By Reza Joseph, Group Product Manager: Cybersecurity, Cloud, Unified Comms at Itec SA.
For 47% of South African organisations hit by ransomware in 2025, the attack succeeded because of inadequate protection. For 43%, a lack of cybersecurity capacity was a contributing factor.
These findings from Sophos’ State of Ransomware in South Africa 2026 point to a problem that goes beyond whether an organisation has bought the right security technology. Ransomware is evolving, the attack surface is expanding, and organisations need the people, processes, and expertise to keep pace.
Putting the threat into perspective, a South Africa‑focused threat landscape analysis from Check Point (Jan-Sep 2025), notes that South African organisations faced 2,116 attack attempts per week on average, compared with 1,963 globally.
The sheer scale of these attacks supports the viewpoint that the traditional perspective on ransomware is now myopic. An attacker breaking into a network, encrypting files, and demanding payment is now only one part of the picture. They are increasingly looking for valuable data and persistent access that can be exploited for extortion, sold to other criminals, or used to support further attacks.
The recent breach of the FBI provides a striking example of how this threat has changed. A cybercriminal group claimed to have stolen sensitive information relating to thousands of FBI personnel – potentially endangering undercover agents’ lives. The FBI says the incident resulted from a security failure on a platform managed by a third party, after a contractor failed to implement an available security patch.
If an organisation as security conscious as the FBI can be exposed through a weakness in a system managed by a third party, it is a reminder that cybersecurity cannot be viewed solely through the lens of an organisation’s own perimeter.
Moving outside of an organisation’s own network, suppliers, technology partners, and cloud platforms can all become part of the attack path. Part of the greater risk here is that, when a breach occurs through a third party, the organisation that owns the data still carries the financial, operational, and reputational consequences.
Smaller businesses should pay particular attention. Being smaller does not necessarily make an organisation less attractive to attackers, particularly if it provides services to a larger enterprise or interfaces with valuable systems or information.
Compromised identities are an increasingly effective route in. With valid credentials, an attacker can bypass the perimeter, move through the environment, identify valuable information and critical systems, and wait for the right opportunity to act. It can be months before anyone realises they are there.
Security therefore has to look beyond whether a user is successfully authenticated and consider whether their behaviour makes sense. Organisations need the visibility to recognise unusual activity and the capability to respond quickly.
AI-enabled social engineering is also becoming more sophisticated, while internal use of AI poses new questions about what employees are putting into public platforms and where sensitive information could end up. AI governance therefore needs to become part of cybersecurity planning.
But none of these risks is new. Today’s challenge is who has the expertise to manage all of it?
Cybersecurity now spans identity, networks, endpoints, applications, data, legislative compliance, and threat detection. Maintaining deep specialist capability across these areas is difficult when skilled people are already in short supply, and buying multiple security products does not solve the problem if nobody understands how they work together.
A specialist cybersecurity partner can help by looking across the environment rather than at individual technologies, bringing different security capabilities together and providing the responsiveness needed when a threat emerges.
Cybersecurity Month is a useful prompt to consider how the threat has changed, but security cannot be an annual exercise. It is an ongoing business capability, and the greatest risk comes when last year’s security strategy is expected to deter this year’s threats.
For more articles like this click here.
If you enjoyed this website then check out our other sites: Wedding and Function, Home Food and Travel, Kids Connection, Thirsty Traveler, Bargain Buys, Boat Trips for Africa.
Need help with your online marketing then visit Agency One