Every second attacker logs into the company network
Compromised credentials are the leading cause of cyberattacks for the second year in a row. The Sophos Active Adversary Report shows that in 56 percent of the analyzed attack cases, cybercriminals possessed stolen login credentials. The Sophos Active Adversary Report 2025 analyzes the behavior and techniques of cybercriminals from over 400 actual attacks conducted by the MDR (Managed Detection and Response) team and incident response specialists in 2024. Attackers primarily gained access to networks via external remote services (56 percent of all MDR and IR cases) by exploiting valid accounts, including...
