Sophos

Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released the 2026 Sophos Active Adversary Report. It reveals that 67% of all incidents investigated by Sophos Incident Response (IR) and Managed Detection and Response (MDR) teams last year were rooted in identity-related attacks. The findings highlight how attackers continue to exploit compromised credentials, weak or missing multifactor authentication (MFA), and poorly protected identity systems — often without needing to deploy new tools or techniques. Key findings include: • A shift from exploited vulnerabilities toward compromised credentials, with ...