Over 1 billion Naira in fraud slipped past automated security systems completely unnoticed across West Africa in the first half of 2026, according to esentry’s latest threat landscape report, Eye of Horus.
Investigations by the firm’s Digital Forensics and Incident Response team across Nigeria’s fintech, payment, and core banking sectors revealed that three major incidents ran their full course without triggering a single system alert, uncovered only after the fact by routine audits, support tickets, or settlement warnings.
The finding anchors a report esentry describes as its most operationally intensive to date. Across six specialized teams, the company processed more than 3.5 million security alerts in H1 2026, reaching a median detection-to-escalation time of 11 minutes for confirmed threats, a pace the report credits to tighter integration between endpoint monitoring, network correlation, and human analyst judgment.
Yet the same report is candid that speed at the monitoring layer does not close every gap. In each of the three fraud cases, esentry’s investigators found the same structural pattern. Attackers operating through credentials, sessions, or access to the environment had already extended trust, and logging failures made real-time detection impossible from the outset.
“Attackers are increasingly exploiting trust rather than vulnerabilities. A legitimate credential, a trusted developer tool, a familiar SaaS platform, or an AI-enabled workflow can all become an entry point when the right controls and visibility are missing.
“What we are seeing in H1 is a shift in the attack surface. The threat is no longer confined to the systems organizations traditionally think of as vulnerable; it is increasingly embedded in the technologies, identities and workflows businesses rely on every day,” said Gbolabo Awelewa, Chief Business Officer at esentry.
“Credential compromise, software supply chain attacks, abuse of trusted platforms and the growing use of AI by threat actors all point to the same reality: organizations cannot assume something is safe simply because it is familiar.
“The priority now is continuous visibility, proactive threat hunting and the ability to identify malicious behavior before it becomes business impact. For us at esentry, this is why cybersecurity must be an ongoing discipline of seeing what others might miss, questioning what appears trusted and building the resilience to respond as quickly as the threat evolves,” he added.
The report situates the finding within a national threat landscape it describes as intensifying on nearly every front. Nigerian organizations faced an average of more than 4,700 attacks per week over the half-year, while 281,500 Nigerian accounts were newly breached in the first quarter of 2026 alone, placing the country among the more heavily exposed markets globally for the period.
Separately, esentry’s threat intelligence team traced a financially motivated data broker, publicly operating under the alias ByteToBreach, to a single individual based in Thessaloniki, Greece, who has claimed breaches across more than 35 organizations in over 26 countries since June 2025, including an alleged, unconfirmed database from a major Nigerian bank.
The report extends the same scrutiny to esentry’s regional presence in Ghana, where the national Computer Emergency Response Team logged more than 3,500 confirmed cybersecurity incidents in the first quarter of 2026 alone, while 352 fraudulent online investment schemes cost victims a combined GHS 3,429,447 between January and June. esentry’s own analysis finds Ghana’s sector-targeting pattern closely mirrors what its teams have already observed in Nigeria, concentrated in financial services, government platforms, and telecommunications, allowing detection intelligence built on Nigerian data to transfer directly into the Ghanaian market rather than being developed from zero.
esentry’s offensive security division reported a comparable pattern under deliberate testing conditions. Across 175 engagements conducted in H1 2026, spanning targeted penetration tests, social engineering campaigns, and a cloud security assessment, every single engagement succeeded in gaining unauthorized access. None required a zero-day exploit.
The report attributes the results to recurring, correctable weaknesses in authorization design rather than sophisticated attack techniques, a distinction it argues should reshape how organizations prioritize security investment heading into the second half of the year.
For H1 2026, esentry collaborated with Darktrace, a renowned cybersecurity AI company, bringing a global perspective into its threat intelligence report for the first time. The collaboration combined esentry’s deep visibility across the African cybersecurity landscape with Darktrace’s global threat intelligence and research capabilities.
Darktrace contributed original research, highlighting a case study on React2Shell, a vulnerability disclosed in December 2025 that has continued to be actively exploited. The research found that threat actors developed a working exploit within just 30 hours of disclosure, while a decoy system deployed by Darktrace researchers was compromised within two minutes of going online. The findings reinforced what esentry’s teams were already observing across Africa: attackers are moving faster, automating more of the attack chain, and targeting the seams between cloud and on-premises environments with growing precision.
esentry’s recommendations for the second half of 2026 center on closing the gap between detection capability and detection coverage, mandating egress logging and authentication source-IP retention as a baseline rather than an upgrade, enforcing backend authorization at every application endpoint, and extending the same governance discipline to esentry’s own newly launched agentic AI security capability, which the company has restricted to operate only with human sign-off at every high-impact decision.
