Cyber risk begins long before an attack

By Frik van der Westhuizen, CEO of EQPlus

Cyber incidents are usually discussed from the moment an attacker appears, even though the conditions that determine how damaging that attack can be take place much earlier. Over time, a business influences its own exposure through decisions about the technology it adopts, who can access it, how quickly it addresses vulnerabilities, and what happens to permissions when people or suppliers leave.

The numbers give some sense of what local businesses are dealing with. Check Point Research recorded an average of 2,803 cyberattacks per organisation each week in September 2026, up 48% from the previous year. In Africa, the average was even higher at 3,701 attacks a week.

AI is also changing the nature of the risk. The INTERPOL African Cyberthreat Assessment Report 2026 found that AI was involved in 55% of reported cybercrimes across the 36 African member countries surveyed. While buying another security product might be an easy response to those numbers, companies should instead focus on keeping the environment under control as the business evolves.

Risk accumulates

A security gap does not always begin with a significant mistake. Consider a new cloud platform brought in to solve a legitimate business need. It may require user accounts, access to company data, and connections to existing systems. Six months later, the platform is still there, but the original project team has moved on and nobody is quite sure whether every permission is still needed.

That is how exposure grows in ordinary environments. The business adds technology because it needs it, while the controls around it can fall behind the pace of change.

Generative AI is a current example. Check Point’s September data found that one in every 39 enterprise GenAI prompts posed a high risk of sensitive data leakage, with high-risk activity affecting 89% of organisations that regularly use these tools. The problem starts when employees use these tools without clear rules about what information they can share.

Basics become difficult at scale

Most ICT environments change gradually over time. New systems come in, people move in and out of the business, and access that was granted for a specific reason is not always removed afterwards. Older technology may also remain in place long after the rest of the environment has changed around it.

The problem is not that these changes happen. After a few years, the business may no longer have a clear record of what’s still in use or who can access it. That makes it much harder to see where the real security gaps are.

Routine ICT management is what keeps that picture current. It is where you discover whether critical systems are patched, old accounts remain active, backups can be restored, or alerts are generated without anyone properly investigating them.

Security has to keep up with the environment

A business can invest heavily in security and still lose control of small changes accumulating across its technology estate. Annual assessments have value, although they provide a view at a particular point in time. The environment continues changing the day after the assessment is completed.

Businesses need an up-to-date view of their ICT environment. That includes knowing which systems are running, where sensitive information is stored, who has access to it, and which security weaknesses still need attention. As systems, users, and suppliers change, that information can quickly become outdated.

At EQPlus, we see this as part of everyday ICT management. Regular monitoring and maintenance help teams identify vulnerabilities and address them before they become embedded in the environment for months. Access also needs to be reviewed as people join, leave, or change roles. Security tools can help, but they are far less useful when the business lacks an accurate view of the environment they are supposed to protect.

Security leaders should be judged on how effectively they deal with known weaknesses before those weaknesses are exploited. Weaknesses are far cheaper to find while the business still has time to deal with them. An attack is a particularly expensive way to discover what should already have been visible.