Sophos-Active-Adversary-Report-2026.md

## Executive summary Sophos' 2026 Active Adversary Report reviews 661 IR/MDR cases from 2025 and finds attackers largely relying on identity compromise (67.32% of root causes) rather than novel zero-days, with substantial ransomware and data-exfiltration activity; persistent operational failures — missing logs, weak or misconfigured MFA, long token lifetimes, and unprotected/EOL systems — amplify risk and shorten defender reaction windows.