Cyber disruption has become a recurring operational reality for businesses, with implications extending well beyond IT departments.
By Boland Lithebe, cybersecurity lead for Accenture, South Africa
For South African organisations navigating increasingly connected technology environments, the ability to maintain essential services and recover quickly from an incident is an important consideration for business continuity, financial performance and customer trust.
The challenge is growing. According to Accenture’s data, 87% of organisations see cyber disruption as a recurring operating reality, while 72% believe preventing all disruption is no longer realistic given the complexity of modern technology ecosystems. These findings point to a shift in how businesses need to approach cybersecurity. Protection remains essential, but organisations must also be prepared to operate when their systems are compromised or unavailable.
Artificial intelligence (AI) is adding urgency to this challenge. The data shows an 89% year-on-year increase in AI-enabled cyberattacks in 2025. It also indicates that frontier AI models achieved an 83% success rate on their first attempt at finding and exploiting vulnerabilities, compared with rates that were previously close to zero. The time between discovering a vulnerability and exploiting it has narrowed considerably, in some cases from weeks to hours. This leaves organisations with less time to identify threats, make decisions and limit potential damage.
The implications are particularly relevant when critical processes depend on interconnected digital services. Cloud platforms, AI applications, business software and external technology partners can improve efficiency and enable growth, but they also create dependencies that may complicate recovery. The data shows that 69% of organisations believe their operations increasingly depend on complex internal and third-party digital ecosystems, while 61% say external dependencies influence their ability to sustain critical business operations.
A disruption affecting one provider or system can therefore have consequences across several business functions. An organisation may have effective security controls in place yet still struggle to process transactions, serve customers or restore essential operations if a critical dependency becomes unavailable. About 81% of leaders expect to operate under degraded system conditions during cyber disruption. Business continuity planning needs to reflect that possibility, rather than assume systems will remain fully available.
One of the most important barriers to resilience is the gap between executive expectations and operational realities. More than half of executives believe strong protection controls are sufficient to ensure business continuity after an attack. Meanwhile, 81% assume critical IT downtime in a serious incident will last 10 days or less, despite the research indicating that recovery averages three to six months.
Such a mismatch can leave businesses underprepared for the financial and operational consequences of a serious incident. Recovery may require restoring data, rebuilding compromised environments, validating systems and confirming that operations can resume safely. These activities take time, and the process becomes more complicated when several systems and external providers are involved.
Leadership alignment is equally important. Our data reveals differences between chief executive officers (CEOs) and chief information security officers (CISOs) in their understanding of cyber resilience, including the role of regulatory compliance. CEOs are reported to be 136% more likely than CISOs to believe regulatory compliance ensures cyber resilience. Compliance remains important, but meeting regulatory requirements does not, by itself, establish whether a business can sustain critical operations or recover effectively after an attack.
Cyber resilience is the ability to maintain or rapidly restore essential operations during disruption while protecting business value. It complements preventative security by addressing what happens when controls fail. This distinction has practical consequences for governance, investment decisions and accountability. If responsibility is fragmented across security, technology, risk management and business leadership, decisions can be delayed precisely when a coordinated response is most needed.
There are six assumptions organisations should challenge: that compliance means they are protected; that protection guarantees recovery; that third parties are solely responsible for their own security; that an incident response plan automatically establishes resilience; that cyber insurance will cover the full impact; and that resilience is exclusively the security team’s responsibility. Each overlooks an aspect of the broader business response, from supplier dependencies and recovery capability to financial exposure and executive accountability.
A practical starting point for South African business leaders is to identify the smallest set of critical operations that must remain available, or be restored first, for the organisation to continue functioning. This requires mapping essential business processes and their dependencies across the value chain, then agreeing on recovery priorities, decision-making authority and acceptable trade-offs before an incident occurs.
Organisations should also establish recovery environments that can be trusted even when normal systems are compromised. This includes maintaining the information and technical resources needed to rebuild systems safely, automating recovery activities where appropriate, and testing plans against realistic scenarios. Regular reassessment is necessary as business operations, technology platforms and third-party relationships change.
These measures should be treated as business priorities rather than isolated technical projects. Boards and executive teams need a shared understanding of the operations that matter most, the disruption the organisation can tolerate and the resources required to recover. Investment can then be directed towards the systems, processes and capabilities that protect business value, while clearer accountability can reduce duplicated effort and improve decision-making.
For local organisations, strengthening cyber resilience means preparing for disruption as part of responsible business management. Prevention remains a fundamental line of defence, but the ability to sustain essential services, recover in a controlled manner and restore trust is just as important. Organisations that build these capabilities into their operating models will be better positioned to manage disruption without allowing an incident to become a prolonged business crisis.