Phishing Still Number One Entry Point to cyber attacks, Harare Businesses told

By Ross Moyo

Despite all the talk about Artificial Intelligence (AI) posing cyber threats, phishing remains the biggest way in for cyber attackers, businesses were told at a breakfast meeting hosted by Telecomms giant, Liquid Intelligent Technologies, in Harare today.

According to global survey data shared by Sophos, about 24 percent of attacks still start with phishing emails, with compromised credentials being the second major vector, often because people reuse the same password for personal and work accounts that have previously been exposed on the dark web.

The Sophos State of Ransomware report, now in its sixth year since 2020, was referenced, showing that while the rate of data encryption has gone down from over 70 percent to around 50 percent as companies improved backups and awareness, the threat has not gone away.

Recovery costs have dropped from an average of 2.7 million dollars to 1.7 million dollars, and median ransom payments from $2 million dollars to under $800,000 dollars, not because attackers are less greedy, but because they are now tailoring demands to what they know the victim can afford.

One case cited involved a hospital where attackers demanded exactly $50,000 dollars — the balance in its bank account.

Speakers warned that backups are now also being targeted by attackers, and that organizations must test recovery plans.

The impact is not just financial but human, with IT managers, CISOs and compliance officers facing extreme stress, job loss and regulatory consequences under laws such as South Africa’s POPI Act and Zimbabwe’s own data protection frameworks.

Four pillars of resilience were recommended: prevention, protection with layered controls, detection and response with 24/7 monitoring, and planning and preparation with practised recovery plans.

The meeting hosted by Liquid comes when the world is commemorating cyber security awareness month, a global initiative that raises awareness about online safety and empowers individuals and businesses to protect themselves from cybercrime.