Hackers Are Logging In, Not Breaking In: New Data from the 2026 Sophos Report
Cyberattacks are changing shape. Instead of breaking in through new software flaws, many attackers are logging in with stolen credentials.
That is the headline finding from the 2026 Sophos Active Adversary Report, which analyzed 661 incident response and managed detection cases across 70 countries. Last year, 67% of all incidents investigated were rooted in identity-related attacks. In simple terms: hackers are abusing usernames and passwords.
Brute-force attacks accounted for 15.6% of initial access methods, nearly matching exploitation of vulnerabilities at 16%. In many cases, attackers did not need new tools. They used valid accounts to slip past traditional defenses.
Multifactor authentication [MFA] gaps remain a major weakness. In 59% of cases, MFA was not enabled. That left organizations exposed to stolen or guessed credentials.
Attackers are also moving faster. Once inside a network, it now takes a median of just 3.4 hours to reach Active Directory, the core identity system in many organizations. Overall median dwell time the period between intrusion and detection fell to three days. Faster response by defenders, especially in managed detection environments, helped drive that drop.
Ransomware remains largely an after-hours crime. The 2026 Sophos report found that 88% of ransomware payloads were deployed outside normal working hours. Data theft followed a similar pattern, with 79% of exfiltration happening off-hours. The trend reinforces the need for round-the-clock monitoring.
2026 Sophos Report Key Highlights
| Metric | 2026 Finding |
| Identity-Based Attacks | 67% of all investigated incidents |
| MFA Status | 59% of victims had MFA disabled |
| Median Dwell Time | Dropped to 3 days |
| Ransomware Timing | 88% deployed outside working hours |
| New Ransomware Brands | 24 new variants identified this year |
At the same time, defensive blind spots are growing. Missing logs due to short data retention periods doubled over the past year. In many cases, firewalls kept logs for only seven days sometimes just 24 hours limiting investigators’ ability to reconstruct attacks.
According to the 2026 Sophos Report the ransomware landscape is also more crowded. Researchers observed 51 different ransomware brands, including 24 new ones. Akira and Qilin were the most active, while only a handful of names such as LockBit have persisted since 2020.
Despite intense debate about artificial intelligence, the report found no major AI-driven shift in attacker tactics. Generative AI has made phishing faster and more polished. But it has not yet changed the fundamentals.
2026 Sophos Report recommends having strong identity controls, phishing-resistant MFA, proper log retention and 24/7 monitoring remain the core defenses. The basics still matter perhaps now more than ever.
