The Most Boring Finding in the Sophos Data Is Also the Most Important
Every year, the ransomware conversation gets louder about new attack techniques. AI-generated phishing. Deepfake social engineering. Adversarial machine learning. Living-off-the-land binaries. Supply chain compromises through obscure dependencies. The narrative reliably suggests that defenders are facing a fundamentally new threat that requires fundamentally new tools.
For three surveys in a row, the Sophos State of Ransomware report came back with a less fashionable answer. The 2025 edition puts it in one line:
"For the third year running, victims identified exploited vulnerabilities as the most common technical root cause of attack, used in 32% of incidents."
Not an exotic technique. A flaw in software the victim was already running, used as the way in. Sophos does not split that category into zero-days and flaws that already had a patch, so the survey cannot say how many of those incidents were patchable on the day of the attack. What it does say is that for three years, victims named no other single entry point more often.
The streak has since ended. In the 2026 edition, exploited vulnerabilities fell to 18%, behind malicious email (26%), phishing (24%) and compromised credentials (23%). We come back to that shift below, because it sharpens the argument rather than weakening it: the leading entry point changed within a single year, and the defender's recovery problem did not change with it.
At BackupSec, we read the three-year run as a strategic signal. The gap between known security weaknesses and closed ones does not shrink on prevention's schedule. This article looks at why that gap persists, why prevention alone cannot close it, and what that means for backup architecture in 2026.
What the Sophos Data Actually Shows
The 2025 Sophos report is based on an independent, vendor-agnostic survey commissioned by Sophos and run by a third-party specialist between January and March 2025. It covers 3,400 IT and cybersecurity leaders across 17 countries, all in organizations with 100 to 5,000 employees that had been hit by ransomware in the previous twelve months. Sophos names each report for the year the survey ran and notes that "many of the attacks referenced occurred in 2024." The root-cause question was answered by all 3,400 respondents:
- Exploited vulnerabilities: 32% of attacks, the #1 cause for the third year running (36% in the 2023 report, 32% in 2024).
- Compromised credentials: 23%, down from 29% in 2024.
- Malicious email: 19%.
- Phishing: 18%, up from 11% the previous year.
The sector reports built on the same 2025 survey mostly follow the pattern. In manufacturing, exploited vulnerabilities were the leading cause at 32%. In retail, they led for the third year running at 30%. Not every sector fits: in healthcare, exploited vulnerabilities topped the list at 33% "for the first time in three years." The pattern was broad, not universal.
One caveat about the survey itself. It records what victims believe the root cause was, and Sophos's own incident data reads a little differently. Across the 2024 incident-response and MDR cases in its 2025 Active Adversary Report, compromised credentials led (41%) and exploited vulnerabilities came second (22%). Either way, exploitation sits at or near the top.
What makes the survey finding important is its persistence. The share eased from 36% to 32% and then held there, and for three years nothing overtook it.
That should tell us something architectural about the problem.
Why Patching Fails, Even When Organizations Do It
The intuitive response to "a third of attacks start with an exploited vulnerability" is "then patch faster." That response is correct but operationally insufficient, and the reasons it falls short are worth examining honestly.
The denominator problem. A mid-sized organization can easily run thousands of distinct software components across operating systems, applications, firmware, container images and SaaS configurations. Vendor advisories arrive continuously. Even a security team at the top of its game cannot patch every component on the day a CVE is published. The denominator of "things that could be exploited" is structurally larger than the bandwidth of "things that can be patched this week."
The criticality problem. Many patches require downtime, regression testing, or coordination with business owners who are protecting revenue. The systems that most need patching (externally facing applications, legacy production systems, OT and industrial control infrastructure) are often the ones where downtime costs the most. So patches get scheduled, deferred, batched, and eventually forgotten. That maintenance debt is exactly where an attacker looking for a way in will look first.
The discovery problem. You cannot patch what you cannot see. In the 2025 Sophos survey, security gaps the organization was not aware of were a contributing factor in 40.1% of attacks, just behind lack of expertise (40.2%). Respondents named 2.7 contributing factors on average, so these are contributing causes, not sole causes. In retail, unknown security gaps were the most-cited operational cause, named by 46% of victims. Shadow IT, undocumented systems, forgotten cloud workloads and third-party integrations with their own dependency trees make the modern attack surface genuinely hard to enumerate. The gap between what your asset inventory shows and what an attacker can actually reach is where many exploited vulnerabilities live.
The window problem. Even when a vulnerability is known and a patch exists, the time to exploitation has collapsed. Mandiant's time-to-exploit analysis measured an average of 63 days in 2018–2019, 32 days across 2021–2022, and five days in 2023. Of the flaws it tracked that were exploited after a patch was available, 12% were exploited within one day and 29% within one week. And 70% of the exploited vulnerabilities it tracked in 2023 were used as zero-days, before any patch existed at all. The patching window of a few years ago is gone.
None of these problems is solved by buying another vulnerability management tool. They are structural features of how organizations run IT, and they help explain why exploited vulnerabilities stayed at the top of the Sophos list for three years.
The AI Distraction
The 2025 Sophos data was also a useful corrective to the dominant narrative about AI-driven attacks.
The industry conversation in 2025 was heavily oriented around AI-generated phishing campaigns, deepfake social engineering and machine-learning-enabled evasion. These threats are real and deserve attention. Phishing did rise in the 2025 survey, from 11% to 18% of attacks. Sophos does not say how much of that rise came from AI-written lures, and neither can we. What the 2025 data does show is that phishing did not displace exploited vulnerabilities as the leading entry point.
The 2026 edition moves the picture on. Email-based attacks took the lead: malicious email (26%) and phishing (24%) together accounted for half of all incidents, while exploited vulnerabilities fell 14 points to 18%. Sophos does not attribute that shift to AI either.
The practical lesson for risk leaders is to be skeptical of any narrative, ours included, that says the most important defensive investment is whichever vector leads this year. The leader changed inside twelve months. A defense that depends on closing one particular door is betting on a moving target. The more durable investment is the one that makes any single entry vector less load-bearing for the outcome.
What "Less Load-Bearing" Actually Means
Here is the architectural insight that follows from accepting that exploitation cannot be fully eliminated. If a meaningful share of attacks will keep starting with a flaw you did not patch in time (roughly a third of them in three consecutive Sophos surveys, and still nearly one in five in the fourth), then the strategic question shifts from "how do we patch faster?" to "what happens when we don't?"
This is the question most security architectures are still avoiding.
In a defense model where prevention is assumed to work, vulnerability exploitation is treated as a failure that needs to be eliminated. In a defense model that takes the Sophos data seriously, it is treated as a recurring condition that the rest of the architecture must absorb without a catastrophic outcome.
The shift from elimination to absorption is the same shift mature reliability engineering made years ago. You do not eliminate failure in distributed systems. You design systems that degrade gracefully when failures occur. You measure mean time to recovery, not just mean time between failures. You treat resilience as a primary architectural property, not as a cleanup job after prevention fails.
Security is slowly beginning to apply the same logic. The Sophos data is, in our reading, strong evidence that the transition is overdue.
Where Backup Architecture Becomes the Pivot Point
When a vulnerability is exploited and an attacker establishes a foothold, the chain that follows is well documented: lateral movement, privilege escalation, reconnaissance, exfiltration and, eventually, payload deployment. It is also fast. In the 2024 cases behind Sophos's 2025 Active Adversary Report, the median dwell time in ransomware incident-response cases was 4 days, and 3 days in MDR cases. That is the time an attacker has to find and neutralize the controls that would otherwise enable recovery, and it is shorter than most review cycles.
The most important of those controls is the backup environment.
If your backup infrastructure can be reached from a system compromised through an exploited vulnerability, the vulnerability did not just enable an attack. It enabled the attack to win. An exploited CVE on an internet-facing application matters architecturally less for what it does on that host than for what it lets an attacker do to your recovery layer in the days that follow.
This is the pivot point the Sophos data implies. Exploited vulnerabilities will remain one of the main ways in, whatever their rank in a given year. The variable that determines outcomes is whether your recovery architecture is reachable from the systems where those footholds are established.
Concretely, this means:
Identity separation. The credentials that protect production systems must not grant access to backup infrastructure. If a compromised domain administrator account can reach your backup repository, your backups are part of the attack surface that the unpatched vulnerability exposed.
Validated immutability. Software-based retention policies can be modified by anyone with sufficient privilege. Hardware-enforced or platform-enforced retention locks are designed to resist that, but "configured" and "actually working as intended" are different claims, and only a test separates them. Whether your immutability is enforced by your backup platform, your storage layer or a hardened repository, the property that matters is whether it has been tested under adversarial conditions, not merely enabled in a settings panel.
Network and trust isolation. A backup environment that sits on the same network domain as production systems is part of production from a threat-modeling perspective. Logical and physical isolation are what turn backup infrastructure from "another target" into "the layer that survives when other targets do not."
Regular restore validation. In the 2025 Sophos survey, only 54% of organizations whose data was encrypted restored it from backups, the lowest rate in six years and the third consecutive decline. Sophos does not ask the others why. It does report that 29% used "other means", which it says likely includes decryption keys that had been made public (multiple answers were allowed). Its one direct data point on failed backups is narrow: of 151 organizations that paid more than the initial demand, 38% said their backups had failed or were malfunctioning. The 2026 edition shows a rebound, with 66% of encrypted victims recovering from backups. Either way, a backup that has never been restored under realistic conditions is a hypothesis, not a control.
The Strategic Reframe
For risk leaders, the three-year run of vulnerability exploitation at the top of the list is not an indictment of vulnerability management programs. It is evidence that vulnerability management, however well executed, cannot carry the full weight of ransomware defense on its own.
The 2025 finding that 32% of attacks started with an exploited vulnerability should be read alongside another figure from the same survey: 49% of organizations whose data was encrypted paid the ransom, down from 56% the year before. In the 2026 edition the rate was 48%, and Sophos puts the four-year average at roughly 50%. In our reading, those numbers are connected. They describe a posture in which prevention is asked to be infallible because the recovery layer cannot be relied on. The correction is not to make prevention more infallible. It is to make recovery reliable enough that prevention failures do not decide business outcomes.
That correction is architectural, and it is overdue. The organizations that close the gap will be the ones whose recovery layer can absorb an incident regardless of which door it came through. The 2026 data shows how quickly the busiest door can change.
Where BackupSec Comes In
At BackupSec, we start from the premise that prevention will sometimes fail, and that when it does, the outcome depends on two things: whether clean, isolated copies of your data exist, and whether anyone has checked that the backup layer holds up against the attack that is coming.
Three of our services map to the gaps described above:
- ZeroMON monitors Veeam Backup & Replication. It runs on-premises as an OVA, connects with a read-only account, and sends nothing to BackupSec or any third party. It tracks job health and configuration changes in Veeam (who changed what, and when), shows immutability status as Veeam's own repository settings report it, shows the results of Veeam's Security & Compliance Analyzer, and includes a honeypot that records scans and connection attempts against the ZeroMON appliance as an early reconnaissance signal. Alerts go out by email and in-app notification. Because it reads Veeam's configuration, it does not verify object-level locks on the storage itself.
- ZeroTAM gives your team a dedicated backup-security advisor for architecture, ransomware recovery planning and capacity, with priority support in a crisis. It is advisory work, not software.
- ZeroPEN is a threat-led penetration test of Veeam Backup & Replication, plus Veeam ONE and Enterprise Manager. It simulates a ransomware kill chain in eight stages mapped to MITRE ATT&CK, from initial access through Veeam server compromise, repository access and backup neutralization to proof of encryption capability. It is non-destructive: "ZeroPEN never deletes real backups, performs real encryption, or stops production or backup services." You get audit-ready evidence of what an attacker with a foothold could reach, and a retest for critical findings.
The 32% figure was never destiny, and the 2026 figure of 18% is not a reprieve. Both describe the front door. What decides the outcome is whether the recovery layer fails along with the prevention layer. Decoupling the two does not make you immune to exploited vulnerabilities. It makes a missed patch far less likely to decide whether you pay.
Talk to BackupSec about backup penetration testing →
This analysis draws on the Sophos State of Ransomware 2025 and 2026 reports, the 2025 Sophos sector reports for manufacturing, retail and healthcare, Sophos's 2025 Active Adversary Report, and Mandiant's 2023 time-to-exploit analysis. The interpretation and framework are BackupSec's own. To discuss how it applies to your environment, get in touch with our team →