Network edge devices have grown to account for over a quarter of all initial business compromises, new research from Sophos found.

The cyber firm tracked cyber incidents hitting small businesses in 2024, finding that ransomware accounted for 70% of all cases Sophos tracked.

This was true for 90% of all midsized organisations, the firm found.

For small and midsized businesses alike, ransomware and data theft accounted for almost 30% of all managed detection and response incidents tracked by Sophos in 2024.

The firm also found that ransomware incidents saw a decline in 2024, though the cost of the attacks rose overall.

While some trends continued, Sophos found that new, data-focussed threats grew, as new tactics emerged.

Firewalls, virtual private network (VPN) appliances, and other network edge devices acted as the vector for a fourth of all initial compromises in businesses. As Sophos could only track cases that were confirmed by telemetry, this figure is likely much higher, the firm estimated.

VPNs were found to account for over 25% of all incidents and 25% of ransomware and data exfiltration events, Sophos highlighted.

New advancing techniques in social engineering, malware, and initial compromise continue to plague software-as-a-service platforms, Sophos found, as the widely-adopted services fall victim to evolving threats.

Recommended reading

• 60% of Businesses Anticipating a Cyber-breach in 2025
• VPN Security Fears Pushing Firms To ‘Zero Trust Everywhere’
• Growing Adoption of Zero-trust and Multi-cloud Environments

Business email compromise is a growing proportion of all initial compromises in cyber incidents. This vector can be leveraged to deliver malware, steal credentials, or for a variety of social engineering purposes.

Sophos found that adversary-in-the-middle multifactor authentication (MFA) token capture is a growing credential phishing method driving the rise of business email compromise.

Mobile threats are also being driven by fraudulent applications and social engineering campaigns for malware delivery, affecting both small and midsized businesses.