In the first of 3 episodes covering Sophos’ 2025 report ‘The State of Ransomware’, Brian Sibley, VCTO at Espria and Jon Hope, Cyber Security Evangelist at Sophos discuss the findings of this year’s report, and specifically its implications for the UK.
In this episode the team will reveal key findings that cover the scale and impact of ransomware in the UK, including 70% of attacks resulted in data being encrypted and 26% of encryption-led attacks also involved data theft. The team also discuss the report in comparison to the findings of the 2024 report, the trends and shifts in attack tactics and their outcomes. Gain an understanding of the real-world implications for UK businesses across various sizes and sectors.
This podcast episode delves into the complexities of ransomware attacks, highlighting both technological and human factors that contribute to their success. It underscores the importance of a multi-layered defence strategy combining technology, human expertise and education.
Brian and Jon discuss how ransomware attacks are frequently caused by multiple factors, including both technology vulnerabilities and human errors. Exploited software vulnerabilities are the most common cause, accounting for about 32% of successful attacks. These vulnerabilities are usually flaws in software that cybercriminals exploit to execute malicious code. Whereas remote ransomware attacks involve cybercriminals using vulnerable or unmanaged devices within a network to attack other devices that store valuable data. Traditional endpoint protection often fails to detect these lateral attacks.
Human factors also play a significant role in ransomware infiltration. Compromised user credentials, often obtained through social engineering tactics such as phishing, are a common cause. Phishing remains a significant threat vector, relying on human interaction to succeed. Cybercriminals craft highly convincing emails using AI to mimic brand language, tone and logos, making it difficult for users to distinguish legitimate messages from malicious ones.
Organisations face operational challenges such as a lack of skilled cybersecurity personnel, insufficient time to dedicate to security and acceptance of certain security gaps as risks. These challenges underscore the need for adequate resources and comprehensive security strategies.
The podcast emphasises the importance of security data and logs as critical defence tools. Extended Detection and Response (XDR) platforms consolidate security data into a single location for easier analysis. Managed Detection and Response (MDR) services provide 24/7 expert monitoring and analysis, offering a cost-effective alternative to building an in-house team. Integrating data from various tools allows for comprehensive visibility and early warnings.
Backups are crucial for recovery, but cybercriminals often target them first. Integrations with backup vendors can enable monitoring for suspicious changes. The discussion concludes by emphasising that while recovery capabilities are improving, preventing ransomware attacks remains the priority. Early detection through human-led threat hunting, combined with integrated technology tools, and continuous education are key to defending against sophisticated ransomware threats.
