23
Sophos today released the 2026 Sophos Active Adversary Report. It reveals that 67% of all incidents investigated by Sophos Incident Response (IR) and Managed Detection and Response (MDR) teams last year were rooted in identity-related attacks. The findings highlight how attackers continue to exploit compromised credentials, weak or missing multifactor authentication (MFA), and poorly protected identity systems — often without needing to deploy new tools or techniques.
Key findings include:
- A shift from exploited vulnerabilities toward compromised credentials, with brute-force activity…
