Sophos' seventh State of Ransomware report finds exploited software flaws dethroned as the top attack route, as email and identity compromise take over and falling ransom figures mask a harder shift in how attackers get in.

With payment bans spreading across jurisdictions and the data showing that paying buys neither safety nor silence, security leaders are confronting a harder question than whether to pay: how they became the target in the first place, and whether they can recover without negotiating at all.