Phishing has stopped looking careless. Generative AI can produce polished language, local context, credible invoices and executive-style requests in seconds. Voice cloning and synthetic media add another layer of persuasion. The result is not simply more malicious email; it is more convincing social engineering delivered at industrial scale.
The trend matters acutely to South African managed service providers (MSPs) and IT resellers. Email remains the workflow through which clients approve payments, exchange personal information and access cloud services. When attackers compromise that trust layer, they do not need to defeat every security control. They only need one believable message and one rushed user.
The threat has shifted towards people and trusted channels
The Acronis Cyberthreats Report H2 2025 found that email attacks increased 36% compared with the first half of 2025, while phishing accounted for 83% of email threats. In the first half of that year, phishing had already risen to 52% of initial attacks on MSPs, up from 30% a year earlier.
INTERPOL’s 2026 assessment adds a regional warning: AI was linked to more than half of reported cybercrime across Africa, while Southern Africa’s high connectivity makes the region attractive to global threat actors. The implication is clear. Generic spam filtering and annual awareness training are no longer a sufficient service design.
Why this becomes an MSP problem
A compromised mailbox can lead to fraudulent payments, credential theft, malicious OAuth consent, lateral movement, data exfiltration or ransomware. The client experiences one incident, but the MSP may have to investigate identities, endpoints, email trails, backups and business impact across several disconnected tools.
This fragmentation is costly. It slows containment, makes responsibility unclear and creates gaps between prevention and recovery. It also makes it difficult to prove what happened when management, auditors or the Information Officer asks for a timeline.
A sellable service must be layered
Soteria Cloud helps partners build one coherent cyber-resilience service around Acronis Cyber Protect Cloud. The service can bring together:
- Advanced Email Security to inspect inbound messages and block phishing, impersonation, malicious links and advanced threats before they reach the user.
- Security Awareness Training to turn the workforce into an active control through continuous learning and simulated attacks, rather than a once-a-year exercise.
- EDR, XDR and MDR to detect behaviour beyond the inbox, connect signals across the environment and provide response capability when a credential or device is compromised.
- Microsoft 365 backup to retain an independent, recoverable copy of Exchange Online, OneDrive, SharePoint and Teams data.
- DLP and GenAI protection to reduce the risk of sensitive information leaving through uncontrolled channels or public AI tools.
One agent and one management console reduce operational friction. More importantly, the controls work as a system: prevention lowers exposure, detection shortens dwell time and backup provides a clean recovery path.
Package outcomes, not licences
Clients rarely want to buy five product names. They want confidence that fraudulent mail is less likely to succeed, that a compromised account will be contained and that essential data can be restored.
An MSP can therefore package the offer as an Email and Identity Resilience service with three clear outcomes: reduce successful social engineering, detect compromise quickly and recover business data predictably. Monthly reporting can show blocked attacks, user-risk trends, protected workloads, incident response activity and recovery readiness. That makes the service visible and renewably valuable.
The South African advantage
Soteria Cloud gives local MSPs an aggregation layer designed for the South African operating environment: Rand-based commercial models, local support and Acronis cloud infrastructure hosted in South African data centres. Partners retain ownership of their customer relationship while choosing fully managed, co-managed or self-managed service models.
AI has made phishing easier for criminals to scale. It can also help MSPs scale defence—if email, endpoint, identity and recovery are treated as one service rather than separate boxes.
Ready to turn email risk into a recurring cyber-resilience service? Explore the Soteria Cloud MSP and reseller programme or speak to our partner team.
