Identity Attacks Overtake Exploits as the Leading Cause of Ransomware

Security teams spent the better part of a decade being told that faster patching was the surest way to stop ransomware. New 2026 data says that advice no longer describes the threat organizations are actually facing. Identity compromise, not software exploitation, is now the dominant path attackers use to get in, and a control most organizations already trust to stop it is proving far less complete than deployment reports suggest.

This post walks through what changed, why a control present in 97% of compromised-credential ransomware cases still failed to stop them, and what that means for how security and compliance teams prioritize the next twelve months of investment.

Key Takeaways

1. Identity attacks now cause more ransomware than software exploits. Sophos’s State of Ransomware 2026 survey found malicious email (26%) and phishing (24%) combined have overtaken vulnerability exploitation (18%, down from 32% three years earlier) as ransomware’s leading root cause.

2. MFA was present and still failed. In 97% of ransomware cases where compromised credentials were the root cause, multifactor authentication was already deployed somewhere in the environment, proving that MFA presence and full MFA coverage are not the same thing.

3. A live attack campaign shows exactly how that gap gets exploited. Between June 12 and June 26, 2026, attackers used the deprecated OAuth Resource Owner Password Credentials flow to run more than 81 million login attempts and compromise 78 accounts across 64 organizations, bypassing MFA because it was never in that protocol’s authentication path.

4. Credential abuse runs through the whole attack chain, not just the front door. The 2026 Verizon Data Breach Investigations Report found credential abuse touching 39% of breach chains overall, even in a year when vulnerability exploitation reclaimed the top spot for initial access.

5. Compliance timelines are shifting, but the underlying risk isn’t. The Department of War suspended CMMC 2.0 Phase 2 third-party certification requirements on July 13, 2026 pending a 60-day review, while Phase 1 self-assessment and DFARS 252.204-7012 safeguarding obligations remain fully in force.

Ransomware’s Root Cause Has Shifted from Exploits to Identity Attacks and MFA Gaps

Security teams spent the better part of a decade being told that patching faster was the surest way to keep ransomware out. That advice describes a threat model that no longer matches the data. Sophos’s State of Ransomware 2026 report, based on a survey of 2,158 IT and cybersecurity leaders across 17 countries whose organizations were hit by ransomware in the past year, found that phishing and malicious email now account for half of all ransomware root causes. Vulnerability exploitation, the dominant cause for three straight years, fell to 18% from 32%.

That shift alone would be a significant story. What makes it more than a rebalancing of percentages is the second finding buried in the same survey: multifactor authentication was deployed, in some form, in 97% of the incidents where compromised credentials caused the breach. The control organizations have relied on to stop exactly this kind of attack was already in place, and it did not stop the attack.

This post walks through what the Sophos data actually shows, a live June 2026 attack campaign that demonstrates the mechanism behind that 97% figure, corroborating data from the Verizon 2026 Data Breach Investigations Report, and a compliance development from earlier this month that changes the calculus for regulated organizations without changing the underlying threat. Organizations relying on Kiteworks secure data exchange to govern access to sensitive content are affected by this shift differently than organizations relying on authentication alone, and the difference matters more with every quarter this trend continues.

What the Sophos 2026 Data Actually Shows

Three numbers from the Sophos report deserve attention beyond the headline shift in root causes.

First, two-thirds of victims, 67%, told Sophos that the ransomware attack they suffered was their most significant identity-related attack of the past year. That is a striking admission from a population of organizations that, by definition, all suffered a successful ransomware attack. It says the identity compromise was not incidental to the breach. It was the breach, with encryption as the final step rather than the point of entry.

Second, compromised credentials were the specific root cause in 23% of cases, distinct from the phishing and malicious email category. Combined with the 50% phishing and email figure, that means roughly three-quarters of the ransomware attacks in this survey trace back to some form of identity compromise rather than a technical vulnerability. A successful ransomware intrusion routed through credential theft constitutes a reportable data breach under HIPAA, GDPR, and comparable frameworks regardless of whether encryption is the ultimate payload — the identity compromise and any data the attacker accessed during lateral movement trigger notification obligations independently of the ransomware event itself.

Third, and most consequential for security budgets built around authentication controls, is the MFA figure. Sophos found that where compromised credentials were the root cause, 97% of victim organizations already had multifactor authentication deployed. The report attributes this to two overlapping causes: incomplete deployment across every system that actually needed it, and bypass techniques that continue to evolve faster than defensive coverage does. Neither explanation is comforting, because both describe a gap that a compliance checklist showing “MFA: Enabled” would not catch.

Why MFA Presence Isn’t MFA Coverage: The June 2026 OAuth Campaign

The clearest illustration of how a 97%-deployed control still fails 97% of the time surfaced in the same month Sophos published its report. Between June 12 and June 26, 2026, according to The Hacker News, attackers ran more than 81 million login attempts against Microsoft 365 and Azure accounts, ultimately compromising 78 accounts across 64 organizations.

The technique did not involve tricking a single user into approving a push notification or entering a one-time code on a fake login page. It exploited OAuth’s Resource Owner Password Credentials flow, a legacy authentication method Microsoft deprecated years ago that remains functional in most Azure tenants for backward compatibility with older applications. Coverage of the campaign from Secure Bulletin described how ROPC sends a username and password directly to the identity provider’s token endpoint, with no interactive prompt anywhere in the exchange. There was no MFA challenge for the attackers to defeat, because the protocol never generated one.

The organizations affected by the campaign were not skipping MFA as a matter of policy. Their SaaS accounts, in most cases, had MFA and conditional access properly configured. Their VPN concentrators, firewall administration consoles, and legacy line-of-business applications did not receive the same treatment, because nobody had inventoried every system where a credential remained usable without a second factor. That is the exact gap Sophos described in more abstract terms: MFA “may not have been fully deployed across all relevant systems, creating gaps for attackers to exploit.”

Two independent data sources, six weeks apart, describing the same failure mode is not a coincidence. It is a pattern, and the pattern has a name: treating MFA deployment as a completed project rather than a continuously verified inventory. A formal risk assessment that maps every authentication endpoint against its current MFA enforcement status — not just the SaaS applications where enforcement is easiest to verify — is the foundational step that converts an MFA policy into an MFA program.

The Pattern Behind the Numbers: What Verizon’s 2026 DBIR Confirms

A skeptic could read the Sophos findings as specific to ransomware, or specific to the OAuth ROPC campaign as one unusually well-executed operation. The 2026 Verizon Data Breach Investigations Report, which analyzed more than 22,000 confirmed breaches, argues against reading it that narrowly.

Verizon’s data shows vulnerability exploitation reclaiming the top spot for initial access this year, a genuinely different finding from the ransomware-specific Sophos survey. But credential abuse still touches 39% of full breach chains, meaning it remains the most pervasive technique across the entire attack lifecycle even in a year when it was not the leading door-opener. Identity compromise is not competing with other attack methods for first place in a single category. It shows up at multiple stages: initial access in some cases, lateral movement and privilege escalation in most others, regardless of how the attacker got in the first time.

That distinction matters for how security leaders prioritize investment. A defense built entirely around stopping initial access, whether through patching or MFA, leaves the rest of the chain — the part where a credential moves from one system to another, or where an attacker with legitimate-looking access starts touching content it was never meant to reach — largely ungoverned. Supply chain risk management programs that extend identity governance to third-party vendor accounts — particularly service accounts used by vendors to access internal systems — address the lateral movement stage that the Verizon data identifies as the most pervasive breach chain element.

Compliance Momentum Paused, Not Canceled: The CMMC 2.0 Phase 2 Suspension

Regulated organizations, particularly those in the defense industrial base, got a reminder this month that compliance timelines can move faster than the underlying risk does, in either direction. On July 13, 2026, the Department of War suspended Phase 2 of the CMMC program — the third-party Level 2 certification assessments that were scheduled to begin appearing in DoD contract solicitations on November 10, 2026 — pending a 60-day reform review, according to the Department of War’s own release and corroborating coverage from Federal News Network.

What did not change is worth stating plainly, because it is easy to misread a paused audit requirement as a paused obligation. DFARS 252.204-7021, the contract clause built around CMMC 2.0, remains on the books. Phase 1 self-assessment requirements, which took effect in November 2025, are unaffected. And the underlying DFARS 252.204-7012 safeguarding requirements for covered defense information, along with the NIST 800-171 control families they draw on, including Identification and Authentication and Audit and Accountability, remain fully in force throughout the 60-day review.

The identity and access controls that a Level 2 assessor was going to verify under the suspended timeline are the same controls Sophos’s data says are failing quietly across the broader market right now. A contractor that treats the suspension as license to slow down is solving a scheduling problem while leaving the actual exposure exactly where it was. NIST 800-171 compliance documentation that maps current identity and access controls to specific practice requirements — maintained continuously rather than assembled pre-assessment — is both the evidentiary artifact the suspended C3PAO assessment would have evaluated and the False Claims Act defense that protects a contractor’s self-attested SPRS score.

From Access Control to Content Governance: Closing the Post-Authentication Gap

The tactical response to all of this, deploy more MFA and extend it to more systems, is necessary and not wrong. It is also not sufficient on its own, because the data shows the same failure mode recurring even in environments where MFA coverage looked complete on paper. The more durable fix requires treating a successful login as the start of a second, distinct security question rather than the end of the first one: once an identity is authenticated, what is it actually allowed to touch, and can the organization prove what it touched after the fact?

That second question is where access controls built on role-based access control (RBAC) and attribute-based access control (ABAC) do work that authentication alone cannot. Kiteworks’ Data Policy Engine evaluates every request to sensitive content against user role, content classification, and context at the time of the request, rather than relying on a single authentication event to stand in for authorization for the rest of a session. A compromised credential that gets past a gap in MFA coverage still has to clear a second, independent policy check before it can reach content governed under that model. Applying data classification labels to sensitive content before it enters any governed channel is the prerequisite that makes ABAC policy enforcement precise: a policy engine cannot restrict access by sensitivity tier if content has not been categorized. Data minimization applied to credential scope further reduces blast radius: provisioning accounts with access only to the content their role requires — not the maximum content their permissions might allow — means a compromised credential can reach far less even when it bypasses MFA entirely.

The audit trail generated by that same policy layer is what turns “we think this account was compromised” into an answerable question during incident response. Kiteworks’ unified logging across secure email, secure file sharing, managed file transfer, and web forms means a security team investigating the aftermath of a credential compromise can determine exactly what the compromised identity accessed, when, and from where, across every channel governed by the platform, rather than reconstructing that picture from disconnected logs after the fact. Feeding that unified audit stream in real time into a SIEM platform gives security teams the behavioral correlation engine needed to detect anomalous post-authentication activity — the lateral movement stage the Verizon DBIR identifies as the most pervasive breach chain element — before it reaches exfiltration. This is the practical difference between a zero trust architecture applied only at the network perimeter and one extended to the content layer, where the data the attacker actually wants lives.

The Kiteworks Data Security and Compliance Risk: 2026 Forecast Report puts a number on how widespread this specific weakness is: 33% of organizations lack evidence-quality audit trails, and that single gap correlates with AI governance maturity scores 20 to 32 points lower across every other AI governance dimension the survey measured. Visibility after authentication is not a secondary control. It is closer to a leading indicator of how well an organization governs data generally.

Building an Identity-Resilient Data Security Program

None of this argues for abandoning multifactor authentication or treating it as a failed control. It argues for treating identity risk as a program with several distinct layers rather than a single deployment milestone.

Start with an honest inventory of every system, protocol, and application a credential can reach, not just the SaaS applications where MFA enforcement is easiest to configure and easiest to report on. VPN concentrators, firewall administration consoles, SFTP servers, and any legacy application still running a deprecated authentication flow “for compatibility” deserve the same scrutiny the June 2026 campaign exposed at 64 organizations that likely believed their MFA coverage was complete.

Retire deprecated protocols where retirement is possible, and document a compensating control anywhere it is not. ROPC is deprecated for a documented reason, and it is unlikely to be the only legacy flow still quietly accepting a password with no interactive challenge attached.

Extend incident response planning to assume a credential will eventually be compromised despite MFA, and build the SIEM and audit logging integration needed to answer, within hours rather than weeks, exactly what that credential touched. A documented incident response plan that covers credential-based ransomware intrusion scenarios — including the lateral movement and exfiltration review steps, the HIPAA or DFARS notification assessment, and the credential rotation sequence — gives security teams the operational structure they need to move at the speed a compressed attacker dwell time demands.

Finally, treat the pause in CMMC 2.0 Phase 2 enforcement as an opportunity rather than a deadline extension. Organizations that keep building toward the identity, access, and audit controls the suspended assessments were designed to verify, particularly around CUI handling, will be in a materially stronger position whenever the 60-day review concludes, regardless of what the resulting framework looks like.

What This Shift Means for Cyber Insurance and Board Reporting

Insurance underwriters have spent the last several renewal cycles asking whether an applicant has MFA deployed, treating a yes answer as a meaningful risk reducer. The Sophos data undercuts that assumption directly: a “yes” to the MFA question told underwriters almost nothing about whether that deployment was complete. An organization that answered honestly and still suffered a ransomware attack through a gap in that same coverage is now in a worse position at renewal than an organization that never claimed full coverage in the first place.

Boards and audit committees are asking a version of the same question in different language, usually framed as “are we covered” rather than “where are the gaps.” A more useful board-level metric replaces the binary MFA question with a scoped one: what percentage of systems capable of accessing sensitive content enforce MFA today, and what is the plan and timeline for closing the remainder. That framing turns risk assessment from a compliance checkbox into an ongoing measurement the security team can report against quarter over quarter, the same way a governed activity dashboard aggregates risk signals across an environment rather than presenting a single pass/fail control status.

This reframing matters for underwriting conversations too. An organization that can produce a current, specific inventory of MFA coverage gaps, along with a governed audit trail showing what any given credential accessed across email, file sharing, and managed file transfer, is demonstrating a materially different risk posture than one that can only point to a policy document saying MFA is required. The former is the kind of evidence underwriters increasingly ask for directly; the latter is the kind of answer that Sophos’s data suggests is no longer reassuring on its own. Data governance documentation that maps what content each credential class can access — organized by sensitivity tier, with current access scope and last-review date — is the internal record that makes both the board metric and the underwriting conversation grounded in verifiable facts rather than policy assertions.

To learn more about closing the gap between authentication and content access with governed, audited data exchange, schedule a custom demo today.

Additional Resources

• Blog Post Zero Trust Architecture: Never Trust, Always Verify
• Video Microsoft GCC High: Disadvantages Driving Defense Contractors Toward Smarter Advantages
• Blog Post How to Secure Classified Data Once DSPM Flags It
• Blog Post Building Trust in Generative AI with a Zero Trust Approach
• Video The Definitive Guide to Secure Sensitive Data Storage for IT Leaders