Proofpoint MSP ransomware survey: attacks fall but confidence in defenses remains low

Proofpoint's MSP Platform unit published its sixth annual ransomware survey on October 27–28, covering responses from 400 IT and cybersecurity professionals surveyed in July and August 2026. The headline finding is that reported ransomware incidents have dropped to around 18% of respondents, down from 24% in last year's survey, while basic defenses have become widespread: 91% of organizations now protect their backups against ransomware and 84% have a disaster recovery plan.

Despite that progress, the report found that only about 55% of respondents trust their own defenses — a gap the report describes as significant. Phishing remains the most common entry point, cited by 52% of those who experienced an attack, up from 46% in the prior survey. Compromised endpoints ranked second at 27%. Security awareness training has grown, with 84% of organizations now offering it, up 10 percentage points from last year. The survey also flagged a gap between awareness of AI-assisted threats and confidence that employees could recognize them.

For businesses relying on a managed security services provider, the data is a useful prompt to review what phishing simulation and awareness training is included in the current service agreement and whether backup protection and disaster recovery testing are verified on a regular schedule rather than assumed.