Many organizations mistakenly believe that implementing protection tools such as Managed Detection and Response (MDR) or deploying Endpoint Detection and Response (EDR) agents signifies the completion of cybersecurity work. However, experts warn that this is only part of the bigger picture, not a complete strategy.
Cybercriminals assess a company's security level not by the number of tools purchased, but by how easily they can move within the business after gaining access. Furthermore, initial attack vectors are often found where most organizations do not pay attention.
MDR is a valuable opportunity that improves visibility and response when implemented correctly, but it does not constitute a cyber strategy on its own. It represents only one layer of the vast attack surface that many companies do not fully realize.
Attackers do not care whether the MDR platform monitors endpoints. Their main goal is to find the weakest point in the system. This point could be a compromised Microsoft 365 account, a reused password from an old data leak, a convincing phishing email, or a misconfigured cloud application.
A privileged account that has never been audited or a forgotten vendor connection can also be a vulnerability. These issues are not related to endpoints, so they cannot be solved solely by endpoint monitoring.
The cybersecurity industry has become very effective at selling products: EDR, MDR, XDR, NDR, SIEM, SOAR—new acronyms promising better detection, visibility, and response appear every year. However, businesses buy confidence, not abbreviations.
This confidence should stem from the assurance that attacks will be detected early, suspicious activity will not go unnoticed, identity compromise will be identified before damage is done, and someone is monitoring the situation. Such confidence is achieved not through another tool, but through integration.
According to a Gartner study for 2026, the industry is moving from disparate sets of tools to resilience-focused security models managed through identity, AI governance, and operational integration. Gartner emphasizes that artificial intelligence expands the attack surface through agent systems and automation, and identity has effectively become the new perimeter. Organizations need to transition from a tool-based security model to an operational, resilience-oriented model.
The essence is that security is no longer a matter of accumulating products; it is about managing systemic risks across the entire digital environment. Most companies still think in terms of tools, while attackers think in terms of access. A modern attack touches five interconnected areas: users, email, data, machines, and the internet. These are not theoretical categories, but living attack paths where a weakness in one area quickly becomes an entry point into others.
Artificial intelligence has only accelerated this problem. Attackers use AI to automate reconnaissance, create highly convincing phishing campaigns, and scale identity-based attacks. At the same time, defenders also use AI for detection and response. But speed without context generates noise, and noise without integration creates blind spots where modern breaches thrive.
The core issue is that many organizations feel secure because they have coverage. MDR and EDR provide a feeling of coverage, but coverage does not equal resilience. Coverage is fragmented visibility, whereas resilience is connected visibility. The difference between them is often measured by the speed of breach detection and containment.
Cyber resilience is not a product you can buy; it is a design principle. It is the ability to see all attack surfaces, correlate behavior across systems, detect identity-related anomalies early, and respond before business impact escalates. MDR may and should be part of such a model, but it cannot be the model itself.
If your strategy still begins and ends with the phrase 'we have MDR,' then the real question is simple: what parts of your business remain invisible? Because the attackers already know. And they start not where you look, but everywhere else.
As the capabilities of artificial intelligence (AI) develop, experts warn that South African companies cannot rely solely on regulatory norms; they must invest in continuous protection against cyberattacks.
Some business leaders may have felt relief following the temporary suspension of access to some of the world's most advanced AI models, but cybersecurity specialists emphasize that restricting access to powerful AI is not a substitute for strengthening defense systems.
Richard Ford, CTO of Integrity360, noted that South African organizations should focus less on the presence of advanced AI models and more on the capabilities they have already demonstrated.
These remarks came after the US government's decision in June to suspend global access to Anthropic's Fable 5 and Mythos 5 AI models due to national security concerns. Access to Fable 5 was restored on July 1st after export restrictions were lifted and new precautions were implemented.
Ford warned that the brief suspension should not create a false sense of security. He stated: 'The instinctive reaction is to view the ban as a deterrent, but this is an incorrect conclusion for business leaders.' He added that while a deployed model can be turned off, the demonstrated technological capability cannot be undone.
The warning followed the documentation by Anthropic's own 'red team' that the Mythos Preview model is capable of independently finding and exploiting previously unknown software vulnerabilities.
One of the most significant findings was the discovery of a 27-year-old vulnerability in OpenBSD, an operating system considered one of the most secure in the world. The AI model was able to identify this flaw and develop a working exploit without human intervention, other than the initial prompt.
A more alarming aspect was the cost. According to Integrity360, one vulnerability search run cost less than $50, and conducting 1000 automated scans of the codebase cost less than $20,000. Ford believes this significantly lowers the entry barrier for cybercriminals.
For South African organizations, the main difficulty lies in the time required to remediate vulnerabilities after they are discovered. Globally, companies typically require 30 to 90 days to test and implement software patches. In South Africa, this period is often even longer due to a shortage of qualified cybersecurity personnel.
According to the World Economic Forum's 'Global Cybersecurity Outlook 2026,' 70% of CEOs in Sub-Saharan African countries reported that their organizations lacked the necessary cybersecurity skills to meet current security goals, representing the largest skills gap in any region.
Ford warned that attackers operating at machine speed are fundamentally changing the risk profile. He noted that ransomware operators, who have already disrupted state enterprises and financial institutions in South Africa, will not hesitate to use AI to automate the search for weaknesses across thousands of local networks simultaneously.
He added that artificial intelligence has effectively removed one of the biggest barriers that previously restricted cybercriminals. 'AI removes the technical resource barrier that once limited these groups, making the traditional vulnerability management model obsolete.'
Ford also pointed out that the threat extends beyond individual companies, as businesses increasingly rely on suppliers, municipalities, and government entities, which often have fewer cybersecurity resources and longer patching cycles.
He is convinced that organizations should abandon periodic security checks in favor of constant monitoring of their digital environments. Integrity360 recommends using Continuous Threat Exposure Management, which continuously assesses vulnerabilities and prioritizes the most critical risks, as well as Managed Detection and Response services and real-time threat intelligence.
Ford stated that cyber resilience should no longer be viewed solely as an IT responsibility. 'For South African executives, continuous exposure management is becoming a fiduciary duty at many levels.'
While regulation remains important, Ford cautioned that organizations cannot count on government intervention or restrictions on advanced AI to protect against increasingly sophisticated cyberattacks. Instead, businesses need to focus on reducing the time between vulnerability detection and threat response. He concluded: 'Machine-speed exploitation is already happening in real-world scenarios, and the long-term solution is to build detection and response commensurate with the adversary's pace, and then work to reduce the window of exposure before a breach occurs.'
