Sophos incident research: ransomware often launches outside working hours, so retain logs long enough
Sophos published its 2026 report based on incident response and MDR investigations, identifying identity weaknesses, out-of-hours activity and telemetry gaps as continuing issues. It notes that short device log retention periods hinder investigations.
Source Facts
Sophos says that, among incidents it investigated in the previous year, 67% of root causes involved identity attacks and 88% of ransomware payloads were deployed outside working hours. These percentages reflect the company's cases and cannot directly represent all organisations.
The research also observed more cases of missing logs due to retention limits, with some firewalls retaining records for only a short period. It recommends retaining security logs, strengthening phishing-resistant MFA and providing round-the-clock monitoring and response capabilities.
Who receives overnight alerts, escalation conditions and log storage locations matter more to actual response than simply enabling alerts.
Original sources
Sophos Active Adversary Report 2026: Identity attacks dominate as threat groups proliferate
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
IllustrationLiteLLM explains package compromise: exposed keys must be revoked to complete the response
Illustration