Troye technical director Kurt Goodall. (Image: AI-enhanced)
Blaming the firewall when a cyber attack gets through is a little like blaming the front door when someone walks into your house wearing a uniform. The problem is not necessarily that the door failed, the problem is that someone found another way in.
Modern cyber attacks have become far too sophisticated for businesses to think of cyber security as a collection of products sitting behind a perimeter. The real challenge is detecting what looks legitimate, understanding what is actually happening and continuing to operate when something inevitably gets through.
E-mail is a good place to start because it remains one of the easiest ways for an attacker to exploit trust. Traditional spam filters were designed to identify unwanted messages, suspicious senders and known malicious content. That remains useful, but today's attacks are increasingly designed to look like normal business communication.
A convincing request from a compromised supplier, an apparently legitimate document or a message that directs an employee to a familiar cloud service may sail straight past a conventional spam filter. The problem is no longer simply identifying junk mail. It is identifying deception.
Check Point Research's Cyber Security Report 2026 found that social engineering remained a major attack vector in 2025, while attackers increasingly combined techniques across e-mail, messaging and other collaboration platforms. Its AI Security Report 2026 also highlights how artificial intelligence is accelerating the ability of attackers to create and scale sophisticated campaigns.
That changes what organisations should expect from e-mail security. Stopping spam is no longer enough. Security needs to understand behaviour, context, identity and intent.
But even the best e-mail security cannot guarantee that nothing will get through. This is where the distinction between cyber security and cyber resilience becomes important. Cyber security is about reducing the likelihood and impact of an attack. Cyber resilience is about ensuring the organisation can continue functioning when those defences are bypassed.
The World Economic Forum's Global Cybersecurity Outlook 2026 found that only 19% of organisations surveyed believed their cyber resilience exceeded their requirements. That is a sobering statistic because it suggests that many businesses are still better at building walls than planning for what happens when someone climbs over them.
Resilience requires a different mindset. If ransomware takes down a critical system, can the business continue operating? If a senior executive's credentials are compromised, can the organisation contain the account before the attacker moves further? If a major supplier is breached, does anyone know which systems and data could be affected? These are not questions that a firewall, endpoint security platform or e-mail filter can answer on its own. They require preparation, visibility and a response capability that extends beyond prevention.
This is also why managed detection and response (MDR) is becoming increasingly relevant. The problem for many organisations is not a lack of security alerts. It is having too many of them and too few people with the time and specialist expertise to determine which ones deserve immediate attention.
IDC has highlighted the role of MDR in helping organisations address the growing complexity of threat detection and response and the shortage of specialist security skills. A security platform can tell you that something unusual happened. The value of an effective response capability is understanding whether it matters and doing something about it.
That distinction becomes particularly important outside office hours. Attackers do not work nine to five, and a suspicious login at 2am does not politely wait for the security team to arrive the next morning. MDR provides continuous monitoring, investigation and response, helping organisations shorten the time between an attacker gaining access and someone taking action. It is not about replacing internal IT teams.
It is about extending their ability to deal with a threat environment that has become too fast, too complex and too persistent for many businesses to monitor alone.
Ultimately, cyber security is moving away from the idea that one product can solve one problem. E-mail security needs to recognise sophisticated social engineering. Detection needs to connect activity across users, devices and applications. Resilience needs to assume that something will eventually get through. And MDR needs to turn the flood of security data into decisions and action.
The firewall can keep doing its job, just stop asking it to do everyone else's. A resilient business is not one that never gets attacked, it’s one that can spot the attack, contain it, keep operating and recover without allowing one bad e-mail to become a very good day for a cyber criminal.
