An organisation can train every employee to recognise a suspicious email and still expose sensitive information through an AI agent with excessive permissions. As businesses connect AI to their data and operations, cybersecurity awareness needs to reach the people deciding what those systems can access and do.
This October’s Cybersecurity Awareness Month offers South African organisations an opportunity to examine that gap. The National Cybersecurity Alliance’s 2026 theme, “Don’t Make It Easy for Them”, encourages consistent security habits, including strong passwords, password managers, multifactor authentication, recognising and reporting scams, and software updates. Those habits remain essential. Businesses must also examine whether their technology decisions are creating opportunities for attackers.
For BDO South Africa’s cybersecurity specialists, the concern is the distance between the pace of AI adoption and organisations’ ability to govern the risks it introduces.
“The divide is not really about access to technology. Most organisations can access the same tools. The real difference lies in their ability to govern them,” says Brett Marais, cybersecurity technology solutions and services lead at BDO South Africa.
AI can help organisations improve productivity, analyse information and develop services. It can also amplify weaknesses in data protection, identity management and incident response. A model connected to confidential information, an autonomous agent authorised to act across applications, or an AI feature introduced by a supplier can change an organisation’s exposure before its next formal security review.
Marais argues that security needs to be embedded in adoption from the outset. Leaders need to establish what information each system can access, which decisions it can influence, how its outputs are validated and who can intervene when it behaves unexpectedly.
These questions require business ownership. An AI system used in finance or customer service needs an accountable owner who understands the consequences of its actions, alongside the teams responsible for its technology, data and controls. “Unmanaged AI does not simply introduce another category of risk; it can multiply existing risks,” says Gilchrist Mushwana, Head of Cybersecurity at BDO South Africa.
For Mushwana, AI’s growing influence on business models and operations makes board oversight essential. Directors need enough understanding to question management about value, exposure and the evidence supporting decisions to deploy or expand a system.
“The board’s role is not to put the brakes on AI. It is to create the conditions that give the organisation the confidence to accelerate its AI journey responsibly,” he says.
That requires proportionate governance. Lower-risk applications should be able to progress efficiently, while uses with significant consequences for customers, employees or critical operations need stronger scrutiny and clear escalation routes.
AI also changes the time available to respond. Attackers can use it to support reconnaissance and tailor social engineering, while defenders can use it to enrich alerts, accelerate investigations and prioritise exposure. Slow hand-offs become more consequential when both sides can act faster.
“Cyber teams need to participate in business decisions from the outset, understand where exposure is changing and act quickly enough to support growth,” says Shannon Du-Pont, director at BDO Digital.
Involving security only immediately before launch leaves teams trying to resolve risks after decisions about suppliers, data and access have already been made. Earlier involvement gives the business more scope to address weaknesses without expensive redesign or disruption.
The number of alerts reviewed, patches applied or training sessions completed can help track cyber activity. These figures alone do not establish whether an organisation can withstand disruption.
“Boards should demand proof, not promises,” says Mushwana.
Useful assurance connects security controls to business outcomes. Leaders should know which essential services are exposed, where excessive access persists, whether important suppliers create dependencies and what testing reveals about recovery capability.
Scenario exercises can make those questions concrete. If an AI agent is manipulated, can its access be withdrawn quickly? If trusted data is corrupted, who decides whether the system should continue operating? If a critical supplier fails, how will the business maintain services and communicate with customers?
Du-Pont’s emphasis is on practising those decisions before a crisis, so that containment, recovery and communication work together under pressure.
Marais proposes a focused 90-day plan: identify the AI use cases and machine identities that matter most, assign clear ownership, review access to sensitive information and test a realistic failure scenario. Management should then agree on a small number of measures showing whether exposure is reducing and response capability is improving.
For South African businesses pursuing AI’s benefits, the practical test is whether they can explain how a system is controlled and demonstrate what happens when those controls are challenged.
“Cybersecurity has become a business capability for confident growth,” says Du-Pont. “Its operating model must keep pace with the organisation it protects.”