A figure of 2 113 cyber security threats a week sounds daunting enough but, according to experts, this may only be a fraction of the total number impacting South African companies.
In a July 2025 report, Check Point Software Technologies revealed the 2 000-plus figure yet it is likely only the tip of the iceberg.
Mukelani Dimba, executive for education and communication at the Information Regulator, was recently quoted as saying there is a discrepancy between research into the number of security threats and what is reported.
He bases his view on the fact that only 2 374 incidents were reported to the regulator for the entire 2024/25 financial year. Clearly this is at odds with the Check Point findings.
According to Muhammad Ali, MD of South African ISO specialist World Wide Industrial & Systems Engineers (WWISE), South African businesses are still dangerously underprepared for cyber threats, with most organisations failing to address fundamental vulnerabilities – particularly among third-party vendors.
Ali cautions that cybercriminals are increasingly targeting smaller suppliers as entry points to larger corporate networks.
“Most vulnerabilities arise from delays in applying critical security patches. Many companies fail to test and release patches timeously, leaving their systems exposed. Spear phishing remains the biggest threat, especially when it’s socially engineered and highly realistic.”
Among the biggest cyber attacks to occur in South Africa in recent years were the data breach of a mobile network operator, where some 2Tb of sensitive data were exfiltrated by hackers, and the data breach of one of the country’s biggest property groups where sensitive client information was exposed.
Reflecting on these incidents, Ali says too many organisations still lack adequate disaster recovery and backup integrity.
“Your backup integrity and disaster recovery site are vital. Simulation tests and lessons learnt from them are the only way to ensure you can manage an incident effectively. It’s not if you’ll get attacked – it’s when.”
He emphasises that cyber resilience must be treated as a strategic investment, not a compliance expense.
Business leaders need to be educated in simple, relatable language with live demonstrations and simulations, so they understand the financial, reputational and operational impact of a breach.
Ali says human behaviour remains the biggest factor in data breaches. “Training must be relevant, engaging, and gamified. Short, dynamic awareness campaigns, like brief videos or interactive simulations, are effective in helping employees grasp complex security concepts. These programmes should extend beyond the workplace into personal online safety.
“As new technologies like AI and the Internet of Things (IoT) expand the threat landscape, he stresses the importance of structured governance. Businesses must implement international standards such as ISO/IEC 27001 for information security and ISO/IEC 42001 for AI management,” he says.
These frameworks ensure organisations are governed risk-aware and continuously improving their security posture.
Ali notes that many South African companies still show weak compliance with standards such as ISO 27001, largely due to misconceptions about cost and complexity. However, the right consultant can simplify implementation and ease the administrative burden.
“Work with auditors registered with credible bodies like the South African Auditor & Training Certification Authority or the Chartered Quality Institute | IRCA to avoid unqualified, short-term consultants. Think of cybersecurity compliance as an investment like insurance to safeguard your assets.”
Ali recommends that business leaders start with awareness and capacity-building sessions tailored for executives and boards. They should then take a process-based approach to implementation with the right industry expertise.
Ultimately, a “don’t trust anyone” approach is the way to go, he says. “Regularly scan backups for malware, verify integrity checks, and conduct disaster recovery tests. ISO 27001 certification builds customer confidence, reduces cyber insurance costs and has become the flagship assurance standard for corporates.”