The Stages of a Cyberattack:
From First Entry to Backup and Recovery
Understanding the stages of a cyberattack is essential for businesses looking to protect their systems, data and operations. A cyberattack isn’t a single moment. It’s rarely just, “An employee clicked a bad link.” That click is often only the beginning.
By the time most businesses realise that something is wrong, an attacker may have already been inside their systems for days, quietly mapping out what’s valuable, where it’s stored, and how to reach it, and in a growing number of cases, the real damage doesn’t happen when the attacker gets in; it happens when they reach the systems designed to bring the business back afterwards.
Understanding the stages of a cyberattack, from initial entry to backup compromise, changes the question most businesses ask. It’s no longer just, “How do we stop attackers from getting in?” It’s also, “If they do get in, can we still recover?”
Stage 1: Initial Entry – Where a Cyberattack Begins
Every breach starts somewhere, and it’s rarely a dramatic, high-tech break-in. More often, it’s something ordinary:
- A phishing email that looks like it’s from a supplier or a colleague
- A reused or stolen password
- An exposed remote access point: an unpatched VPN, an open RDP connection, outdated software with a known vulnerability
None of these require a sophisticated hacker. They require an unpatched system, a tired employee, or a weak login that nobody’s reviewed in years. The first line of defence isn’t always the firewall; it’s often a person, a credential, or a forgotten piece of infrastructure sitting quietly on the network.
Regular IT assessments can help businesses identify these vulnerabilities before they become entry points. Dotcloud’s IT Health Checklist provides a practical starting point for reviewing potential security gaps.
Stage 2: The Quiet Phase of a Cyberattack
One of the most overlooked stages of a cyberattack is the quiet phase, when attackers may explore systems without immediately disrupting business operations. Here’s what most people get wrong about cyberattacks: the damage doesn’t usually start the second an attacker gets in.
Instead, there’s a quiet phase. The attacker explores. They identify administrators, locate shared drives and databases, check which security tools are running, and work out how the environment is structured. They may move from one system to another using legitimate admin tools, so nothing looks obviously wrong on the surface.
This is often the most dangerous part of a breach precisely because it’s invisible. A business can be operating normally: invoices going out, systems running, all while an attacker is already mapping a path to its most valuable data.
Stage 3: When Attackers Target Critical Business Data
Once an attacker understands the environment, their objective usually changes. It’s rarely about one laptop or one inbox anymore. They’re now looking for leverage: the data and systems a business genuinely cannot afford to lose, such as customer records, financial systems, intellectual property, and operational databases.
This is the point where an attack stops being a nuisance and starts becoming an existential threat to the business.
Stage 4: When the Breach Reaches Your Backups
Of all the stages of a cyberattack, the point at which attackers target backup systems is one that businesses often underestimate.
If a company can restore its systems quickly, ransomware loses much of its leverage, and there’s simply nothing to hold hostage. Attackers know this. So increasingly, they go after the backups themselves: deleting them, encrypting them, disabling backup services, or compromising the credentials that protect them.
This is where an important distinction matters: a backup is not the same as recovery. A reliable backup and disaster recovery strategy needs to consider not only where data is stored, but also how quickly critical systems can be restored following an incident.
A backup is a copy of your data. Recovery is the actual ability to restore usable systems and get the business operating again within a timeframe it can survive. A business can have backups and still face weeks of downtime if those backups are slow to restore, untested, or sitting in the same compromised environment as everything else.
Ask honestly:
- Is your backup environment separate from production?
- Could an attacker reach or delete it?
- How long would it genuinely take to restore your systems in practice, not just in theory?
What Does a Cyberattack Cost South African Businesses?
According to IBM’s 2025 Cost of a Data Breach Report, the average cost of a data breach for South African organisations reached R44.1 million in 2025, highlighting the financial impact of detection, containment, business disruption and recovery.
Downtime compounds that cost daily. Employees can’t work, customers can’t be served, transactions stall, and the operational disruption often outlasts the technical fix by weeks or months.
Building Backup and Disaster Recovery Into Your Cybersecurity Strategy
A resilient response isn’t just about stopping attackers; it’s about ensuring one incident can’t shut a business down. That means:
- Regular, automated backups
- Offsite copies, separate from your primary environment
- Replication that allows systems to be restored quickly, not just data
- Backup infrastructure that isn’t vulnerable to the same access an attacker used to get in
- Recovery plans that have actually been tested, not just assumed to work
The goal isn’t preventing every possible attack because that’s not realistic for any business. The goal is making sure that when something does happen, it’s a manageable incident rather than a prolonged shutdown.
Is Your Business Ready to Recover From a Cyberattack?
Dotcloud helps South African businesses build resilient backup and disaster recovery environments designed to minimise downtime and speed up recovery, from automated backups and offsite storage to replication and rapid restoration. Because the real question isn’t whether an attacker can get in. It’s whether your business can still get back up.
Talk to Dotcloud about Backup & Disaster Recovery: https://dotcloud.co.za/baas-disaster-recovery