A new report by Cybersecurity firm, esentry, has revealed that more than N1 billion in fraud went undetected by automated security systems across West Africa in the first half of 2026, exposing gaps in the monitoring systems used by financial institutions.
The firm’s Eye of Horus H1 2026 Threat Landscape Report found that three major fraud incidents investigated across Nigeria’s fintech, payment and core banking sectors were completed without triggering a single security alert.
The incidents were discovered only after the transactions had occurred, through routine audits, customer support tickets and settlement warnings, highlighting the limitations of automated security systems when attackers exploit legitimate credentials and trusted access.
According to the report, the incidents were not primarily driven by sophisticated software vulnerabilities but by attackers abusing existing access privileges, compromised sessions and weaknesses in security logging.
Nigeria records over 4,700 cyberattacks weekly
The report described Nigeria’s cybersecurity environment as increasingly exposed, with organisations facing an average of more than 4,700 attacks per week during the first half of 2026.
- It also reported that 281,500 Nigerian accounts were newly breached in the first quarter of the year, placing the country among the more heavily exposed markets globally during the period.
- Despite the growing threat, esentry said its six specialised teams processed more than 3.5 million security alerts in the first half of 2026, achieving a median detection-to-escalation time of 11 minutes for confirmed threats.
- The company attributed the response time to closer integration of endpoint monitoring, network correlation and human analyst judgement.
However, the report noted that faster responses to detected threats do not necessarily translate into comprehensive security coverage, particularly when organisations lack the logs needed to identify suspicious activities.
Commenting on the findings, Gbolabo Awelewa, Chief Business Officer at esentry, said cybercriminals were increasingly exploiting trusted systems rather than relying exclusively on technical vulnerabilities.
- “Attackers are increasingly exploiting trust rather than vulnerabilities. A legitimate credential, a trusted developer tool, a familiar SaaS platform, or an AI-enabled workflow can all become an entry point when the right controls and visibility are missing,” Awelewa said.
He added that credential compromise, software supply chain attacks, the abuse of trusted platforms and the growing use of artificial intelligence by threat actors were expanding the range of potential entry points for cyberattacks.
According to him, organisations need continuous visibility, proactive threat hunting and the ability to identify malicious behaviour before it translates into financial or operational losses.
Ghana faces rising cybercrime and investment fraud
The report identified similar cybersecurity challenges in Ghana, where the national Computer Emergency Response Team recorded more than 3,500 confirmed cybersecurity incidents in the first quarter of 2026.
- Between January and June, 352 fraudulent online investment schemes reportedly cost victims a combined GHS 3.43 million.
- esentry said its analysis showed that cybercriminals in Ghana were targeting financial services, government platforms and telecommunications, mirroring patterns observed in Nigeria.
- The company said this overlap allows threat intelligence gathered from Nigerian operations to support detection efforts in Ghana, rather than requiring security teams to develop entirely separate threat models.
- The report also examined the activities of a financially motivated data broker operating under the alias ByteToBreach.
According to esentry’s threat intelligence team, the individual was traced to Thessaloniki, Greece, and had claimed responsibility for breaches involving more than 35 organisations across over 26 countries since June 2025.
The claims reportedly included an alleged database from a major Nigerian bank, although esentry noted that the breach had not been confirmed.
Penetration tests expose weaknesses in access controls
The report also highlighted weaknesses in organisations’ security architecture, drawing on 175 offensive security engagements conducted by esentry during the review period.
- The engagements included targeted penetration tests, social engineering campaigns and a cloud security assessment.
- According to the company, all 175 engagements successfully gained unauthorised access, with none requiring a zero-day exploit.
- The company attributed the results to recurring weaknesses in authorisation design, suggesting that attackers could bypass inadequate access controls without deploying previously unknown exploits.
- The findings indicate that organisations may face significant security risks from weaknesses in how applications verify user permissions and control access to sensitive resources. The company recommended enforcing backend authorisation checks at every application endpoint, alongside stronger monitoring and more comprehensive security testing.
It also advised organisations to make outbound network traffic logging and the retention of authentication source IP addresses baseline security requirements rather than optional upgrades.
What you should know
Another report by Check Point Research had highlighted the preponderance of cyberattacks on Nigerian businesses, revealing that the country recorded an average of 4,906 cyberattacks per organisation every week in August 2026.
This represented a 45% year-on-year increase and placed Nigeria among the most targeted markets in Africa.
Nigeria’s average was more than twice the global figure of 2,422 weekly attacks per organisation and was second only to Angola among the four African countries covered in the report.