For many organisations, cybersecurity is still treated as a technical discipline that sits inside IT.
Cyber incidents now affect revenue, operations, service delivery, leadership credibility and customer trust.
That means cybersecurity can no longer be viewed as a narrow technical function.
It has become a business continuity issue, and companies that still separate the two are exposing themselves to unnecessary risk.
Sophos’ 2025 and 2026 frontline research shows just how quickly attacks now move, how often they exploit identity weaknesses, and how much pressure they place on the wider organisation once an incident is underway.
The old model assumed that if the IT team had the right tools in place, the business itself was protected.
That assumption no longer holds. Sophos reported in 2025 that in 56% of IR and MDR cases, adversaries logged in instead of breaking in.
In other words, the attacker often looked less like an outsider forcing entry and more like a legitimate user moving through the environment with valid access.
Sophos also found that the median time from the start of an attack to data exfiltration in ransomware, data extortion and exfiltration cases was just 72.98 hours.
That is not a slow-burning IT problem. That is an operational crisis timeline.
“Businesses need to stop thinking about cyber incidents as something that happens to the IT department,” says Pieter Nel Sales Director – SADC, Sophos. “When attackers gain access today, they are not only targeting systems – they are targeting the organisation’s ability to operate, to serve customers, and to make decisions under pressure.”
That shift is also visible in how fast attackers now move once they are inside.
Sophos’ 2026 Active Adversary Report found that 67% of all incidents investigated were rooted in identity-related attacks.
The same research showed that once an attacker is inside an organisation, it takes them just 3.4 hours to get to Active Directory, one of the most important assets in a Windows environment.
The same research showed that once an attacker is inside an organisation, it takes them just 3.4 hours to get to Active Directory, one of the most important assets in a Windows environment.
Sophos also found that 59% of cases still lacked MFA, making it easier for stolen or compromised credentials to be abused. This is why cyber risk is no longer just about whether the perimeter holds.
It is about whether the business can identify, contain and respond before operational damage spreads.
“What leadership teams need to understand is that modern attackers are bypassing the old signals,” Nel says. “If someone signs in with a valid account, the organisation may not immediately recognise that a crisis has already started. That is why resilience today depends on visibility, speed and coordination, not just prevention.”
The business continuity dimension becomes even clearer when looking at timing.
Sophos found in 2025 that 83% of ransomware binaries were dropped outside of local business hours.
In the 2026 report, Sophos found that 88% of ransomware payloads were deployed during non-business hours, while 79% of data exfiltration actions also took place off-hours.
These numbers matter because they highlight a structural weakness in many organisations: the business may be digitally dependent around the clock, but the response model is often still built around office hours.
An attack that lands at midnight on a Friday is not simply a security event. It is a continuity test.
“Cybercriminals understand business rhythm very well,” Nel says. “They know when teams are stretched, when decision-makers are offline and when response gaps are most likely to appear. That is why companies need to think in terms of continuity, not only control.”
Sophos’ broader enterprise ransomware survey reinforces the point.
Its 2025 enterprise ransomware report, based on the experiences of 1,733 enterprise organisations hit by ransomware, found that fewer than half of attacks ended with data encryption, with 49% of incidents resulting in encryption.
At the same time, 47% of attacks were stopped before encryption.
That suggests some organisations are improving their ability to interrupt attacks before maximum damage is done.
But the same research found that 48% of enterprise organisations still paid a ransom to recover data, while backup use dropped to a four-year low of 53%. Recovery, in other words, remains a major business issue even when prevention improves.
The cost dimension also matters.
Sophos found that the mean cost of remediation for enterprise organisations, excluding any ransom paid, was $1.84 million in 2025.
It speaks to disruption, recovery effort, management time and the wider operational consequences of an incident.
The same survey also found strong human impact on internal teams, with 40% of enterprise respondents reporting increased pressure from senior leaders after ransomware-related data encryption, 39% reporting ongoing workload increases and 37% citing changes in team priorities and focus.
A serious cyberattack does not just damage systems. It disturbs the organisation’s normal operating model.
“Too often, resilience is measured by whether the organisation has bought the right technologies,” Nel says. “A more useful question is this: if an attack happens tonight, how quickly can we detect it, contain it, communicate internally and keep critical operations running tomorrow morning?”
That is why the conversation needs to move upward.
Cybersecurity still requires technical leadership, but it can no longer remain owned only by IT.
CEOs need to see it as an operational issue. CFOs need to see it as a financial exposure issue. COOs need to see it as a service continuity issue.
Boards need to see it as part of governance and resilience.
Sophos’ 2025 report found that overall dwell time fell to just two days, and that in MDR investigations, dwell time was only three days for ransomware cases and one day for non-ransomware cases.
Those timelines show that when monitoring and response are stronger, business outcomes can improve.
The point is not that every attack can be prevented.
The point is that recovery and continuity are shaped by preparation, visibility and speed.
Courtesy: MYBROABAND
