One click from crisis: How to fortify your business against cyberattacks

A supplier emails to say its bank details have changed. A finance employee receives a text asking them to approve an urgent payment. A critical software flaw sits unpatched for weeks. A trusted service provider is breached and gives criminals a route into the company network. 

None of these moments necessarily looks like a cyberattack. Each looks like ordinary business until money is redirected, credentials are stolen, data is encrypted or operations stop. 

That is why business fraud can no longer be treated as a problem for the IT team alone. Finance, procurement, operations, human resources, executives and external partners all form part of the control environment.  

The safest businesses make verification, restricted access and rapid escalation part of everyday work. 

Business email compromise still deserves a pause 

Business email compromise (BEC) remains one of the most direct ways to turn trust into financial loss. A criminal may take over a genuine mailbox, monitor real correspondence and wait until an invoice or payment is due.

They then change the beneficiary details, redirect the instruction or impersonate a senior executive. Because the context and language may be real, the email can look completely authentic. 

For a changed invoice, Kevin Hogan, Investec’s Head of Fraud Risk advises the following:  “Call the sender on their official number and verify telephonically the bank details you’ve received.”  

The FBI’s 2025 Internet Crime Report recorded 24,768 BEC complaints and more than US$3 billion, (approx. R49.7 billion) in reported losses in the United States alone.

The control that matters most is simple: never approve new or changed bank details from an email alone.

 “Always verify your supplier bank details. Use an established account-verification service or call the supplier on a number already held in your approved records. Do not use a number supplied in the email or altered invoice, and do not reply to the same email thread for confirmation,” warns Thivian Moodley, Head of Transactional Banking, Digital Product and Pricing at Investec Business and Commercial Banking.

Ransomware attacks more than data 

Ransomware is malicious software that locks files or systems so criminals can demand payment to restore access. Attackers may also steal data and threaten to publish it. An attack can interrupt customer service, stop production and create regulatory and reputational consequences.

Verizon’s 2025 findings showed that ransomware was involved in 44% of breaches, up 37% from the previous year. The median ransom payment was US$115,000, although 64% of victim organisations did not pay. 

Whether a business pays is only one part of the cost. Recovery may require forensic investigation, system restoration, legal advice, customer communication and extended downtime.  

Offline backups, tested recovery plans, endpoint protection, network segmentation and rehearsed incident response are therefore as important as the decision made after an attack. 

Cyber insurance can provide another recovery layer, but it is not a substitute for controls. Moodley recommends that businesses assess dedicated cyber cover as part of their wider risk planning.  

Investec clients can raise this need with their banker or insurance adviser, while still comparing the scope, exclusions, incident-response support and security requirements of available policies. 

The vulnerability window is getting wider 

Not every attacker needs to deceive an employee. Vulnerability exploitation – taking advantage of a security flaw in software or a system to gain unauthorised access – accounted for 31% of initial access in Verizon’s 2026 analysis, a 55% increase from the previous year.

Yet the median time required to resolve a critical vulnerability had stretched to 43 days. That gap gives criminals time to scan for exposed systems and act before remediation is complete. 

Businesses need an up-to-date inventory of devices, applications and internet-facing services; a clear owner for each system; and patching deadlines based on risk.

Unsupported software and forgotten accounts should be removed.  

“Antivirus and firewall software must be properly licensed, centrally managed and kept current across every work device. A control that exists but is not updated cannot offer the protection the business assumes it has,” says Moodley. 

Your supplier can become your attack path 

A trusted third party may hold data, connect to systems, process payments or provide software that your business depends on. In the 2026 Verizon Data Breach Investigations Report, third-party involvement rose by 60% and featured in 48% of breaches.  

The risk therefore extends beyond the controls inside one organisation. 

Before granting access to a supplier, establish what information they need, how it will be protected and what happens when the relationship ends. Limit permissions, review them regularly and require prompt notification of incidents.  

Critical providers should be included in continuity planning and cyber exercises. Procurement should assess security alongside price, service and commercial resilience. 

Routine payment files can hide operational fraud 

Fraud can also occur between legitimate business systems. Payroll or supplier-payment files are often downloaded from an enterprise resource planning system, handled on a laptop and then uploaded into a banking platform.

Every manual step creates an opportunity for account numbers, amounts or references to be changed, whether by malware or an insider. Direct bank integration reduces that point of intervention by sending approved data between the organisation’s business system and its bank.

Investec offers business and commercial banking clients API and host-to-host integration options, as well as low-code connections for selected platforms.

The objective is not simply convenience, it is to reduce manual file handling, strengthen the audit trail and make unauthorised changes harder to introduce unnoticed. “Once it’s set up, you remove a point where someone could fiddle with the file,” says Moodley.  

The human element is still central 

People were involved in 60% of the breaches analysed for Verizon’s 2025 report. That does not mean employees are the problem. It means criminals design attacks around human behaviours and emotions like trust, panic, concern and even curiosity.  

AI is making cyberattackers’ approaches more convincing. The 2025 report found that synthetically generated text in malicious emails had doubled over two years.

It also found that 15% of employees routinely accessed generative AI platforms on corporate devices, creating another potential route for confidential information to leave the business. 

Clear rules are needed about which AI tools may be used and what data is sensitive and should not be fed into the tool. AI training should be frequent and relevant to the employee’s role.

Finance teams need to practise payment-verification scenarios; executives should expect impersonation attempts; and all employees should know how to report a suspicious interaction without fear of blame.

Password policies must also be usable. “A business-managed password manager helps employees create unique credentials without storing them in spreadsheets, documents or notebooks. You need to give employees the tool that will allow them to do that easily,” says Moodley. 

Investec Business Online allows clients to configure roles, permissions, payment limits and authorisation flows. Moodley says businesses often leave settings too broad because it feels easier. 

“You’d be shocked at how many times I see customers just setting their payment limit to unlimited. The safer approach is to match access and limits to each employee and the way the business actually operates,” says Moodley. 

What to do when fraud is suspected 

• Contact the bank immediately if money may have been transferred and ask the fraud team to trace, recall or freeze the payment.
• Isolate affected devices and accounts without destroying evidence.
• Preserve emails, message headers, invoices, payment records, logs and screenshots, and activate the incident-response plan. 
• Reset compromised credentials, revoke active sessions and review mailbox forwarding rules and account permissions.
• Notify affected suppliers, customers and insurers through trusted channels, and
• Report the incident to the relevant law-enforcement and regulatory bodies.  

Recovery is never guaranteed, but early action can improve the chance of containing both the financial and operational damage. 

Make the pause part of the process

Cyber fraud changes shape, but it repeatedly exploits the same gaps: excessive access, weak verification, delayed patching, manual workarounds and pressure to act quickly.

Technology can reduce those openings, but only when the business configures it deliberately and employees understand why the controls matter.

For Moodley, it’s all about layered security measures: “Layer the security so that one mistake, one stolen password or one compromised device cannot become a business-ending event”.