Closing the security blind spots that are a prime entry point for attacks | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

Closing the security blind spots that are a prime entry point for attacks

Unpatched firewalls continue to give threat actors their golden opportunity

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

What if the biggest cybersecurity risk is not the attack you fear most, but the weakness you forgot or never knew was there?

Many organizations worry that the next breach will come from a highly sophisticated attack so advanced that nothing could have stopped it. That fear is understandable, but the truth is often more uncomfortable.

Principal Consulting Architect XDR - International, Office of the CTO, Barracuda.

In many cases, breaches do not begin with an unstoppable threat. They begin with a blind spot such as a missed patch, a dormant account, a device outside corporate security control or a firewall left exposed. These small gaps that are easy to overlook are exactly the kind of gaps attackers know how to find.

Why software defects are now the biggest security threat

Most ransomware attacks are opportunistic. Here’s how you can stop attackers

76% of UK organizations have faced deepfake attacks. Most weren’t ready

This is the reality, and one of the key findings from our recent report, which found that, in most cases, it is preventable security issues that open the door. Unpatched firewalls, rogue endpoints, dormant identities and misconfigurations continue to give threat actors the opportunity they need.

Why are attackers focusing more on identity than infrastructure?

Because compromising an identity is often easier and quieter than attacking a system head-on.

Once attackers compromise an identity, they are no longer forcing their way in. They are walking in through a trusted door and this is an important shift that we’re now seeing.

Stolen usernames and passwords can provide access to cloud services, email and remote access tools, and valid credentials let attackers easily blend in with normal user activity.

From there, they can escalate privileges, move laterally and turn limited access into broader control over the environment.

Sometimes, the speed with which this happens is startling. In one case, we have detected that the time between the initial breach and the execution of a full ransomware attack was just three hours.

In another real-world incident, attackers gained access through a dormant account that had originally been created for a third-party vendor and was never deactivated after the contract ended. One forgotten account eventually became the route to ransomware.

Maintaining cyber control when AI can act autonomously

Are organizations still being exposed by endpoint and firewall gaps?

Yes, and at scale. Attackers actively look for unprotected business laptops, tablets or servers that fall outside normal security controls, because these devices can provide a path around corporate defenses.

The issue is not always a lack of security tools. In our experience, from monitoring thousands of different environments, the issue often comes down to a lack of consistent configuration. Security tools that have either been accidentally or intentionally disabled present a major security risk. The danger can be heightened as teams may have a false sense of security that comes from having the tool installed in the first place.

We also know that many organizations are trying to manage too many security tools with limited resources. And when teams are overstretched, configuration errors become more likely. That is often where attackers gain their advantage.

It also helps explain why relatively simple attack techniques remain so effective.

Threat actors continue to exploit known vulnerabilities, including some that have been around for years which can be found in legacy systems such as old servers or applications.

More striking still, from our analysis of data last year , we found that the vast majority of ransomware incidents exploited firewalls through either a CVE or a vulnerable account.

Some of the most malicious behavior can look annoyingly legitimate.

Threat actors are increasingly relying on living-off-the-land (LOTL) techniques, using legitimate tools already present in the environment to carry out malicious actions.

One of the clearest examples is fileless malware attacks which use Power Shell as the primary execution method.

That creates a serious challenge for defenders. Power Shell is widely used for legitimate IT administration and maintenance. When malicious activity mimics normal operations, it becomes much harder to distinguish threat behavior from business-as-usual.

This is one of the most difficult blind spots organizations face today: not the threat you can clearly see, but the one that resembles something familiar.

AI is helping threat actors move faster, adapt quicker and scale their efforts far more efficiently.

As threat actors adopt agentic AI, the exploitation of common weaknesses is likely to accelerate. These technologies can help cybercriminals scan environments continuously, identify weak configurations in minutes and rewrite malicious code on the fly to avoid detection.

In other words, the same overlooked issues that are already dangerous today could become even more exposed tomorrow.

That is why basic security weaknesses can no longer be treated as minor issues. In an environment where attacks can be launched and adapted far more quickly, weak identity management controls, unpatched systems and unmanaged devices become far more costly.

Start with the basics and treat them as strategically important, not operational housekeeping.

Some of the fastest and most effective improvements include: consistent multi-factor authentication and stronger access controls; a disciplined approach to patch management and data protection and regular cybersecurity awareness training for employees

But closing blind spots fully requires more than isolated fixes because resilience depends on visibility. The more fragmented security becomes, the easier it is for critical signals to be missed. But when organizations have end-to-end visibility and coordinated management across their environment, they are far better placed to detect both the obvious weaknesses and the hidden ones.

A unified security strategy is one that combines advanced, AI-powered detection technologies with a fully automated SOC. Working with a provider who can deliver that protection 24/7 through a comprehensive managed security platform reduces the burden on internal teams.

And that is what long-term cyber resilience is really built on: not just defending against the spectacular attack, but closing the everyday gaps that attackers are counting on.

As I always say; the breach that changes everything often begins with something that seemed too small to matter.

We feature the best small and medium business (SMB) firewall software.

This article was produced as part of Tech Radar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of Tech Radar Pro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Principal Consulting Architect XDR - International, Office of the CTO, Barracuda.

You must confirm your public display name before commenting

1 Modern Warfare 4 developer breaks down the most advanced weapon simulation in Call of Duty history — 'We want them to feel like real weapons, but they shouldn't feel frustrating'

210 free Microsoft Build sessions you should absolutely attend to see AI's future

3 How to turn your photos into paintings, cartoons, and pixel art with Adobe Firefly

4T-Mobile just brought back its best i Phone 17 deal ever — you don't even need to trade-in to get the device included with a new line now

5 This new super-slim adapter adds apt X Lossless and LDAC Bluetooth to i Phones — upgrade your wireless music for cheaper than you might expect (and it doesn't stop you from charging at the same time, mercifully)

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards