A new report from Sophos reveals that identity-related attacks dominated cybersecurity incidents investigated in 2026, with attackers increasingly exploiting compromised credentials and weak multi-factor authentication (MFA).

• 67% of all investigated incidents were rooted in identity attacks, a significant increase from previous years.
• Sophos Incident Response (IR) and Managed Detection and Response (MDR) teams observed a proliferation of threat groups, with Akira and Qilin being the most active ransomware brands.
• Despite concerns, generative AI has not yet fundamentally changed attacker behavior, though it has increased the sophistication of phishing and social engineering tactics.