The State of Ransomware 2026: Payments are dropping but encryption is climbing

Sophos published multiple July 2026 posts highlighting an elevated ransomware and vulnerability landscape: their State of Ransomware 2026 shows fewer ransom payments but increased encryption; SonicWall SMA1000 vulnerabilities are being actively exploited; threat actors Vect and TeamPCP are leveraging harvested credentials from supply‑chain compromises to scale ransomware deployments; Sophos X‑Ops warns AI coding agents can trigger attacker‑style telemetry and speed exploit development, underscoring gaps in exploit mitigation. Sophos also announced product updates (Protected Browser Extension,