The report found that the primary way attackers gained initial access to networks (56% of all cases across MDR and IR) was by exploiting external remote services, which includes edge devices such as firewalls and VPNs, by leveraging valid accounts.

The combination of external remote services and valid accounts aligns with the top root causes of attacks. For the second year in row, compromised credentials were the number one root cause of attacks (41% of cases). This was followed by exploited vulnerabilities (21.79%) and brute force attacks (21.07%).

Understanding The Speed of Attacks

When analyzing MDR and IR investigations, the Sophos X-Ops team looked specifically at ransomware, data exfiltration, and data extortion cases to identify how fast attackers progressed through the stages of an attack within an organization. In those three types of cases, the median time between the start of an attack and exfiltration was only 72.98 hours (3.04 days).

Furthermore, there was only a median of 2.7 hours from exfiltration to attack detection.

“Passive security is no longer enough. While prevention is essential, rapid response is critical. Organizations must actively monitor networks and act swiftly against observed telemetry. Coordinated attacks by motivated adversaries require a coordinated defense. For many organizations, that means combining business-specific knowledge with expert-led detection and response. Our report confirms that organizations with proactive monitoring detect attacks faster and experience better outcomes,” said John Shier, field CISO.

Other Key Findings from the 2025 Sophos Active Adversary Report:

• Attackers Can Take Control of a System in Just 11 Hours: The median time between attackers’ initial action and their first (often successful) attempt to breach Active Directory (AD) – arguably one of the most important assets in any Windows network – was just 11 hours. If successful, attackers can more easily take control of the organization.
• Top Ransomware Groups in Sophos Cases: Akira was the most frequently encountered ransomware group in 2024, followed by Fog and LockBit (despite a multi-government takedown of LockBit earlier in the year).
• Dwell Time is Down to Just 2 Days: Overall, dwell time – the time from the start of an attack to when it is detected – decreased from 4 days to just 2 in 2024, largely due to the addition of MDR cases to the dataset.
• Dwell Time in IR Cases: Dwell time remained stable at 4 days for ransomware attacks and 11.5 days for non-ransomware cases.
• Dwell Time in MDR Cases: In MDR investigations, dwell time was only 3 days for ransomware cases and just 1 day for non-ransomware cases, suggesting MDR teams are able to more quickly detect and respond to attacks.

• Ransomware Groups Work Overnight: In 2024, 83% of ransomware binaries were dropped outside of the targets’ local business hours.

• Remote Desktop Protocol Continues to Dominate: RDP was involved in 84% of MDR/IR cases, making it the most frequently abused Microsoft tool.

To shore up their defenses, Sophos recommends that companies do the following:

• Close exposed RDP ports
• Use phishing-resistant multifactor authentication (MFA) wherever possible
• Patch vulnerable systems in a timely manner, with a particular focus on internet-facing devices and services
• Deploy EDR or MDR and ensure it is proactively monitored 24/7
• Establish a comprehensive incident response plan and test it regularly through simulations or tabletop exercises

Read the full It Takes Two: The 2025 Sophos Active Adversary Report on Sophos.com.

Paradigm Initiative believes that VPNs are a key enabler of human rights online and are a vital defense against censorship.

The stringent ban was announced by the Tanzania Communications Regulatory Authority (TCRA) on October 14, a few days before the international commemoration of Global Encryption Day.

The TCRA cited that the announcement was consistent with Regulation 16(2) of the Electronic and Postal Communications (Online Content) Regulations 2020.

PIN condemns this announcement as it will clamp down on free speech, limit access to information, threaten the right to privacy and expose citizens who have been relying on VPNs to cyber threats and unauthorised surveillance.

“VPNs are an important part of digital democracy as they can safeguard citizens’ political rights online. In Africa, it has become common for governments to shut down or throttle the internet during electoral periods or to quell protests. VPNs have been providing refuge to millions of citizens and allowing citizens to exercise their rights to express themselves online and participate in civic discourse freely,” said Mr. Sani Suleiman, PIN’s Programs Officer.

Paradigm Initiative, which is a pan-African organisation that advocates for digital rights and inclusion across the continent further challenged key stakeholders to reject efforts aimed at undermining encryption.

The organisation underscored the importance of strong encryption citing that it cannot be overstated. “It is a cornerstone of a safer digital world for us all. The guarantee of secure and private communication is not only a fundamental human right but also an essential component of maintaining trust in the global digital ecosystem,” Sani said.

Encryption, he added, ensures that personal data, online communications, financial and sensitive information are shielded from prying eyes, enhancing the safety and security of individuals, businesses, and society as a whole. It is also essential for protecting freedom of expression and association online.

“Any attempts to weaken this shield are tantamount to compromising the security of all who rely on it. As such, we remain steadfast in our commitment to repel any proposals that threaten to compromise this fundamental technology,” he continued.

Paradigm Initiative noted that currently, encryption is under threat. In recent years, there has been an upward trend in governments purchasing surveillance technologies capable of undermining end-to-end encryption, often done under the guise of national security or public safety. This is of concern in repressive regimes, where encryption is used by journalists, activists, and human rights defenders to communicate and share information safely.

The organisation is deeply concerned about the potential impact of these efforts to undermine encryption on human rights and democracy.

Encryption is essential for protecting freedom of expression, association, and assembly online. It is also essential for protecting the right to privacy and security.

When encryption is weakened, it makes it easier for governments and other entities to spy on communications, steal data, and censor online activity. This can have a chilling effect on free speech and association and can also put people at risk of physical harm.

On Global Encryption Day, Paradigm Initiative therefore;

• Recommends end-to-end encryption and that VPNs be legally available for use by everyone, more so human rights defenders, journalists, and others at risk around the world.
• Urges governments and the private sector to reject all proposals that undermine end-to-end encryption. But rather support policies that enhance, strengthen, and promote the use of strong encryption to protect individuals globally.

Strong encryption is a critical tool toward a safer world for us all. We must protect it.

[Featured Image Credit]

====

Ensuring the security of an organization’s staff while they are working remotely can be a challenging task, but it is essential for protecting sensitive information and preventing security breaches.

In this blog post, we’ll provide some tips and best practices for protecting remote workers from security threats.

1. Use secure remote access methods. When accessing the organization’s systems and resources remotely, it is essential to use secure methods such as virtual private networks (VPNs) or remote desktop protocols (RDPs). These technologies can encrypt communications and protect against unauthorized access.
2. Implement strong authentication measures. To prevent unauthorized access to sensitive information, it is important to implement strong authentication measures such as two-factor authentication (2FA) or multi-factor authentication (MFA). This can help to verify the identity of remote workers and prevent unauthorized access to systems and data.
3. Regularly update and patch systems and software. Outdated or unpatched systems and software can be vulnerable to security threats, so it is important to keep all systems and software up to date with the latest patches and updates. This can help to fix known vulnerabilities and protect against potential security breaches.
4. Use security tools and technologies. To protect against security threats and vulnerabilities, it is important to use security tools and technologies such as firewalls, intrusion detection and prevention systems (IDPS), and antivirus software. These tools can help to detect and prevent security breaches and protect against malware and other threats.
5. Train and educate remote workers. To help protect against security threats, it is important to educate and train remote workers on best practices for cybersecurity. This could include training on the proper use of security tools and technologies, as well as the identification and prevention of common security threats such as phishing attacks and malware.
6. Conduct regular security assessments and audits to identify and address any potential security vulnerabilities or weaknesses.
7. Implement policies and procedures for the secure handling and storage of sensitive information, such as passwords and confidential data.
8. Implement data loss prevention (DLP) measures to prevent the accidental or unauthorized disclosure of sensitive information.
9. Monitor remote access logs and network traffic to detect any suspicious or anomalous activity that could indicate a security breach.
10. Use secure messaging and collaboration tools to protect communications and data shared between remote workers.

Overall, by implementing these tips and best practices, organizations can ensure that their remote workers are protected from security breaches and other threats.

By using secure remote access methods, implementing strong authentication measures, regularly updating and patching systems and software, and using security tools and technologies, organizations can protect their remote workers and sensitive information from security threats.