Across those attacks, 8% of initial compromises occur in VPNs.

Publisher	Sophos
Report	The State of Ransomware 2026
Published	15 July 2026
Topics	VPN, Network Security

Published by Sophos in The State of Ransomware 2026, 15 July 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

VPN and remote access systems account for roughly one-third of initial access vectors in healthcare cyberattacks.

Securin, 27/05/2026

Adoption of more advanced controls like two-factor authentication (47% businesses and 38% charities), a virtual private network for staff connecting remotely (36% businesses and 17% charities) and user monitoring (30% businesses and 31% charities) remain lower than other measures.

Department for Science, Innovation & Technology, 27/05/2026

VPN Common Vulnerabilities and Exposures (CVEs) grow 82.5% over the analyzed period.

SonicWall, 27/05/2026

Roughly 1 in 5 of all device identification events in 2025 involved a VPN connection.

Fingerprint, 27/05/2026

46% of people use a VPN, up from 42%.

Malwarebytes, 27/05/2026

Access is increasinly sold as tokens, SaaS admin, and integration footholds, not just VPN/RDP.

Group-IB, 27/05/2026

Get the newsletter

Weekly cybersecurity statistics by email.