates that it may not have been fully deployed across all relevant systems, creating gaps for attackers to exploit. It also suggests that, while MFA remains an essential element of effective cyber defense strategies, it is not sufficient on its own to prevent credential-based attacks as bypass techniques continue to evolve."

The takeaway: the MFA failure is likely one of incomplete deployment and incomplete inventorying rather than a flaw in the mechanism itself.

Detection and mitigation

Sophos' recommendations center on defense beyond patching:

"Organizations should prioritize identity threat detection and response (ITDR), enforce multifactor authentication across all access points, and regularly audit both human and non-human identity credentials."

For email-borne attacks specifically, the report urges advanced email filtering, deployment of DMARC/DKIM/SPF protocols, and regular phishing awareness training, warning that "technical vulnerability patching alone is insufficient."

Chet Wisniewski, director and global field chief information security officer (CISO) at Sophos, said the best-performing organizations practice what he calls "aggressive defense-in-depth":

"Every layer of defense, even if it can be bypassed, is a speed bump, an alert, or a potential clue to trigger a threat hunt. Usually this looks like using segmentation to slow down the attackers, deployment of [zero-trust network access, or ZTNA] to replace legacy VPNs to contain app exploits, and 24/7 threat detection and response capabilities."

Technical background: why MFA gets bypassed

This section provides general context on the class of attacks behind the report's findings; it is not derived from incident specifics in the survey.

Modern credential-phishing campaigns rarely stop at stealing a password. Reverse-proxy "adversary-in-the-middle" (AiTM) kits sit between the victim and the legitimate identity provider, relaying the login attempt in real time. When the victim completes a challenge — entering a one-time password or approving a push notification — the proxy captures the session cookie or token alongside the credentials, then replays the session into the victim's cloud or VPN environment. The user has genuinely satisfied MFA, so the login succeeds, and the attacker inherits the authenticated session.

Weaker factors amplify the problem. Push-based approval can be beaten by "push fatigue," where attackers bombard users with notifications until they approve one; OTPs can be harvested by the same relay technique. Passkeys and FIDO2 tokens are phishing-resistant precisely because they bind authentication to the origin domain, so a relay proxy cannot replay them — which is why the report's finding that they were not the most widely deployed factor matters.

A practical defensive habit, generic to any identity provider's sign-in logs, is to hunt for anomalous MFA completions — for example, new device enrollments that immediately precede a successful authentication during a suspected phishing window. Enforcing phishing-resistant factors (FIDO2 or passkeys) on privileged and high-value accounts, forcing session invalidation on sign-out, and shortening session lifetimes all shrink the window in which a stolen token remains usable.