Cybercriminals have stopped trying to break into the business through security tools. The effective 2026 approach is to move around them entirely, exploiting the gaps between isolated controls, since few security solutions have a complete picture of the system. The result is that companies with comprehensive, fully functioning security stacks are being breached like a hot knife through butter because the architecture around them was never built to detect modern attacks.
The tools used to protect businesses from cyberattacks are being bypassed by intelligent threat actors who penetrate businesses through business email compromise or phishing emails that are 100% not malicious. The links in these emails, SMS messages, or WhatsApp communications lead to websites that are not malicious, but those sites redirect users to malicious destinations that infect the business.
This sophisticated re-routing approach makes it increasingly difficult for security solutions to catch the threats. An email security tool scanning for known malicious content will not flag a clean email directing a user towards a chain of legitimate-looking redirects. An endpoint protection platform will not catch a payload deliberately engineered to appear benign. The tools are working properly, but the attacks are slipping past their defences because no single layer of the stack has sight of the full picture.
URL redirection has become one of the most common phishing techniques, used in around 54% of phishing attempts, with open redirects and legitimate-looking services that hide malicious URLs. Business email compromise (BEC) was listed at $2,77 billion in losses in 2024 in the IC3 2025 report, with the highest-probability loss paths planned for 2026 still focused on identity theft and BEC challenges, respectively. These have become one of the most common attack patterns in the current threat environment, and they are succeeding at scale because companies have built their defences around products that operate in isolation.
Layered security approach
If an attacker gets past one layer, there needs to be redundancy behind it. No system is more than 99,99% effective, which means every individual control will eventually be bypassed. The only architecture capable of supporting this reality is one that ensures that when a failure occurs at one layer, it is caught by the layer below.
A layered defence builds controls that compensate for limitations. Email security at the perimeter filters what it can, endpoint protection catches threats that reach the device, network monitoring identifies unusual behaviour and lateral movement that point solutions miss individually. Identity controls then close the credential and session abuse pathways that underlie most initial breach vectors. Each layer narrows the window an attacker can exploit. Together, all these systems create a chain of visibility that no single tool can provide.
The security operations centre (SOC) is the layer that makes the rest of the architecture function under pressure. Security teams managing isolated tools are saturated with alerts, the majority of which are noise, and the genuine threats that arrive during stretched periods are missed because there is not context to act on them.
A SOC correlates signals across the entire environment, stripping out noise and providing the intelligence layer that sees the full sequence of the attack rather than its individual components. It also operates continuously rather than during business hours when teams are fully staffed.
Awareness training is another key layer. Attackers target people because they are faster to exploit than a patched system. A user who can identify a redirect chain, who questions an unexpected payment instruction regardless of how convincing the sender appears, and who knows how to escalate before clicking, becomes a security control that no product can replace.
Finally, it comes down to translating security within the business as an architecture. It is a control, detection, and protection environment built around how attacks actually work today, and each layer is capable of detecting what the previous layer missed, supported by human oversight that ensures context and capability.
The attack that breaches a business in 2026 will almost certainly have passed through at least one security tool undetected. The question is whether there was anything behind that tool to catch it. For most South African businesses, the honest answer is no, and so closing that gap starts with understanding that a collection of tools is not the same thing as a defence.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version