Sophos ransomware survey: email and phishing are major entry points, while recovery costs remain important
Sophos's seventh annual ransomware report surveyed 2,158 IT and security leaders whose organisations had experienced ransomware. Malicious email and phishing together accounted for half of incidents. Recovery burdens remained significant even as some ransom measures declined.
Source Facts
Sophos's 2026 survey sampled organisations affected by ransomware in the preceding twelve months. Respondents attributed 26% of root causes to malicious email, 24% to phishing and 18% to vulnerability exploitation. These are survey findings, not a census of every incident worldwide.
The report says backup restoration improved among cases where data was encrypted, but average recovery costs still rose. It also notes that some victims had MFA yet retained coverage gaps in VPNs, management consoles or legacy systems.
Security budgets should cover email, accounts and recovery exercises together, rather than treating vulnerability patching alone as a complete defence.
Original sources
The State of Ransomware 2026: Payments Drop as Encryption Climbs
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
IllustrationLiteLLM explains package compromise: exposed keys must be revoked to complete the response
Illustration