Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released the 2026 Sophos Active Adversary Report.

John Shier

It reveals that 67% of all incidents investigated by Sophos Incident Response (IR) and Managed Detection and Response (MDR) teams last year were rooted in identity-related attacks.

The findings highlight how attackers continue to exploit compromised credentials, weak or missing multifactor authentication (MFA), and poorly protected identity systems, often without needing to deploy new tools or techniques.

Key findings include:

• A shift from exploited vulnerabilities toward compromised credentials, with brute-force activity (15.6%) drawing almost level with exploitation (16%) as an initial access method
• Median dwell time declined to three days. This was driven by attackers’ movements, but also by defenders reacting more swiftly. This was particularly notable in MDR environments.
• Attackers are getting faster at reaching Active Directory (AD). Once an attacker is inside an organization it takes them just 3.4 hours to get to the AD server.

·       Ransomware  remains a firmly off-hours activity. 88% of ransomware payloads are deployed out of hours, and 79% of data exfiltration actions take place out of hours, emphasising the continued need for 24/7 coverage.

• Lack of telemetry undermines defense efforts. Missing logs due to data retention issues doubled over last year. This rise was largely driven by firewall appliances where the default was only seven days, and in some cases, 24 hours.

Identity Attacks Accelerate While MFA Gaps Persist

The report shows a continued rise in attacks rooted in identity compromise, including stolen credentials, brute-force activity, and phishing. 

While exploited vulnerabilities remain a factor, attackers increasingly rely on valid accounts to gain initial access, allowing them to bypass traditional perimeter defenses. 

There was also a lack of MFA in 59% of cases, facilitating the abuse of stolen and compromised credentials to penetrate an organization.

“The most concerning finding in the report has actually been years in the making: The dominance of identity-related root causes for successful initial access.

“Compromised credentials, brute-force attacks, phishing, and other tactics leverage weaknesses that can’t be addressed by simple patch hygiene. Organizations must take a proactive approach to identity security,” said John Shier, Field CISO and lead author of the report.

More Threat Groups, Broader Risk

Sophos researchers observed the highest number of active threat groups recorded in the report’s history, expanding the overall threat landscape and increasing the challenge of attribution.

• Akira (GOLD SAHARA) and Qilin (GOLD FEATHER) were the most active ransomware brands observed, with Akira dominating across 22% of incidents
• 51 ransomware brands appeared across cases, including 27 returning brands and 24 new ones
• Only four brands or techniques, LockBit, MedusaLocker, Phobos, and abuse of BitLocker, have persisted continuously since 2020, the first year of Active Adversary Report data

“Law enforcement action continues to cause disruption in the ransomware ecosystem. Although we still see activity from LockBit, the dominance and reputation it once had has clearly been impacted.

“However, it means we are seeing a raft of other groups vying for dominance and many more emerging groups. For defenders, it’s important to understand the groups and their TTPs in order to best protect your organization,” continued Shier.

AI Hype Meets Reality

Despite widespread predictions, Sophos found no evidence of a major AI-driven transformation in attacker behavior. While generative AI has increased the speed and polish of phishing and social engineering, it has not yet produced fundamentally new attack techniques.

“AI is adding scale and noise but not yet replacing attackers. While in the future GenAI could be the next accelerator, right now the fundamentals still matter: strong identity protection, reliable telemetry, and the ability to respond quickly when something goes wrong,” said Shier.

Defensive Takeaways

Based on the findings of the 2026 Active Adversary Report, Sophos recommends organizations:

• Deploy phishing-resistant MFA and validate its configuration
• Reduce exposure of identity infrastructure and internet-facing services
• Patch known vulnerabilities promptly, especially on edge devices
• Ensure 24/7 monitoring through MDR or equivalent capabilities
• Preserve and retain security logs to support rapid detection and investigation

 The 2026 Sophos Active Adversary Report analyzed 661 IR and MDR cases handled between November 1, 2024 and October 31, 2025, spanning organizations across 70 countries and 34 industries.

You can read the full report here[SE1] . https://www.sophos.com/en-us/blog/2026-sophos-active-adversary-report 

Grey, a cross-border payments provider, has rolled out USD business accounts, bulk payments, and USDC stablecoin integration on one platform to streamline international transactions for emerging market firms.

Grey

The upgrade lets businesses open USD corporate accounts, collect from global clients, and execute payouts to 170+ countries—including bulk transfers—in minutes, slashing World Bank-noted 6-7% fees, multi-day delays, hidden charges, and forex opacity.

Idorenyin Obong, Co-founder and CEO of Grey said: “Global banking access lags for high-growth markets; we’re bridging that with faster, transparent money movement regardless of client location.”

COO Joseph Femi Aghedo added: “Unpredictable payments stall growth—Grey cuts friction for payroll, suppliers, and partners, now with USD and stablecoins for broader reach.”

Launched in Africa in 2020 with US, UK, Europe presence and recent Latin America/Southeast Asia expansion, Grey offers multi-currency accounts, cheap transfers, virtual USD cards, expense tools, and strong security.

The GSMA yesterday announced the global launch of a new Innovation Fund offering grants of £100,000 to £200,000 to support small and growing enterprises using mobile and digital technologies to accelerate the green transition in low- and middle-income countries (LMICs).

The GSMA Innovation Fund for Green Transition for Mobile (the Innovation Fund), a GSMA-funded initiative supported by its members, builds on the GSMA’s commitment to advance inclusive and sustainable connectivity, and the mobile industry’s ambition to achieve net zero emissions.

The Innovation Fund will support commercially viable innovations that expand access to clean energy and promote circularity in mobile devices – including renewable energy solutions, smart metering, refurbishment models and responsible e-waste management – to advance digital inclusion and industry climate action.

The initiative aligns with the United Nations Sustainable Development Goals, recognising the critical role of mobile technology in enabling inclusive, sustainable development.

Targeting enterprises operating across Africa, Central and South America, and South and Southeast Asia, the Innovation Fund will focus on solutions that strengthen digital inclusion, affordability and socio-economic empowerment, while delivering environmental impact.

Philippe Bellordre, Acting Head of Mobile for Development, GSMA, said: “Through this Innovation Fund, we are investing directly in enterprises that are using mobile and digital technology to advance digital inclusion and enable a clean energy transition – while also scaling practical, circular solutions that extend the life of mobile devices and make connectivity more affordable for underserved communities.”

Driving circularity and improving handset affordability

Another core focus for the Innovation Fund is extending the lifespan of mobile devices through circular economy approaches, including repair, refurbishment and reuse, reducing e-waste while increasing access to affordable handsets for underserved populations.

The Innovation Fund will support solutions such as take-back and trade-in schemes, leasing models, refurbished device marketplaces, traceability tools, and responsible e-waste collection and recycling. By keeping devices in circulation for longer, these initiatives lower environmental impact while reducing the cost of ownership and expanding connectivity for low-income communities.

Building evidence for industry climate action

Beyond supporting individual enterprises, the Innovation Fund is designed to generate practical insights and lessons that contribute to the mobile industry’s wider climate and ESG priorities. This includes evidence that supports enabling environments for clean energy and circular economy solutions, informs policy discussions, and helps scale sustainable business models across emerging markets.

Who the Innovation Fund is for:

The Innovation Fund is open to for-profit small and growing enterprises with up to 250 employees that are:

• Operating in LMICs across Africa, Central and South America, or South and Southeast Asia

• Using mobile or digital technology as a core part of their solution

• Demonstrating commercial revenue and active users

• Able to contribute at least 25% matching funding

What the Innovation Fund provides:

Selected enterprises will receive:

• Grants of £100,000 to £200,000 over 15-18 months

• Technical assistance

• Support to connect with investors and build partnerships with mobile network operators

• Monitoring, evaluation and learning support

• Visibility through GSMA platforms, publications and industry engagement