Sophos: 8 in 10 ransomware attacks start with compromised identities

Compromised identities have become the leading entry point for ransomware attacks, overtaking exploited software vulnerabilities as cybercriminals increasingly rely on malicious email and phishing campaigns to gain access to organisations, according to Sophos’ State of Ransomware 2026 report. Based on a survey of 2,158 IT and cybersecurity decision-makers across 17 countries, including the UAE, the report found that 79 percent of ransomware attacks globally now originate from compromised identit