When a South African employee makes an honest cybersecurity mistake, the response inside their organisation is close to a coin flip, with just half of organisations responding with coaching or learning support.
The other half either pairs that support with a formal written warning, or opts for outright disciplinary action in the form of suspensions, demotions or loss of privileges.
These findings are part of a new analysis of the dataset behind KnowBe4’s global From Agentic Risk to Human Wins report, which indicates that South African organisations are replicating a worldwide pattern rather than bucking it.
The same South African dataset earlier revealed the country’s growing exposure to ungoverned AI agents and deepfake-driven scams. Where that research looked outward, at the threats employees face, this cut looks inward, at how organisations treat the employees who make the mistakes those threats exploit.
“An employee who has just sat through a disciplinary process for an honest mistake is an employee who will think twice before flagging the next one,” says Anna Collard, CISO advisor at KnowBe4 Africa. “That hesitation is where the real damage happens, because the phishing click reported within minutes is a minor incident, but the same click, hidden out of fear, can sit undetected for weeks.”
None of the South African organisations surveyed said they would terminate an employee over an inadvertent error, a genuinely encouraging sign. But a formal warning or disciplinary action still carries much of the same chilling effect on future reporting.
“None of our respondents said they would fire someone over a genuine mistake, and that restraint matters,” says Collard. “But half still formalise the consequence with a warning or discipline, and that is still a punishment from the employee’s point of view. If the goal is a workforce that reports problems the moment they happen, the response to a first honest mistake has to look more like coaching than a hearing.”
KnowBe4 argues that organisations serious about reducing human and AI agent risk need to separate the response to error from the response to negligence or malice, treating a first honest mistake as a training signal rather than a disciplinary one.
The “From Agentic Risk to Human Wins: Building a Culture of Security in the Era of Agentic AI” report concludes that achieving “Wins” requires organisations to design systems that guide behaviour, build supportive cultures, and shift from tracking failures to reinforcing positive actions, and extending a security-first mindset across both AI agents and humans.
You can download the South African data insights here and the Global report here.