The State of Ransomware – An overview of Sophos’ 2025 Report
In the first of 3 episodes covering Sophos’ 2025 report ‘The State of Ransomware’, Brian Sibley, VCTO at Espria and Jon Hope, Cyber Security Evangelist at Sophos discuss the findings of this year’s report, and specifically its implications for the UK.
In this episode the team will reveal key findings that cover the scale and impact of ransomware in the UK, including 70% of attacks resulted in data being encrypted and 26% of encryption-led attacks also involved data theft. The team also discuss the report in comparison to the findings of the 2024 report, the trends and shifts in attack tactics and their outcomes. Gain an understanding of the real-world implications for UK businesses across various sizes and sectors.
This podcast episode delves into the complexities of ransomware attacks, highlighting both technological and human factors that contribute to their success. It underscores the importance of a multi-layered defence strategy combining technology, human expertise and education.
Brian and Jon discuss how ransomware attacks are frequently caused by multiple factors, including both technology vulnerabilities and human errors. Exploited software vulnerabilities are the most common cause, accounting for about 32% of successful attacks. These vulnerabilities are usually flaws in software that cybercriminals exploit to execute malicious code. Whereas remote ransomware attacks involve cybercriminals using vulnerable or unmanaged devices within a network to attack other devices that store valuable data. Traditional endpoint protection often fails to detect these lateral attacks.
Human factors also play a significant role in ransomware infiltration. Compromised user credentials, often obtained through social engineering tactics such as phishing, are a common cause. Phishing remains a significant threat vector, relying on human interaction to succeed. Cybercriminals craft highly convincing emails using AI to mimic brand language, tone and logos, making it difficult for users to distinguish legitimate messages from malicious ones.
Organisations face operational challenges such as a lack of skilled cybersecurity personnel, insufficient time to dedicate to security and acceptance of certain security gaps as risks. These challenges underscore the need for adequate resources and comprehensive security strategies.
The podcast emphasises the importance of security data and logs as critical defence tools. Extended Detection and Response (XDR) platforms consolidate security data into a single location for easier analysis. Managed Detection and Response (MDR) services provide 24/7 expert monitoring and analysis, offering a cost-effective alternative to building an in-house team. Integrating data from various tools allows for comprehensive visibility and early warnings.
Backups are crucial for recovery, but cybercriminals often target them first. Integrations with backup vendors can enable monitoring for suspicious changes. The discussion concludes by emphasising that while recovery capabilities are improving, preventing ransomware attacks remains the priority. Early detection through human-led threat hunting, combined with integrated technology tools, and continuous education are key to defending against sophisticated ransomware threats.
Stay Ahead with Expert Insights from Espria
Be the first to hear about our latest podcasts and webinars, where we explore the evolving world of cybersecurity, digital transformation, and IT strategy. Join industry experts, thought leaders, and solution specialists as they share real-world challenges and practical advice to help your organisation thrive.
You may be interested in
Why the Sophos–Microsoft Partnership Matters – Especially for Education, Financial Services and Legal Organisations
For most organisations today, Microsoft is the foundation of how you operate and on top of this there is also a requirement for regulatory compliance and operational resilience. Whether it’s Microsoft 365 for collaboration, Teams for communication, or Azure for infrastructure, these platforms sit at the heart of day-to-day business. But for sectors like Education, Financial Services, and Legal, that reliance comes with heightened risk, and responsibility. These organisations are not only prime targets for cyber attackers, they are also subject to strict regulatory, data protection and governance obligations. That’s why the partnership between Sophos…
Microsoft 365 E7: The Frontier Suite – What’s Changing, Why It Matters and How to Prepare
Microsoft has officially announced Microsoft 365 E7: The Frontier Suite, marking a major leap forward in enterprise productivity, automation and AI. With general availability for both Microsoft 365 E7 and Microsoft Agent 365 set for May 1, 2026, business leaders now have the clarity needed to plan their next move. What’s what: Microsoft 365 E7 is the new top-tier enterprise suite and Microsoft Agent 365 is a key AI-powered component within the E7 offering – not a rebrand, but a major capability addition. What’s Now Official Confirmed features Why This Matters Microsoft 365 E7: The Frontier Suite isn’t just a new…
Cyber Insurance is the New Compliance
Cyber Insurance Is Now Compliance; But UK Businesses Aren’t Ready As cyber threats surge and insurance requirements harden, cyber insurance has shifted from a safety net to a core component of business compliance. Yet many UK SMEs remain dangerously unprepared for the rising expectations of modern underwriters, risking denied claims, unaffordable premiums and serious operational fallout. Cyber Insurance is the New Compliance | RSS.com Cyber Insurers Are Becoming De Facto Regulators The traditional view of cyber insurance as paperwork is now obsolete. Insurers are no longer accepting self‑declared cybersecurity maturity, they require verifiable proof of…
Why Cyber Resilience Can’t Be Audited Once a Year: Lessons from the UK Cyber Action Plan
Moving from box‑ticking compliance to real‑world cyber readiness Written by Richard Puckey Cyber security has a confidence problem For years, many organisations have taken comfort in annual cyber audits, certifications and compliance checklists. Pass the audit, tick the box and move on. On paper, everything looks secure. The problem? Cyber threats don’t operate on an annual cycle. The UK’s Cyber Action Plan is a clear signal that this approach is no longer enough. It challenges businesses to rethink cyber security not as a periodic compliance exercise, but as a living, breathing capability and culture that must stand up…
Unchecked Microsoft 365 Accounts could Become the Next Business Security Crisis, says Espria
Ensuring licenses are regularly reviewed, right sized and aligned with actual usage will keep costs under control even as prices rise. The UK’s new Cyber Security & Resilience Bill is set to bring businesses, not just MSPs, under stricter regulatory control, including tighter rules around resilience planning, faster reporting of cyber incidents, and stricter expectations for maintaining secure systems. The Cyber Security & Resilience Bill increases pressure on organisations to tighten identity governance and reduce avoidable attack surfaces. This directly impacts Microsoft 365 environments, where dormant or “zombie” accounts become a material compliance and security…
Why Enablement, Speed and Hybrid Visibility Will Separate the Best MSPs From the Rest
Espria CEO Angelo Di Ventura outlines what will define success in managed security over the next 18 months. Fresh from his recent appointment as CEO of Espria, Angelo Di Ventura has shared his perspective on how the Managed Service Provider landscape is set to evolve over the next 18 months, with enablement, speed and hybrid visibility emerging as the defining characteristics of the most successful providers. According to Di Ventura, the providers that will stand out will not be those that simply add more tools or services, but those that deliver consistency, clarity and confidence…