The ransomware landscape is undergoing a significant transformation. While cybercriminals continue to extract millions from impacted organizations, sustained investments in defensive measures are finally yielding better outcomes.
Sophos released The State of Ransomware 2026, its seventh annual report analyzing the real-world experiences of 2,158 IT and cybersecurity leaders across 17 countries. The data reveal a story of costly impact paired with genuine defensive progress.
For executives and board members, the report highlights two distinct trends: the operational financial costs of recovery are climbing, even as ransom demands and payments drop drastically.
Over the last two years, organizations have gotten significantly better at negotiating with attackers and refusing outrageous extortion attempts.
-
Demands down 65%: The median ransom demand fell to $698,000, down from $1.32 million in 2025 and $2 million in 2024.
-
Payments down 62%: The median ransom payment dropped to $769,000 (down from $1 million in 2025).
-
Negotiation leverage: 51% of organizations that paid a ransom negotiated a discount off the original demand. The median payment was 90% of the initial demand.
-
Resilience through backups: The proportion of victims paying a ransom fell to 48%, while 66% recovered encrypted data using backups—a 12% jump from 2025. Here are some metrics from 2024, 2025, and 2026, for comparison's sake:
-
Median ransom demand: 2024: $2M; 2025: $1.32M; 2026: $698K
-
Median ransom payment: 2024: N/A; 2025: $1M; 2026: $769K
-
Used backups to restore: 2024: 68%; 2025: 54%; 2026: 66%
-
Paid ransom to restore: 2024: 56%; 2025: 49%; 2026: 48%
"This data confirms what we've been saying: 79% of ransomware attacks start with identity—nearly double malicious email and phishing combined. That's exactly why those like us in the industry have been ringing the identity bell for years," said Chandra Gnanasambandam, CTO at SailPoint. "This is the new normal. Attacks that once took a year to succeed now take about an hour, cybercrime has industrialized, and with 95% of access still standing rather than granted just in time, identity is the obvious weak point. It's why security is undergoing one of its biggest shifts, moving from 25 years of human-centered defense to a human-plus-AI world that demands adaptive identity and zero standing privilege as baseline."
While paying ransoms is becoming less common, recovering from an attack isn't getting cheaper. Excluding any ransom paid, the average cost to recover from a ransomware attack rose 11% to $1.7 million (up from $1.53 million in 2025). Downtime, device replacement, network fixes, and lost revenue remain the true drivers of financial damage.
For defenders on the front lines, the 2026 report marks a structural shift in how ransomware gains access to target networks.
After three consecutive years as the top entry vector, exploited vulnerabilities dropped 14 percentage points to 18%. Instead, identity compromise is now the leading delivery mechanism.
-
Email-based attacks rule: Malicious email (26%) and phishing (24%) now account for half of all ransomware root causes.
-
Identity overlap: 67% of ransomware victims confirmed their ransomware incident was directly tied to their organization's most significant identity breach.
-
MFA alone isn't stopping attacks: In incidents where compromised credentials were the root cause, 97% of organizations had MFA deployed in some capacity. Attackers are actively exploiting gaps in partial rollouts or bypassing traditional MFA methods.
The survey revealed that perimeter security devices are crucial for stopping payloads before encryption occurs.
-
61% of firewalls detected the attack before the ransomware payload was deployed.
-
When a firewall failed to identify the attack, 71% of organizations suffered full data encryption, compared to 50% when detected early.
-
High-value targets: Attacks starting with an exploited firewall vulnerability saw higher ransom demands, with 59% asking for $1 million or more.
"Stolen credentials are now the dominant ransomware entry point, and the trend is accelerating. Once attackers obtain a legitimate identity, they can move through an environment undetected, escalating privileges and staging ransomware before most teams know something is wrong," Shane Barney, CISO at Keeper Security. "Organizations need to recognize that identity is now the primary security perimeter. Strong password policies, MFA, and continuous monitoring remain foundational, but they're no longer sufficient on their own. Security teams need visibility into who is accessing critical systems, whether that access is appropriate and how privileged accounts are being used. Applying least-privilege principles, eliminating standing administrative access and continuously validating identities significantly reduces the opportunities attackers have to abuse stolen credentials."
Barney added, "The goal isn't just stopping the initial breach. It's limiting the blast radius when credentials are compromised. Organizations that can't see who has access to what, and can't revoke it fast, will keep finding out after the fact. That's what zero trust and strong identity governance are designed to prevent."
Ransomware is no longer just a technical issue—it carries severe human costs and impacts the everyday services communities rely on.
The stress placed on defenders behind the scenes is near-universal. Ninety-nine percent of organizations that had data encrypted reported lasting impacts on their IT and cybersecurity personnel.
-
41% reported heightened anxiety and stress regarding future attacks.
-
40% faced increased pressure from senior leadership.
-
21% saw their entire IT/cybersecurity leadership team replaced as a direct consequence.
Public sector and critical services face the highest pressure
Not all sectors fare equally when hit by ransomware. Organizations providing vital public services were the most likely to pay ransoms due to acute pressure to restore operations.
-
Local/State Government: 72% paid the ransom.
-
Media, Leisure, & Entertainment: 64% paid the ransom.
-
Retail: By contrast, only 32% of retail organizations paid, proving far more willing to rely on backups and weather operational downtime.
To stay ahead of AI-augmented threats and identity-based intrusions, Sophos recommends that organizations focus on the following foundational controls.
-
Prioritize Identity Threat Detection & Response (ITDR): Audit human and non-human credentials regularly and ensure comprehensive MFA implementation across all access points.
-
Focus heavy defenses on email: Deploy advanced filtering, enforce email authentication protocols (DMARC, DKIM, SPF), and run realistic phishing simulations.
-
Integrate telemetry via XDR/MDR: Connect firewall telemetry to Managed Detection and Response (MDR) or Extended Detection and Response (XDR) tools to catch suspicious lateral movement before encryption happens.
-
Maintain offline, immutable backups: Regularly test data restoration protocols to ensure your organization can recover without negotiating with threat actors.
We asked some solution provider leaders for additional comments.
James Maude, Field CTO at BeyondTrust, said:
"In order to effectively deal with ransomware and other threats, we need to invest more in shifting left. We must think more about securing identities and access to reduce our attack surface and blast radius in the event of compromise, rather than just thinking post-breach. Ransomware and other threats are only as effective as the privileges and access they manage to acquire. Therefore, if we can implement better hygiene and focus on least privilege, then threat actors are far less likely to ransomware us in the first place."
Trey Ford, Chief Strategy and Trust Officer at Bugcrowd, said:
"Criminals have established a scalable business model, and we expect to see ransomware attack volume continue to grow. We also need to bear in mind that there will be a gap in reported incidents versus overall ransomware incidents. Larger targets, with bigger payout potential, will have seen the most aggressive corporate investment (process and technology) mitigating exposure to this attack pattern—it is still an unsolved space."
Mika Aalto, Co-Founder and CEO at Hoxhunt, said:
"Phishing is rarely the end goal. It's typically the front door to something much bigger, including data theft, cloud compromise, or ransomware. Here's an analogy: If ransomware is the explosion, phishing is often the spark."
"Recent research found a step change at the turn of 2025 to 2026, when AI-generated phishing surged 14-fold almost overnight. The big shift isn't brand-new tactics and zero-day messaging, it's the modernization of old attacks. Traditional phishing kits are being upgraded with cleaner formatting, better writing, and more personalized messaging that can be generated at scale. Phishing never really went away, it simply got an upgrade. With that being said, people are trained to obey authority, and phishing attacks are designed to push people into bypassing normal checks. Organizations need to normalize 'see something, say something' behavior and make verification frictionless."
"Phishing has evolved beyond static text, and awareness must do the same. The entire concept of 'security awareness training' is outdated if it stops at awareness. The next generation of defense is behavioral, not informational. We're moving from telling people what to do to shaping what they actually do, in real time. We are building an essential set of security reflexes and instincts."
