- › Sophos found 67% of the incidents its response teams handled last year were rooted in identity attacks, across 661 cases in 70 countries.
- › Brute-force activity (15.6%) has drawn almost level with exploitation (16%) as an initial access method. The adversary is trying the door as often as the window.
- › There was a lack of MFA in 59% of cases. The most common identity failure is not a clever bypass, it is that the control was never there.
- › Once inside, attackers reach the Active Directory server in about 3.4 hours, and median dwell time is down to three days. The window to catch them is short.
- › 88% of ransomware payloads are deployed during non-business hours, because the adversary picks the moment your staffing is thinnest.
Think about how a burglar actually works. The movies show a glass cutter and an alarm panel getting hot-wired, and that is a fine story. The real professional does something duller. He gets a key, walks up to the door in daylight, and lets himself in, because the door does not care who is holding the key. Nobody hears anything break. The alarm never trips. The only trace is a log entry that says the door opened at 2:14, which it does forty times a day.
That is where the security industry actually is right now, and the numbers finally say it out loud. Sophos analyzed 661 incident response and managed detection cases across 70 countries and 34 industries, and found that 67% of them were rooted in identity-related attacks (Sophos Active Adversary Report, 2026). Two out of three incidents did not start with someone defeating your technology. They started with someone using it exactly as designed, with a credential that worked.
The Economics Made This Inevitable
Put yourself in the adversary’s chair for a minute and price out your options, because they are running a business with a cost structure just like you are.
Option one is exploitation. You need a working exploit for something the target actually runs and has not patched. If it is a zero-day, you are burning an asset worth six or seven figures, and the moment you use it the clock starts on it being discovered and killed. Your payload has to survive endpoint detection that gets better every year, watched by people paid to notice. It is expensive, it is loud, and it is a wasting asset.
Option two is a credential. You buy it from a broker for the price of a sandwich, or you pull it out of an infostealer log, or you phish it, or you just try common passwords against an exposed service until one works. Then you log in. There is no exploit to detect because you did not exploit anything. There is no malware for the endpoint agent to flag at the door because you arrived as a user. Your activity looks like activity, which is the whole point.
Now look at what the data says about which one they are choosing. Brute-force activity accounts for 15.6% of initial access, drawing almost level with exploitation at 16%. Sit with that. The crudest technique in the catalog, just trying credentials until one opens, is now nearly as common as the entire category of exploiting software flaws. That is not a story about attacker sophistication. It is a story about what is cheap, and right now your login page is the cheapest thing you own.
The Most Common Failure Is the Boring One
Here is the finding that should reorganize your quarter. In those cases, there was a lack of MFA in 59% of them.
Not bypassed. Not defeated by some clever adversary-in-the-middle rig. Absent. In more than half of the incidents where stolen credentials got abused, the control that exists specifically to make stolen credentials useless was not standing there.
I want to be careful here, because the reflex is to hear that and think it is somebody else’s problem. It usually is not. MFA gaps are almost never a decision anyone made on purpose. They are the legacy application that could not support it. The service account nobody wanted to touch. The VPN that got an exception during a migration in 2023 that nobody ever closed. The contractor tenant that was supposed to be temporary. Every one of those is a door with no lock on it, sitting inside a building where you are certain everything is locked, and the adversary only has to find one.
To put that in perspective, you can spend the entire year buying detection to catch an attacker who is already inside, or you can spend a fraction of it making sure the credential they bought for the price of lunch does not work by itself. One of those is a much better trade.
The Part Where MFA Alone Stops Being Enough
Close the 59% and you have done more than most organizations. You have also just moved the fight, not ended it, and it is worth knowing what is waiting on the other side.
Where MFA is present, capable crews route around it rather than through it. They run adversary-in-the-middle phishing kits that proxy the real login page and steal the session token after you authenticate correctly, which means your password and your second factor both worked perfectly and the attacker still walked away with a live session. They spam push notifications at midnight until someone taps approve to make it stop. They call your help desk and talk their way into a reset. They convince a user to enroll a passkey that belongs to the attacker, which is phishing-resistant login for the wrong person and survives every password reset you order afterward.
The common thread is that none of these break the cryptography. They attack the enrollment, the recovery, the session, or the human, which are the soft edges around the strong part. This is why “we have MFA” is a starting position rather than a finish line, and why the shape of your MFA matters more than its presence. Phishing-resistant factors bound to the device and the origin, applied everywhere and not just to email, are a different control than a code in a text message.
Once They Are In, You Have Hours
The other numbers in the report explain why prevention here pays so much better than detection.
Once an attacker is inside, it takes them about 3.4 hours to reach the Active Directory server. Median dwell time across cases has dropped to three days. Read those together and the picture is grim: the intruder is at the crown jewels the same afternoon, and out the door with what they came for inside the week. There is no leisurely hunt window. Your identity provider and your domain controllers are not just infrastructure at that point, they are the objective, because whoever owns identity owns everything downstream of it.
Then there is the detail that tells you exactly how deliberate this is. 88% of ransomware payloads get deployed during non-business hours. They are not firing at 2pm on a Tuesday when your team is at their desks. They are firing at 3am, on the weekend, over the holiday, because they profiled your staffing before they profiled your network. The adversary is modeling your people’s schedule as part of the attack, which is the same insight that runs underneath everything we write about defending the operator, not just the system.
Defending the Login
None of this is a counsel of despair. It is a re-prioritization, and it is mostly unglamorous work.
Close the MFA gap first, and prove it. Not “we deployed MFA,” but an actual enumerated list of every authentication path into your estate with a yes or no next to it. The legacy app, the VPN, the service account, the contractor tenant, the admin console someone stood up for a project. The 59% lives in the paths nobody put on the list, so the list is the deliverable.
Make the factors phishing-resistant, everywhere. SMS codes and push approvals are better than nothing and they are beatable by the techniques above. Move to factors bound to the device and the origin, and apply them to the whole estate rather than the handful of apps that were easy.
Lock down enrollment and recovery. Almost every MFA bypass in the wild goes through the side door: enrolling a new factor, resetting a credential, talking to a help desk. Control who can enroll authentication methods, alert on new factor registrations, and give your help desk a verification procedure they follow mechanically instead of a judgment call they make while someone pressures them.
Watch identity like you watch the network. Your SIEM is probably full of endpoint and network telemetry and thin on identity. Impossible travel, a token used from a new location, a service account touching a system it has never touched, a burst of failed authentications followed by one success. That last pattern is a brute force that worked, and it is sitting in your logs right now if anyone is reading them.
Treat Active Directory as the objective it is. Tier your admin accounts, keep domain admin off general-purpose workstations, and monitor the AD server like the target it becomes 3.4 hours after any foothold.
Do not forget the identities that are not people. Service accounts, API keys, and agent credentials rarely have MFA at all and vastly outnumber your humans, which is a whole problem of its own that we cover in non-human identity security.
Staff for the hours they actually attack. If 88% of payloads land outside business hours and your coverage is business hours, you have handed the adversary the schedule. Either extend the coverage or arrange for someone to be woken up, and decide that now rather than at 3am.
The Door, Not the Window
We built a generation of security around the idea that attackers break things to get in, and we bought accordingly. Firewalls, patch cycles, endpoint agents, all of it aimed at the moment something gets defeated. It was the right investment for that threat, and it worked well enough that the adversary went and found a cheaper door.
They are not defeating your controls anymore. They are authenticating. Two thirds of the time, that is the whole story of the incident, and in more than half of those the thing that would have stopped it was simply not turned on. The good news is that the fix is known, it is not exotic, and it costs less than the detection stack you would need to catch what gets in without it.
Want to know which authentication paths into your organization are missing the lock? Start with our free Human Attack Surface Score, or contact Grab The Axe and we will go find them the way an adversary would.
Operating on the philosophy that 'you can't build a secure system if you don't know how to break it,' Chris leads our engineering division. A top 1% National Cyber League competitor, he hardens our digital infrastructure against the very exploits he has mastered.
View Author Page →
