Exclusive: Acronis Warns of Rising Identity Threats

By June Ramli

Perth, Oct 22: Cybercriminals are increasingly gaining access to business networks by using stolen credentials rather than relying solely on traditional hacking methods, according to global cybersecurity company Acronis.
In an exclusive online interview with DailyStraits.com, Acronis Senior Solutions Engineer Irzal Ramadlani said phishing, compromised passwords and stolen browser session cookies remained significant threats to Australian businesses.
“Attackers increasingly don’t break in. They log in,” said Ramadlani, who is based in Jakarta.
He explained that criminals were increasingly targeting corporate identity systems, including Microsoft Entra ID and Active Directory, to gain access to internal business environments.
Stolen browser cookies pose a particular danger because they can allow attackers to access accounts without entering passwords and, in some circumstances, bypass multi-factor authentication.
The growing emphasis on identity-based attacks is driving cybersecurity providers to expand protection beyond individual computers and servers to include user accounts, authentication systems and access privileges.

Stolen Credentials Exposed on Dark Web

Ramadlani said Acronis was expanding its managed detection and response (MDR) services to help businesses identify compromised information circulating on criminal networks.
The company offers on-demand dark web scanning through its managed service providers, allowing organisations to identify exposed credentials using a business domain and email address without installing additional software.
The resulting reports can reveal computers associated with infostealer malware infections, work email addresses found in criminal password lists, accounts linked to known data breaches and exposed email addresses.
Ramadlani cited an anonymised customer report that identified 29 infostealer infections associated with a single computer over one year.
The investigation also uncovered more than 500 compromised passwords, over 15,000 stolen browser cookies and 27 mailboxes appearing in criminal password lists.
He said identifying compromised information was only the beginning of the response.
Depending on the circumstances and service arrangements, Acronis security analysts can recommend or undertake remedial measures, including isolating infected devices, scanning affected computers, changing compromised passwords and terminating active browser sessions.
Businesses should also review login records, enforce password resets and ensure multi-factor authentication is enabled.

Cybersecurity Protection for Small Businesses

For smaller Australian businesses unable to maintain their own cybersecurity teams, Ramadlani said managed security services could provide continuous monitoring without the expense of establishing an internal security operations centre.
Acronis delivers its MDR services through managed service providers (MSPs), which oversee technology and cybersecurity systems on behalf of business customers.
The company has introduced an option allowing its analysts to communicate directly with nominated customer contacts when cybersecurity incidents occur.
Previously, security alerts would typically pass from Acronis to the MSP before reaching the affected business.
Under the updated arrangement, Acronis analysts can send incident notifications and reports directly to designated customer representatives, reducing delays when threats emerge outside normal working hours.
Ramadlani said the feature was included in Acronis’ advanced MDR package, although overall pricing varied by region.
The arrangement allows smaller MSPs to offer round-the-clock protection without requiring their own employees to monitor alerts overnight.

AI Analyses Threats, Humans Make Decisions

Artificial intelligence is also becoming increasingly important in cybersecurity operations, particularly as businesses generate large volumes of security data.
However, Ramadlani stressed that human analysts remain responsible for deciding how to respond to potential threats.
“The AI handles the volumes, and the people make the call,” he said.
He explained that business networks can generate hundreds of thousands of security events each month, making it impractical for analysts to examine every notification individually.
Acronis uses AI-assisted technology to organise alerts, enrich them with threat intelligence and prioritise incidents requiring further investigation.
Human analysts then assess the findings and determine whether intervention is necessary.
Ramadlani said the approach enabled security teams to concentrate on genuine incidents rather than spending time reviewing routine notifications.
He emphasised that artificial intelligence supports cybersecurity professionals rather than replacing their judgement.

New Identity Protection Service Planned for 2027

Acronis is preparing to introduce a managed Identity Threat Detection and Response (ITDR) service as part of its expanding cybersecurity portfolio.
Early access for selected partners is planned for the final quarter of 2026, with general availability targeted for the first quarter of 2027.
Unlike traditional endpoint protection, which concentrates on individual computers and servers, ITDR is designed to continuously monitor identity-related threats.
These include compromised credentials, suspicious authentication activity and misuse of access privileges across corporate identity systems such as Active Directory and Microsoft Entra ID.
Ramadlani said Acronis’ existing MDR capabilities could already support identity-related actions during security incidents when the necessary integrations were enabled.
These measures include suspending compromised accounts, resetting passwords and terminating active sessions.
The planned ITDR service would extend those capabilities by allowing security analysts to monitor identity-based threats continuously, rather than responding only when suspicious activity was detected on an endpoint.
Ramadlani said he would seek further information about the number of partners participating in the early-access programme, including those based in Australia.

Healthcare Sector Requires Continuous Protection

Healthcare organisations face particular cybersecurity challenges because their networks contain sensitive information and support services that may operate around the clock.
Ramadlani highlighted Australian managed service provider IT&T, whose customers include medical practices and not-for-profit organisations.
He said IT&T adopted Acronis MDR in April 2025 to strengthen its cybersecurity capabilities without establishing its own 24-hour security operations centre.
The arrangement enables Acronis analysts to investigate threats and, where authorised, take action on designated critical systems.
Ramadlani used the hypothetical example of a hospital appointment server experiencing a cybersecurity incident at 3am to illustrate the importance of continuous monitoring.
Under an agreed response arrangement, Acronis analysts could intervene on behalf of the managed service provider rather than waiting until the following business day.
He said such services allowed smaller technology providers to deliver continuous security coverage while focusing their own resources on customer relationships and support.

Businesses Urged to Strengthen Security Ahead of 2027

Looking ahead to 2027, Ramadlani said the cybersecurity landscape would remain difficult to predict as attackers adopted increasingly sophisticated techniques.
Rather than forecasting specific incidents, he urged organisations to maintain comprehensive security measures covering multiple potential points of attack.
These include endpoint protection, email security, patch management, data backup, identity protection and continuous threat monitoring.
He also pointed to research published by the Acronis Threat Research Unit, which examines emerging cybersecurity trends and provides guidance on evolving threats.
Acronis representatives said a further security benchmark report was expected in early November.
For Australian businesses, Ramadlani’s message was that protecting individual devices was no longer sufficient on its own.
As attackers increasingly exploit legitimate credentials and authenticated sessions, businesses must also strengthen the systems that control who can access their networks and sensitive information.