.svg?width=185&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=13&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
.avif?width=1024&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Shared - Banner with Media - Background")
Sophos 2025 Annual Threat Report
Ransomware is still the most prevalent and costly cyber threat to small businesses. Here’s what you need to know.
Cybercriminals are becoming increasingly adept at exploiting the areas security defenders aren’t looking and maneuver inside the networks while keeping the lowest profile possible. In the Sophos 2025 Annual Threat Report, we take a close look at the expanding array of threats to small and medium-sized businesses.
Download the report today to discover how attackers are evolving their social engineering tricks, utilizing methods that include vishing, email-bombing and quishing, to steal credentials and infiltrate networks and eventually deploy ransomware.
Ransomware is still the No. 1 threat to SMBs
Ransomware cases accounted for 70% of Sophos Incident Response cases for small businesses and over 90% for midsized organizations.
The 2025 Sophos Annual Threat Report covers the methods by which threat actors try to infiltrate networks and deploy ransomware, and the various ways they try to profit off those attacks.
In this report, you’ll discover:
- Which attack vectors were most prominent in 2024.
- The main categories of malware in use and what they target.
- Which ransomware families pose the biggest threat to small businesses.
- The latest social engineering threats.
- Which legitimate software utilities and tools bad actors are exploiting to gain access to confidential data.
- Specific steps organizations need to implement to have a comprehensive, layered approach to their security strategy.
Check out these and other topics covered in the Sophos 2025 Threat Report:
Top sources of network intrustions
Compromised network edge devices were the largest single source of network intrusions, accounting for initial compromise in 25% of MDR/IR incidents.
Business email compromise growth
Attackers are bypassing MFA through adversary-in-the-middle authentication token capture to send convincing phishing.
Living off the land
Cybercriminals are becoming increasingly adept at exploiting the areas security defenders aren’t looking and maneuver inside the networks while keeping the lowest profile possible.
Threats to VPNs
VPNs are the single largest source of compromise, accounting for the point of initial compromise in 20% of all MDR and IR cases.
Slight shift in ransomware
Attackers breach a compromised, and often under-protected, endpoint to encrypt data on other devices connected to the same network.
Other popular types of malware
The most frequently encountered malware were loaders/droppers (40%), followed by stealer/spyware (19%).
How Sophos keeps up with the latest threats
Sophos combines machine learning, automation, and real-time threat intelligence with frontline human expertise from Sophos X-Ops to deliver advanced, 24/7 threat monitoring, detection, and response that keeps up with the latest threats. The 2025 Sophos Annual Threat Report provides key insights that help organizations and security practitioners defend against threats old and new, including ransomware groups and services designed to launch multiple malware attacks and steal information.
Cybersecurity Delivered
Sophos is a worldwide leader in next-generation cybersecurity and protects more than 600,000 organizations and millions of consumers in more than 150 countries from today’s most advanced cyberthreats. Sophos delivers a broad portfolio of advanced security services and products to protect corporations and individuals against a wide range of cyberattacks.