Most medium and large South African organisations already run the endpoint controls they are supposed to. EDR, disk encryption, multifactor authentication and tamper protection are standard in most estates. According to Petre Agenbag, Service Delivery Managerat Dariel, the harder problem heading into 2027 is coverage: knowing that every device the organisation owns is running those tools and finding out quickly when one isn’t.
“Ask a security team on any given morning which version of which agent is running on which device, and where the gaps are, and most of them can’t tell you with much confidence,” he says. “I’ve seen that in a lot of environments, and it’s usually where an attackergets in.”
Agenbag would rather see coverage reported as a percentage of the estate than as a dashboard full of alerts. He treats an unmanaged laptop as an incident, because to an attacker it can be worth more than a zero-day. And since someone will eventually land ona machine, he argues for least privilege and application control on the endpoint itself, so that one compromised device doesn’t turn into domain administrator access an hour later.
What AI has changed for attackers
Much of the public discussion about AI-driven attacks focuses on autonomous, self-directing malware. Agenbag says what he actually sees is more ordinary. Phishing emails are well written, including in Afrikaans and isiZulu, without the spelling and grammarmistakes people were taught to look for. Reconnaissance that used to take days takes minutes, and malware is rebuilt often enough to stay ahead of signature-based detection.
Behaviour-based EDR copes better with this, he says, because malicious code has to do certain things once it runs, whoever or whatever wrote it. “It still has to inject into a process, or dump credentials, or start encrypting files in bulk. That looks muchthe same on the device whether a person wrote the code or a model did, so that behaviour is what we should be watching for.”
Defenders can use AI for triage, correlation and automatic containment, and Agenbag expects the organisations that put it to work properly to be in a stronger position. He is wary of handing judgement to a model that will produce a plausible explanation foran alert whether or not it is correct. The larger change, in his view, is volume. “A small team can now run as many campaigns as a large one used to. So, your weakest laptop, or the one password someone reused, gets found a lot sooner than it would have afew years ago.”
Identity lives on the device
The widely quoted figure that around four in five attacks begin with a compromised identity makes more sense, Agenbag says, once you look at where identities sit day to day. Session tokens, cookies and cached credentials are stored on the endpoint, and an attackerwho steals a live token can get past MFA without ever being challenged.
“They don’t need to log in,” he says. “They pick up a session that’s already logged in and carry on from there.”
For that reason he thinks organisations should be measuring what an identity can reach from a particular machine, which he calls its blast radius. In his experience most have never measured it. He also wants device health and identity linked in both directions.A device that is unpatched, out of compliance or missing a healthy EDR agent should be given narrower access, and a compromised device should be isolated and have its sessions revoked in a single action. “Most teams can do one or the other, but very few cando both quickly, and the damage tends to happen in the few minutes between.”
Replacing an endpoint platform
Vendor feature lists look broadly similar on paper, so when organisations replace their endpoint platform Agenbag focuses on how it behaves once it is running. He suggests buyers ask how long it takes to get from contract signature to every device protected,and whether the tool clearly shows what is still uncovered. With South Africa’s shortage of skilled security staff, a powerful console that nobody has time to tune will offer little real protection. The migration needs careful planning too, as two EDR agentson one machine tend to interfere with each other, and a rushed cutover can open gaps at a bad moment.
He also checks whether the platform feeds the SIEM, the identity provider and the ticketing system, or becomes one more console that people rarely open. Because of ransomware, he won’t compromise on tamper protection or rollback. He wants clear exit terms aswell. “If you ask whether you can take your own telemetry with you when you leave and the answer is vague, I’d assume the price you were quoted isn’t the real one.”
His strongest advice is to run the proof of concept on the organisation’s own machines. “The vendor’s demo environment is set up for the demo to go well. Your estate was put together over years by people who’ve mostly moved on, and it will behave differently.”
Where the agent can’t see
Endpoint software only protects devices it is installed on, and Agenbag says there are more devices without it than organisations like to admit. He points to BYOD laptops, contractors’ machines, operational technology on the factory floor and the RaspberryPi someone plugged in two years ago to solve a problem. Signed, trusted tools such as PowerShell and remote-management software are hard to block without getting in the way of legitimate work. A stolen identity used inside a SaaS or cloud tenant may nevertouch a laptop that EDR is watching. And a user who approves the fourth MFA prompt at two in the morning has, in effect, got around most of the stack.
“Most of these come back to inventory,” he says. “A forgotten device, a trusted tool someone’s misusing, a session sitting in the cloud. Usually, the organisation just didn’t know it had it. Endpoint security works from whatever picture it has of the estate,and for most companies that picture is quite out of date.”
