Thought Leadership by André Kannemeyer, Technical CEO, Duxbury Networking

Most businesses understand why they need backups. They are essential when ransomware or another incident damages data. But a backup solves only one part of a cyberattack. It does not tell you whether the person signing into the environment is really the employee whose name appears on the account. 

INTERPOL’s African Cyberthreat Assessment Report 2026 found that South Africa accounted for almost 40% of phishing detections in Africa in 2025. Phishing remains effective because the objective is often to obtain credentials that let an attacker enter through the same login process used by legitimate employees. A business can therefore have clean backups sitting exactly where they should be while an attacker is using a valid account to move around the environment. 

A successful login can still be hostile

Multifactor authentication has made stolen usernames and passwords harder to use, but attackers have adapted. MFA fatigue relies on repeated approval requests, while more sophisticated phishing can intercept authentication information in real time. 

This changes what organisations should expect from identity security. Authentication controls need to make stolen credentials less useful and give security teams earlier warning when credentials have already been exposed. 

WatchGuard’s AuthPoint identity security platform is one example of how that layer is evolving. It supports phishing-resistant FIDO2 passkeys and zero trust policies alongside multifactor authentication across workforce access. AuthPoint Total Identity Security also includes dark web credential monitoring that alerts organisations when workforce credentials appear in breach databases. 

No authentication method removes credential risk completely. The practical aim is to make account takeover more difficult and reduce the time between exposure and action. 

What happens after authentication

The harder problem begins when an attacker gets hold of an account and initially looks much like the employee who normally uses it. Security teams then need enough context to recognise when that identity starts behaving differently. A successful login on its own says very little about whether the activity that follows is legitimate. 

Cynet approaches this through identity threat detection and response. Its identity security capabilities bring identity information together with endpoint and network telemetry to identify compromised accounts and suspicious behaviour. The platform can detect activity associated with lateral movement and privilege escalation, while its response capabilities can disable compromised users and isolate affected endpoints. 

A successful login therefore becomes only the starting point. What the identity does afterwards can provide the warning that something is wrong. An account that suddenly starts moving between systems or behaving in ways that do not fit its normal use may deserve attention even though the original authentication appeared legitimate. 

Backups solve a different problem

None of this makes backup and recovery less important. Businesses still need protected copies of critical data and a tested way to restore them. The problem comes when a backup strategy is treated as the complete resilience plan. 

If stolen credentials allow an attacker to remain active in the environment, restoring data does not address the route through which access was obtained. The organisation still needs to establish whether other accounts are affected and whether malicious activity is continuing before restored systems return to normal operation. 

Different security controls must be considered in relation to one another, even when they perform different jobs. Duxbury Networking’s cybersecurity portfolio reflects that approach. WatchGuard protects several security layers, including identity, while Cynet strengthens prevention, detection, response and 24/7 managed detection and response. For partners, the value lies in matching those capabilities to the customer’s actual exposure rather than treating one platform as the answer to every problem. 

Partners should test the identity assumption

For resellers and managed service providers, the conversation starts with what the customer assumes will still be trustworthy during an attack. Most organisations can explain where their backups are kept and how critical data would be restored. The more revealing question is what happens if an attacker obtains a valid identity despite the controls already in place. 

The answer will not always be another product. Sometimes the weakness lies in configuration, monitoring, response planning, or an assumption that nobody has properly tested. That is why the conversation should start with the exposure rather than the catalogue. 

Backups remain fundamental because businesses need a dependable way to restore data after an attack. Identity security addresses another part of the risk by making stolen credentials harder to exploit and suspicious use easier to identify and contain. 

A business can have every backup it expects to have and still face a serious incident because an attacker is operating through an account the environment believes it can trust. The time to find that weakness is before the attacker does.