By Anna Collard, SVP of content strategy and CISO advisor at KnowBe4 Africa
It is the July school holidays, and a 15-year-old is at home on the family laptop – the same one a parent occasionally uses for work. Somewhere else in the house, that parent is fielding a high-stakes Teams call. The teenager, hunting for help with a history project, searches for a “free AI tutor” and installs a browser extension promising instant homework answers. It works beautifully. If that browser profile is shared, and isn’t protected by multi-factor authentication, an extension like this could also harvest session cookies and saved credentials that lead back to a corporate login.
The moment doesn’t feel like a security event. No firewall was breached and no policy was ignored. A curious child simply opened a door, and an attacker could walk through the household to reach the employer. During the South African winter holidays, when children have long, unsupervised hours online and parents work from the kitchen table beside them, that door opens more often.
One roof, one attack surface
The risk extends well past a shared laptop. The modern South African household runs on connected devices: the app that switches the geyser off to save costs, the robot vacuum, the smart TV box streaming the holidays away. Each is a computer on the same network as the work machine, and an attacker who compromises one can probe the others, exploit a vulnerable home router, intercept unencrypted traffic or redirect DNS queries.
The scale of that risk is documented, and prosecuted. The BADBOX 2.0 botnet compromised more than 10 million uncertified Android devices – cheap TV streaming boxes, tablets, digital projectors and picture frames, some arriving with malware pre-installed at the factory – prompting an FBI advisory and a lawsuit by Google against its operators. In January this year, researchers reported a successor, Kimwolf, with more than 2 million infected devices, most of them unofficial TV boxes marketed as a cheap route to unlimited streaming.
Kimwolf is linked to a separate malware family (Aisuru) rather than a direct successor to BADBOX, but the pattern – cheap, uncertified devices compromised at scale – is the same. In a country where precisely those types of boxes sell like sweetcakes, the family bargain-buy can arrive already working for someone else.
For organisations, the concern that follows is credential theft, session hijacking and home-network compromise travelling back into corporate systems on the shoulders of a legitimate employee.
The attacker has upgraded; the setting has softened
Now add AI to the picture. KnowBe4’s latest Phishing Threat Trends Report found that 86% of phishing attacks were AI-driven, alongside a 41% rise in attacks through Microsoft Teams and a 139% surge in reverse-proxy attacks used to steal Microsoft 365 credentials. The clumsy “Dear Sir/Madam” email of a decade ago has long since been replaced by messages that reference your name, your role and your organisation’s recent news – and they arrive across email, chat platforms and calendar invitations at once.
That upgrade lands at the moment defences are weakest: at home, relaxed, distracted, half-listening to the children. Security teams increasingly have to account for risk across the wider digital footprint of their workforce, including the devices, networks and habits of the people employees live with. Every unpatched router, reused household password and dubious browser extension on a shared laptop adds real exposure that will never appear on an IT asset register. Workforce security in other words, just doesn’t stop at the office door like it used to – because the people carrying that risk don’t either.
Security training is digital parenting in disguise
The knee-jerk corporate response some might consider – extend monitoring and control into employees’ homes – would be invasive, unworkable and corrosive of trust. The workable response starts from a different premise: make the stakes personal.
Most security awareness training falls short because employees experience it as something done to them, a mandatory click-through module that protects the employer. Reframe it and the motivation changes entirely. The instincts that catch a phishing email are the same instincts that protect a child from a grooming scam, a parent from romance fraud and a family’s savings from being drained – the manipulation techniques are identical whether the target is a corporate login or a teenager’s gaming account. An employee who understands why a “free” mod from an unverified source is dangerous will have a far richer conversation with their child than a vague instruction to be safe online. Call it digital parenting: security awareness as a life skill that happens to protect the employer as a by-product.
Practical resources make that reframing concrete. The CAPY (Cyber Awareness Program for You) hub gives people guidance they can take home by choice – protecting children online, securing family devices, spotting scams aimed at older relatives – treating the employee as a capable adult and the household as an ally in the organisation’s defence. Raise the digital literacy of the whole household and the ecosystem around the organisation strengthens with it, no surveillance required.
This holiday, the connected home will keep the geyser warm, the children entertained and the household running. Whether it also keeps the office safe depends on conversations that happen around the kitchen table, long before anything reaches the security team’s dashboard.
