SECURING THE FUTURE: Blueprint for solving South Africa's cybersecurity crisis in the age of AI

Occasional Paper 3/2026

Read as PDF

Copyright © 2026

Inclusive Society Institute

PO Box 12609, Mill Street

Cape Town, 8010

South Africa

                                                                    235-515 NPO               

All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means without the permission in writing from the Inclusive Society Institute.

D I S C L A I M E R

Views expressed in this report do not necessarily represent the views of the Inclusive Society Institute or those of their respective Board or Council members.

MARCH 2026

by Lars Gumede

BCom (Actuarial Science)

ABSTRACT

The major powers globally have made cybersecurity a top priority. They see that every aspect of our lives depends on an expanding complex network of cyber systems that are vulnerable to exploitation. That cyberspace is a domain of power and opportunity, but with that comes threat from malicious actors. South Africa is not adequately prepared for this reality. In fact, the country has the third-highest incidence of cyberattacks in the world. Citizens are being scammed, defrauded, robbed and tricked by sophisticated cybercriminal gangs. Businesses are being extorted and held to ransom. The country’s defence organisations and government themselves regularly fall victim to cyberattacks. And the rise of artificial intelligence (AI) is just making it easier for even amateur cyber actors to access dangerous cyber tools.

The crisis of cybersecurity in South Africa requires a national project involving all sectors of society: the government, private sector, civil society and citizens. Following the lead of countries around the world that are winning the cybersecurity war, there are three main priorities. First, is putting in place a dedicated cybersecurity organisation; one that is totally free from political appointments and interference and led by the top cyber experts in the country. The second priority is developing a national cybersecurity awareness campaign to strengthen the weakest link in South Africa’s cyber defence: the human element. And third, a national programme of cultivating the next generation of cyber talent is required. Without proper cybersecurity, no nation can be secure. A single cyberattack could descend the country into total anarchy in less than a week. This thought alone should be driving us to act now, together as a nation.

INTRODUCTION

Cybersecurity is the most important aspect of national security in today’s world. Every facet of our lives depends on cyber systems, and these systems are vulnerable to malicious cyber threat actors.

Amateur hackers, cybercriminal gangs and nation-state cyber actors are all engaged in illegal activities targeting South Africa and its people. Malicious software, including spyware, is being deployed against government organisations. Ransomware is being used to extort and hold businesses to ransom. Deepfakes are being deployed against unsuspecting citizens for the purposes of scams, frauds and outright thefts.

Worse, the development of artificial intelligence (AI) is transforming this threat landscape into an even bigger one. Due to new AI developments, it has never been easier for cyber actors to get their hands on dangerous cyber tools. This means small-time cyber actors now have access to sophisticated tools once reserved for large organisations and nation-state cyber actors. Furthermore, already sophisticated cyber actors are made even more capable and dangerous.

South Africa is currently the wild west of cyber activity, with among the highest incidences of cyberattacks in the world. Government organisations are routinely infiltrated in cyberspace by hacker groups, nation-state actors and even amateur hackers. Private businesses are consistently victims of ransomware and extortion, being forced to pay large amounts to regain control of their systems. Private citizens are frequent victims of deepfakes and associated cybercrimes intended to rob, scam or extort them.

The fact that the rest of the continent is even more lawless when it comes to cyberspace is a further strategic issue for South Africa, as countries all over the continent house cybercriminal groups actively targeting the country.

As will be seen, there are also plenty of cybersecurity success stories from countries around the world. For the world’s major powers, cyber is a top priority and their primary initiatives are threefold. First, they have dedicated cybersecurity and cyber intelligence organisations that employ their nation’s top cyber experts and coordinate cybersecurity, cyber intelligence, and incident response as well as law enforcement actions with regard to cyber threats and crimes. Second, they have national cybersecurity awareness campaigns, recognising that the weakest link is always the human element. These programmes train citizens in good cyber practises and on how to recognise cyber threats, schemes and scams. Finally, these top nations put great effort into creating and fostering the next generation of cyber talent by giving support to promising young individuals on a large scale.

Cybersecurity is the bedrock of every modern nation; without it no nation can be secure. This is a matter of top priority and requires the urgent attention of the entire country: the government, private sector, civil society and citizenry.

WHAT IS CYBERSECURITY AND WHY IS IT IMPORTANT?

Cybersecurity is about the protection of data, networks, devices, systems and processes from unauthorised access and interference by known and unknown actors (CISA, 2025). In today’s world, cyber systems are integrated into every facet of our lives, from the devices we carry around like extra limbs, to municipal systems like traffic lights, water infrastructure and electricity grids. These are systems we rely on for the proper functioning of society, and they are all at constant risk of attack, with potentially devastating consequences.

Cyberattacks come in many forms. There is malicious software (Malware), which is software designed to take advantage of a system, and forms a part of most modern cyberattacks. There is social engineering (Phishing), also known as human hacking, which aims to trick an individual into granting the attacker access to a system. Phishing attacks often use seemingly normal emails, text messages, phone calls and other methods to trick an individual into taking actions such as sharing personal information and passwords, downloading malware or sending money. Spoofing is an attacker pretending to be someone you know by replicating their email or phone number. There are Denial-of-Service (DoS) attacks, which seek to overwhelm and flood a system with large amounts of junk traffic in order to crash the system and render it unusable to the legitimate persons using the system.

Ransomware is utilised to lock legitimate users out of their systems, demanding payment to unlock them. There are also Zero-Day exploits, which are advanced and novel holes attackers find in a system that allows them access — these are very difficult to detect and rely on the fact that no system is perfect. Another type is Password attacks, in which an attacker attempts to guess the victims passwords or login details. These are just some of the types of cyberattacks and risks faced by governments, companies and individuals (IBM, 2025). According to the Global Cybersecurity Outlook 2025 report by the World Economic Forum (WEF), these attacks represent the vast majority of cyber threats to governments, businesses and individuals (WEF, 2025).

Figure 1: Most Common Types of Cyberattacks.

(Source: Generated by author.)

These cyberattacks can come from various sources. Cybercriminal gangs utilise the above techniques in order to extort and rob ordinary citizens. Hackers, whether amateurs (‘script kiddies’) or persons with expert-level experience and skills, are constantly aiming to exploit common systems like mobile devices, computers, corporate and government systems. There are also nation-state actors, which are groups of hackers with the backing of countries, giving them the resources to pull off sophisticated cyber operations. Often these nation-state actors buy technologies from companies engaged in the development of spyware and other cyber or surveillance technologies (IBM, 2025).

With all our lives and the smooth functioning of society dependant on cyber systems, this is a matter of the utmost importance. At the click of a button an entire country’s electricity grid can be shut off or its water systems interfered with. In 2015, a Russian hacker group known as ‘Sandworm’ remotely shut down the Ukrainian power grid for six hours, leaving 230,000 residents without electricity (CFR, 2015). In 2010, an Iranian nuclear facility in Natanz was disrupted by the Stuxnet virus, a piece of malicious software developed by American and Israeli intelligence (Baezner & Robin, 2017). In 2024, Israel carried out an operation in which the pagers of thousands of Hezbollah operatives were simultaneously and remotely detonated (Trenta, 2024). In 2014, Chinese state-sponsored hackers exfiltrated blueprints of the Lockheed Martin F35 stealth fighter jet, using the information to support their own fighter jet programme (AFOSI, 2020). In 2018, Saudi journalist Jamal Khashoggi was tracked to his brutal murder by Saudi operatives using advanced spyware built by Israeli company, NSO group (The Guardian, 2021). It is clear that there is an ongoing global cyber war of all against all.

The systems we rely on can be infiltrated to such an extent that attackers have more control over our devices than we do — giving them access to everything: our bank details, our personal data and communications, as well as the ability to surveil and sabotage.

Now, despite the fact that these acts are often highly sophisticated, they can be prevented. Most advanced cybersecurity systems are near secure enough for their purposes; the issue is the human aspect. Cybersecurity has a PICNIC problem: Problem In Chair, Not In Computer. Most cyber incidents rely on an unsuspecting individual to click on a link or compromise themselves in some way. Being the weakest link, it is essential to address the human aspect. This involves creating awareness about the realities of cybersecurity and exploitation in order not to gently open the door for the attackers.

This human component is the most important component in cybersecurity as attackers seek to trick legitimate users into giving them access — this makes the attacks even harder to detect and trace. Unfortunately, there is an entirely new aspect to cyber threats in 2025. Cyber actors are now utilising artificial intelligence (AI) to supercharge their attacks.

CYBERSECURITY IN THE AGE OF AI. EVEN MORE URGENT

Cybersecurity has been a concern for as long as computers have been around. During World War II, there was a cyber battle between the United Kingdom (UK) and Germany involving building the first advanced computers, building secure encryption to ensure the security of the communications of their respective sides, and attempting to crack the encryption of the other. Breakthroughs by the first cryptographic experts at Bletchley Park in the UK turned the tide of the war and gave birth to the United Kingdom’s cyber intelligence organisation, the Government Communications Headquarters (GCHQ). In 2010, the Stuxnet virus, a sophisticated piece of software, caused major disruptions to the Iranian nuclear facility at Natanz — the virus was walked through the door on a USB drive by an unsuspecting and naive employee. The top technology companies have been fighting a constant uphill battle with attackers and every few months a new major company is hacked and has data exposed or is held to ransom. It is clear then that the issue of cybersecurity is not new.

Unfortunately, there is a new factor at play today making the issue of cybersecurity even more severe: Artificial Intelligence (AI). Using advanced AI, sophisticated hacking tools are widely available to anyone with sufficient motivation, and already sophisticated actors now have even more sophisticated tools. Actors are now utilising AI and their own creativity to come up with extraordinary cyber schemes. For example, in February 2024, on a regular day in Hong Kong, an employee of Arup, a British multinational company, received instructions on a video conference call with his boss and CFO to transfer $25 million (~R500 million) to an external account. Unfortunately for the company and the employee involved, the entire affair was a complex cyber fraud utilising advanced AI. All the persons on the video call were, in fact, deepfakes. The attackers had used voice-cloning and face-generation tools to imitate the real expressions and speech of the company seniors. The target was left with no doubt of the request’s legitimacy and transferred the money, which was then quickly laundered through accounts and cryptocurrency mixers, and is yet to be recovered. What is most concerning about this incident is that all the tools involved are available essentially for free on the internet for anyone with the bravado and willingness to learn these techniques (Gumede, 2024).

That means these attacks are only going to get more advanced and the attackers, more creative. Platforms such as ElevenLabs can generate a full audio avatar of a person with just a 30-second clip of the person speaking, and WormGPT (the hacking equivalent of ChatGPT) can generate real-seeming personalised emails, texts and scripts for use in such attacks. Recently, a special kind of AI-powered malware was developed (in proof of concept form) by a Canadian cybersecurity research company. This “Polymorphic malware” uses AI to constantly change and hide itself, allowing it to remain undetected by Endpoint Detection and Response (EDR) tools (HYAS, 2024). This means the malware can behave as if it is alive and actively evade detection by the security defences.

The confluence of ordinary cyberattacks and threat actors combined with the developments in AI have brought about a dramatic shift in the cybersecurity landscape. Cybercriminals no longer need specialised skills and abilities in order to carry out these attacks and those who do possess these skills are made even stronger.

STATE OF CYBERSECURITY IN SA

South Africa is scarily vulnerable in all aspects of cybersecurity and consistently victim to malicious cyber actors, who essentially have free reign to victimise whomever they please. According to the South African Banking Risk Information Centre (SABRIC), South Africa ranks as the third-highest country globally in terms of cybercrime victims (SABRIC, 2024). An assessment detailed in Interpol’s African Cyberthreat Assessment Report found that nearly 600 cyberattacks are launched every hour at South African businesses, government and civic organisations (Interpol, 2022). Government, the private sector and the citizenry are all being victimised, with little to no response, as there is no dedicated agency for cybersecurity or cybercrimes like there is in most developed nations.

Each year, the country loses roughly R2.2 billion due to cyberattacks and incidents, according to the Information and Cybersecurity Centre at the CSIR, which does cybersecurity analysis and statistics. The report by the CSIR also states that over half of all South African companies are victims of ransomware each year and that the average cost of a single large data breach is R53.1 million. Moreover, 88% of South African organisations face between one and five cyber incidents each year (CSIR, 2024). This should come as no surprise, as the country lacks a structured counter to this cyber threat.

The National Cyber Policy Framework (NCPF) assigns the Department of Science and Technology (DST) the responsibility of putting in place a national cybersecurity research and development agenda. However, experts such as Prof. Elmarie Biermann and Dr. Noëlle van der Waag-Cowling have assessed a ‘lack of momentum’ in relation to this agenda (Biermann & Cowling, 2018). These critics argue that the legislation introduced in 2018, namely the Cybercrimes and Cybersecurity Bill, has had no quantifiable effect on the cybersecurity landscape and instead seems to criminalise routine and non-harmful online activities.

The primary laws dealing with cybercriminal activity are the Cyber Crimes Act of 2020 and the Electronic Communications and Transactions (ECT) Act of 2002. The Cyber Crimes Act criminalises hacking, unlawful interception of data, ransomware and similar activities (Cyber Crimes Act, 2020). The Electronic Communications Act gives legal protections to sensitive electronic activities such as electronic transactions and communications (Electronic Communications Act, 2002). The laws are comprehensive (some say too comprehensive as to inhibit perfectly reasonable activity), but enforcement is virtually nil.

In March 2012, the NCPF mandated the then Department of Telecommunications and Postal Services (now the Department of Communications and Digital Technologies [DCDT]) to create the Cybersecurity Hub. The Cybersecurity Hub serves as the country’s Computer Security Incident Response Team (CSIRT) and coordinates cybersecurity responses and information sharing between departments (Cybersecurity Hub, 2025). It also runs an awareness portal (website) with information on cyber awareness but does not run widespread public information campaigns bringing the message to the people. This cyber hub is being overseen by the Cyber Response Committee of the Department of Justice and Constitutional Development. Since these structures have not substantively reduced the cyber threat (544 police cases in the face of over 100,000 banking-related cyberattacks alone; an 86% increase year-on-year), opposition parties, led by DA Spokesperson for Justice and Constitutional Development Adv. Glynnis Breytenbach MP, have tabled a bill proposing the creation of an Office of the Cyber Commissioner to oversee cyber activities (DA, 2025).

Steps are needed as all sectors of society — public, private, civil and individuals — are under constant cyber victimisation, with little to no consequences from law enforcement.

PUBLIC SECTOR

Government departments and state-owned enterprises (SOEs) are under constant attack from and victimisation by cyber actors.

Eskom, the national power utility, is under constant attack. According to Sithembile Songo, the chief information security officer (CISO) at Eskom, it faces up to one billion attempted cyberattacks per month, with DDoS attacks being most common and ransomware attacks accounting for more than 100,000. In 2022, the South African Reserve Bank (SARB) was hacked and its systems disrupted. Then Treasury Minister Enoch Godongwana said that neither SARB nor the South African authorities were able to identify the attack; instead, the FBI (from the United States) “took it upon themselves to notify the oblivious authorities” (Maliti, 2022).

In July 2024, Minister of Public Works and Infrastructure Dean Macpherson announced that hackers had stolen R300 million from the department over a period of 10 years of undetected theft (Public Works, 2024). In May 2024, the Department of Justice and Constitutional Development was victim to a ransomware attack that compromised over 1,200 sensitive files. In July, National Treasury announced they had found malware on their systems related to an attack on Microsoft Sharepoint and that they were seeking Microsoft’s help in dealing with the issue (BusinessTech, 2025). In Jan 2025, the South African Weather Service suffered a hack that left the systems down and unable to function for two weeks in what it described as a “criminal security breach” (Digital Watch SA, 2025). More recently, in March 2025, Parliament announced the hacking of its social media accounts — an incident which saw attackers using the official social media accounts of the Parliament of South Africa for the purposes of promoting a scam cryptocurrency project.

In 2022, the Department of Defence was hacked by a threat actor by the name of ‘Security Notification Attachment’ a.k.a. Snatch. A spokesperson for the department denied any hack took place, saying they were “categorically unwilling to accept information about penetration into the secure government network” (MyBroadband, 2025a). Despite their bizarre denials, 1.6TB of sensitive data from the Department of Defence was published on the website of the attackers and can still be bought on various dark web data broker websites by anyone with the funds, internet and a computer.

In 2024, Cybersecurity research company Recorded Future reported that the State Security Agency was amongst a handful of government departments around the world that had been breached by the cyber-espionage group RedNovember (MyBroadband, 2025b). The group uses open-source tools to exploit vulnerabilities in devices linked to the internet to target government and private organisations globally (Recorded Future, 2024).

The threat to the country’s security is clear. Hackers can, at will, penetrate all government systems, even sensitive defence systems. Rather than acknowledge this major national security crisis, the Minister of Defence Angie Motshekga told Parliament that “cybersecurity is already inherent in SANDF doctrine” (Teixeira, 2025). In the Department of Defence’s Annual Report for FY2024/25, the DoD notes that it is participating in the discussions to create an Integrated Cybersecurity Centre in the Justice, Crime Prevention and Security (JCPS) cluster. These discussions have been ongoing and there has been no substantive progress yet. In 2018, the DoD stated its aim of creating a cyber capability. However, the head of the SANDF’s cyber command, Brigadier General Mafi Mgobozi, stated before Parliament in 2023 that the new unit was in ‘limbo in relation to finding suitable facilities’ and is currently accommodated in "limited space” at Defence Intelligence headquarters and is, therefore, not able to function optimally (DefenceWeb, 2023). The general has subsequently described the unit as being “partially operational” due to lack of funding (Lesedi, 2023).

Considering the lack of a dedicated, well-funded and capacitated agency to deal with the cyber threat, it is likely this trend will continue and government entities will remain vulnerable. Similar types of attacks against government will only become more prevalent. This is echoed by the State Security Agency’s warning that attacks on critical infrastructure are likely to escalate going forward (DefenceWeb, 2025).

PRIVATE SECTOR

It is not just government that is under constant cyberattack; private sector organisations are also being victimised and their victimisation made worse by the lack of government capability in this area.

Cybersecurity researcher Check Point’s Global Threat Intelligence Report, released in July 2025, shows that South African businesses are hit by 2,113 cyberattacks every week (CPR, 2025). Despite this, private sector cybersecurity budgets are low and, more importantly, business awareness of the threats remains low. In a survey mentioned in the report, 80% of IT executives interviewed said they were most confident they could not fall for any kind of phishing attack. However, when tested, 64% of them clicked on a malicious phishing link disguised as a friendly one.

Large companies regularly fall victim to data breach and ransom. In April 2025, Cell C announced it had been hacked by cyberattackers, resulting in customer data being stolen. The company stated it was working with the authorities to deal with the issue and mitigate the impact on customers’ service but that it was unclear just how bad the attack had been. It therefore urged its users to be vigilant and assume the worst. In March 2025, the real estate company Pam Golding suffered a cyberattack. As part of the attack, unidentified cyber assailants remotely accessed the company’s customer relationship management software system. This resulted in the personal data of its customers — like contact details, addresses and ID numbers — being exposed (Decision Inc, 2025).

In April 2025, the telecommunications operator MTN, Africa’s largest mobile operator, underwent a sustained cyberattack. In a company statement, it said the attackers gained unauthorised access to the personal information of customers in various markets across the continent. In March 2025, Astral Foods, which is South Africa’s largest chicken producer, suffered a breach by unknown cyberattackers. The attack disrupted the company’s ability to produce and distribute its chicken, which saw a temporary nationwide chicken shortage (Decision Inc, 2025).

Unfortunately, these threats are not only faced by large businesses, but also by small businesses — often with much worse consequences, as they do not have the capabilities and budgets of large companies. Recent surveys reveal that 47% of South African businesses report experiencing between one and five cybersecurity incidents in the past year (2023), with 88% admitting to at least one security breach (CSIR, 2024).

The consequences of poor cybersecurity readiness are devastating. Imagine a local retail business that processes hundreds of transactions daily. One day, employees are greeted with a ransom note on their screens, demanding R500,000 to unlock their encrypted files. Unable to access customer data, inventory records or payment systems, the business grinds to a halt. After several days of downtime, the company reluctantly pays the ransom, only to discover that the data has been deleted. Legal fees, customer compensation, reputational damage and lack of support from authorities further compound the losses.

Seventy-one percent of cyber leaders believe that small organisations have reached a critical tipping point in being unable to secure themselves against growing cyber threats, according to the World Economic Forum’s Global Cybersecurity Outlook 2025 (WEF, 2025). This is because new AI-boosted cyberattacks have reached a pivotal moment in sophistication, requiring more than business owners are able to do to counter them.

INDIVIDUALS

Individual citizens are also commonly victim to advanced cyberattacks. Often these attacks are successful due to victims not believing that anybody would go so out of their way to scam them. Yet, there are thousands of ordinary citizens who have been victimised by unscrupulous cybercriminal elements.

One notable advanced tactic is the use of AI-powered scams and frauds. In January 2024, the Financial Sector Conduct Authority (FSCA) issued a public warning after persons were fooled by an investment scam that utilised deepfakes (AI-generated videos) of prominent South African businesspersons such as Patrice Motsepe and Johann Rupert. Recently, former Finance Minister Trevor Manuel warned of a scam on social media platforms that featured a deepfake of him, stating that “there are social media posts using [his] image, and artificial voice and pretending to either give people investment advice or requesting that they invest in products that I advise them to” (Fraser, 2025).

In October 2025, SARB also issued a statement warning of a deepfake investment scam featuring their chief, Governor Lesetja Kganyago. Major bank FNB made similar public statements, warning of a deepfake scam impersonating bank officers and seeking to trick bank customers into giving the attackers access to their systems, saying that “in some cases, the scams can be incredibly sophisticated, leveraging deepfakes, voice synthesis, and automated chatbots to appear more legitimate” (Illridge, 2025)

In fact, instances of deepfake scams have risen by 1200% in the past year, according to a report by TransUnion Africa. “We’re a very digitally orientated country, with internet penetration at about 79%, over 50 million users, and 124 million mobile connections. That gives rise to exploitation,” said Amritha Reddy, Senior Director of Fraud Product Management at TransUnion (Nozulela, 2025).

These deepfake scams can also be much more intimate than a social media advertisement using the likeness of a prominent figure. Zoho, a South African cybersecurity company, has warned about much more personal schemes by cybercriminals; impersonating loved ones on WhatsApp. A typical scam such as this works as follows: you get a phone call about something unrelated and over time the attackers develop a large audio file of your voice that can be turned into an audio deepfake. The attackers can then call or send voice notes pretending to be you (Adeyemi, 2025).

This issue has led Deputy Minister of Communications Mondli Gungubele to state that the country needs to prepare to protect consumers against scams and cybercrime related to AI.

Figure 2: Main cyber risks to government, business, society and the citizenry.

(Source: Generated by author)

AFRICA

Not limited to South Africa, the entire continent is facing a cybersecurity crisis. Cybercrime costs Africa an estimated $3.5 billion (R70 billion) annually, according to a report by the Centre for Strategic and International Studies (CSIS) and McAfee (Kauder, 2025). According to Interpol, cybercrime accounts for roughly 30% of all reported crimes in both western and eastern Africa.

In July 2024, hackers calling themselves ‘Hunters’ breached Kenya’s Urban Roads Authority, then struck again in December against Telecom Namibia, affecting over 500,000 customers. In April, R100 million was stolen from Nigerian fintech company Flutterwave by daring hackers. According to Interpol, hackers routinely exploit Africa’s poor infrastructure and outdated systems. In fact, cybercriminals operating Ransomware-as-a-Service (RaaS) use African organisations as a testing ground for new malware. After South Africa, the most targeted countries, according to Interpol, are Egypt and Morocco, due to their large economies and internet access (Interpol, 2024).

The primary cybersecurity initiative in Africa is Interpol’s African Joint Operation against Cybercrime (AFJOC), which is engaged in combating cybercrime across the continent. During Operation Serengeti 2.0 (in 2025), a part of AFJOC and involving 18 African nations as well as the UK, over 1,200 arrests were made and close to R2 billion recovered. The operation also dismantled 11,000 ‘malicious infrastructures’ linked to ransomware, business email compromise and large-scale fraud. Under this operation, the authorities in Angola closed 25 illegal cryptocurrency mining sites operated by 60 Chinese nationals and seized close to R800 million in equipment. In Zambia, police dismantled a R6 billion investment fraud scheme that victimised 65,000 people and uncovered a human-trafficking linked scam that utilised 372 forged passports. In Côte d’Ivoire, authorities arrested the leader of a R30 million inheritance scam. Among the countries participating were Nigeria, Kenya, South Africa, Ghana, Tanzania and Zimbabwe, alongside the UK and other Interpol members (DefenceWeb, 2025).

Due to the rampant cyber lawlessness in the rest of the continent of Africa, South Africa faces an even bigger threat as cybercriminal gangs are targeting South Africa from outside its borders. These challenges make it essential to learn what the most successful cyber countries around the world are doing in order to implement what is proven to work.

WHAT TOP COUNTRIES AROUND THE WORLD ARE DOING

Countries around the world have implemented all sorts of highly successful cyber initiatives, bringing great benefit to their economies, stability, security and more.

In November 2022, after a number of large cyber incidents, such as the breach of Medibank in which the confidential data of millions of Australians was exposed, a new cybercrime task force was set up, known as the ‘Hack the Hackers’ task force. A joint operation by the Australian Federal Police (AFP) and the country’s cyber intelligence organisation, the Australian Signals Directorate (ASD), the task force put together 100 of Australia’s top cyber experts, brought them under one roof and gave them the go-ahead to use offensive cyber tools and tactics similar to those employed by the hackers themselves to hunt down and neutralise cyber threats to Australia (O’Neil, 2023).

The task force has already seen major success, including involvement in Operation Checkmate (2025) taking down the BlackSuit/Royal ransomware group, which has extorted more than R6 billion from victims around the world. In Operation Endgame (2024), the task force took down an international botnet infrastructure using more than 200 servers, made dozens of arrests, and carried out the seizure of millions of euros in cryptocurrency (Breached Company, 2025). This task force is reversing the ordinary dynamic between the authorities and cybercriminals by actively hunting down these threat actors, thus creating real consequences for cyber acts against the state. This is a perfect example of how a country should respond to rising cybercrime and cybersecurity threats.

In July 2021, Singapore’s Cybersecurity Agency (CSA) launched an initiative called ‘Better Cyber Safe Than Sorry’ — a large-scale cybersecurity public awareness campaign. As explored above, the weakest link in any cyber system is the human aspect. By raising awareness in the populous of cybersecurity essentials, one can substantively reduce the costs of cybercrime. The campaign has four key points: Using strong passwords (with multifactor authentication), recognising the signs of phishing and other social engineering schemes, using up-to-date anti-virus software, and always keeping the software on personal devices up to date (CSA, 2025).

The campaign has partnered with major Singaporean e-commerce sites like Shopee, Carousell and hundreds of other stores. It utilises TV ads, bus stop posters and social media to spread the message far and wide. In addition, the CSA runs a ‘Cyber Safe Seniors Programme’ giving multilingual cybersecurity awareness educational content to over 50,000 senior citizens in a bid to prevent those seniors falling victim to cybercrimes and scams. This is a real model for a national cybersecurity awareness campaign (OpenGov Asia, 2021).

The United States has long had several dedicated organisations dealing with cyber. For example, the National Security Agency (NSA), the country’s largest intelligence organisation, which deals with signals and cyber intelligence, including tracking sophisticated cyber actors around the world. The Cybersecurity and Infrastructure Security Agency (CISA) is the coordinator for all US cyber and infrastructure security (CISA, 2025). The United States Cyber Command (USCYBERCOM), the military organisation, has the goal to “Own the Domain” when it comes to cyberspace. Together these organisations work towards ensuring that whatever happens in cyber space, happens to the advantage of the United States (USCYBERCOM, 2025).

The successes of these organisations are common knowledge, from monitoring and responding to cyber threats to creating the world’s most advanced cyber tools. Recently, in August 2025, the above organisations issued a warning about the Chinese cyber threat actor known as Salt Typhoon — which had targeted telecommunications companies around the world. The NSA even has its own hacking unit, once known as Tailored Access Operations (TAO), directly targeting adversaries and other threats to America. CISA routinely stress tests the systems of large American companies, with the view of protecting them from foreign threat actors. Such dedicated cyber organisations and agencies are essential for the protection of any major country.

In 2000, less than 2% of the population of China had access to the internet (World Bank, 2025). Today China is, of course, a global cyber and internet power. In May 1999, after a US missile destroyed the Chinese embassy in Belgrade, the first known Chinese cyberattack took place. Early Chinese internet users defaced the websites of several American government departments. Those early hackers from the China Eagle Union and the Honka Union of China were the beginning of Chinese hacking power — now known the world over for sophisticated operations that have successfully brought China up to the level of the United States in science and technology (Lafarge, 2022).

Instead of being shunned, these early Chinese hackers were given the support they needed to develop their abilities and given the go-ahead to use their skills for the betterment of the state. As a result, this small group of ‘Honkers’ (derived from the Chinese ‘Hong Ke’) with just 40 hackers, known to western researchers as ‘The Red 40’, which began as a loose network that met in online forums in the 1990s and 2000s, became a global cyber superpower within the short space of a decade or two (Benincasa, 2025).

Today, Israel makes up 0.11% of the world’s population. Despite this, it holds one-third (33%) of the world’s cybersecurity unicorns (billion dollar startups). For comparison, the Cape Town—Stellenbosch corridor (South Africa’s ‘Silicon Valley’) had roughly 450 tech companies in 2022, while Israel had 6,500, one for every 1,400 people. This cyber hub has attracted the majority of the top tech companies in the world to open R&D centres in Israel. This was achieved through programmes such as the Talpiot programme and Unit 8200 (Gumede, 2022). The Talpiot programme is a specialised training programme for the top school and high school students in the country and is designed to get them to the level of a university graduate before they even graduate high school, putting these top students on the path to becoming world-class experts in their fields; everything from cyber, sciences, academia and leadership.

The top cyber trainees go into Unit 8200, Israel’s signals and cyber intelligence organisation, where they are given the go-ahead to create the world’s most advanced cyber systems and tools. Then, after these tools are replaced and become militarily obsolete, they take these tools to the private sector, starting world-class cyber-tech startups. For this reason, Unit 8200 graduates are coveted by tech companies around the world. This unique programme produced Israel’s extraordinary overachievement in cybersecurity and associated technologies (Gumede, 2022).

These examples of the most successful cybersecurity initiatives from around the world each speak to a different essential aspect of this new world: Dedicated cyber organisations, national public awareness campaigns, proactive and offensive operations as well as supporting the next generation of cyber talent, who will create the technologies of the future.

WHAT SA SHOULD DO

Given that there are already proven examples of successes from around the world, the country must learn from these. South Africa should seek to emulate all of the initiatives outlined above and below.

CREATION OF A NATIONAL CYBERSECURITY AND INTELLIGENCE ORGANISATION

The creation of a dedicated cybersecurity and intelligence organisation that is well capacitated, well-funded and has clear objectives. This organisation should be staffed by the top experts in the field and not encumbered by political appointments and interference. This organisation should oversee all cyber activities, go after cyber threats to the country in order to restore consequences for cybercrimes, and test all public and private systems for their cyber strength.

Such an organisation would oversee the cybersecurity of government departments, infrastructure, corporate systems and products, and the creation of locally made defensive and offensive tools. Most importantly, it should prepare and execute a long-term cyber strategy.

CREATION OF A NATIONAL CYBERSECURITY PUBLIC AWARENESS AND EDUCATION CAMPAIGN

The creation of a publicly accessible (zero-rated) platform as well as widespread messaging to bring awareness to the population about proper cybersecurity practices, to address the weak link ‘PICNIC’ problem of cyber defence. This is particularly essential for older citizens or citizens further away from the tech and internet worlds.

Such a campaign would have the effect of raising the cybersecurity awareness of the population, turning all citizens into eyes that can monitor for malicious cyber activities, keeping the citizenry updated on the latest techniques utilised by cybercriminals, and preventing countless persons falling victim to scams, frauds and other criminal activities.

CREATION OF A NATIONAL PROGRAMME FOR FOSTERING TOP CYBER TALENT

This could mean giving support to promising school students or giving internships and work opportunities to top talent. It could also mean taking all persons incarcerated for cyber-related crimes and putting their skills to work to the benefit of the state. This strategy is not without precedent globally or in South Africa; as in the case of the Bishops High School student who hacked ABSA in 2003 and was forced to work for three years at the CSIR’s Cybersecurity Research Lab (M&G, 2003).

Such a programme would quickly create a large cohort of cyber experts in all subfields, which will have unquantifiable benefits to the economy, state institutions, employment, and positively affect every other sector of society.

Figure 3: South Africa Cybersecurity Action Triangle.

(Source: Generated by author)

By implementing these initiatives, the country will address the current cyber threat crisis (cybersecurity and intelligence organisation), position itself properly for the future (fostering next-generation talent) and turn all South African citizens into cybersecurity-aware frontline defenders (national awareness campaign). These basics are being employed by every major tech-leading country.

CONCLUSION

Every facet of our lives depends on cyber systems, and those cyber systems are only becoming more vulnerable to malicious actors . For this reason, the major nations globally have cybersecurity as a top priority.

Cyberspace is a domain of power and South Africa is not adequately prepared. Acts in cyberspace are being committed every day by the powers of the world. From the United States deploying a virus to destroy Iranian nuclear plants, Russia shutting down the Ukrainian power grid, and Israel turning innocent-seeming pagers into explosive devices against Hezbollah, to Chinese hackers exfiltrating defence blueprints from US defence companies — it is clear that the domain of cyberspace is the most important in today’s world. It is a domain in which an invisible global war is being constantly fought.

Not only is South Africa likely the victim of all manner of nation-state cyber operations, but cyber actors of all types are also running free, constantly victimising South African citizens to the point where South Africa has the third-highest incidence of cyberattacks in the world. Ordinary citizens are being scammed, defrauded, robbed and tricked by sophisticated cybercriminal gangs. Businesses, small and large, are being extorted and held to ransom, resulting in billions of rands in losses and unquantifiable damage to the economy. The country’s defence organisations, which are supposed to secure the country from external threats, are themselves consistently penetrated by cyber threat actors. Government is also victim to these cyberattacks, as are private sector organisations and individuals.

The issue of cybersecurity requires a national project involving all sectors of society: the government, private sector, civil society and the population as individuals. This is a defence issue, as the country’s diplomatic communications can be intercepted, the army’s vehicles and planes hacked and disabled, elections influenced, with the only bound being the creativity of the attackers. This is an education and talent issue, as the development of the next generation of cyber experts is needed to create the technologies and strategies of the future. This is also a stability issue, as power grids, water infrastructure, supply chains, food production, can all be hacked and brought to a standstill. Such a thing could descend the country into total anarchy in less than a week.

What needs to be done is clear and does not require the reinvention of the wheel. Following the lead of such countries as Australia, the United States, China and most other developed countries, a dedicated cybersecurity organisation is required. One that is totally free from political appointments and interference and led by the top cyber experts in the country.

Following the lead of countries such as Singapore, a national cybersecurity awareness campaign is needed to work to strengthen the weakest link in South Africa’s cyber defence, which is the human element. If people have a better understanding of the risks and realities of cybersecurity and cybercrime, this will bring massive benefits to the country — including an immediate and substantial decrease in cybercriminality and victimisation.

Following the lead of such countries as Israel, China and the US, a national programme of cultivating the next generation of cyber talent is required. This will create the world-class experts of tomorrow, who will bring knowledge, technologies and security to the country.

Without proper cybersecurity, no nation can be secure. This is a matter of top priority and requires the urgent attention of the entire country: the government, the private sector, civil society and the citizenry.

REFERENCES

Adeyemi, S. 2025. Rising security fears in South Africa as scammers weaponise WhatsApp voice notes. [Online] Available at: https://africa.businessinsider.com/local/ rising-security-fears-in-south-africa-as-scammers-weaponise-whatsapp-voice-notes/m50286d [accessed: 4 March 2026].

Air Force Office of Special Investigation (AFOSI). 2020. Cyber espionage for the Chinese government. [Online] Available at: https://www.osi.af.mil/News/ Features/Display/Article/2350807/cyber-espionage-for-the-chinese-government/ [accessed: 4 March 2026].

Baezner, M. & Robin, P. 2017. CSS Cyber Defense Project: Hotspot Analysis: Stuxnet. Center for Security Studies, ETH Zurich. [Online] Available at: https://css.ethz.ch/content/dam/ethz/special-interest/ gess/cis/center-for-securities-studies/pdfs/Cyber-Reports-2017-04.pdf [accessed: 4 March 2026].

Benincasa, E. 2025. Before Vegas: The “Red Hackers” Who Shaped China’s Cyber Ecosystem. Zurich: Center for Security Studies. [Online] Available at: https://css.ethz.ch/en/center/CSS-news/ 2025/07/before-vegas-the-red-hackers-who-shaped-chinas-cyber-ecosystem.html [accessed: 4 March 2026].

Biermann, E. & Cowling, N. 2018. Mind the Gap: Addressing South Africa’s cybersecurity skills shortage. [Online] Available at: https://www.dailymaverick.co.za/article/ 2018-07-13-mind-the-gap-addressing-south-africas-cybersecurity-skills-shortage/ [accessed: 4 March 2026].

Breached Company. 2025. Global Cybercrime Crackdown 2025: A Mid-year Assessment of Major Arrests and Takedowns. [Online] Available at: https://breached.company/ global-cybercrime-crackdown-2025-a-mid-year-assessment-of-major-arrests-and-takedowns/ [accessed: 4 March 2026].

BusinessTech. 2025. National Treasury exposed to malware in major Microsoft security breach. [Online] Available at: https://businesstech.co.za/news/it-services/832796/national-treasuryexposed-to-malware-in-major-microsoft-security-breach/ [accessed: 4 March 2026].

Check Point Research (CPR). 2025. Threat Intelligence Report — 14 July 2025. [Online] Available at: https://research.checkpoint.com/2025/14th-july-threat-intelligence-report/ [accessed: 4 March 2026].

Council on Foreign Relations (CFR). 2015. Compromise of a power grid in eastern Ukraine. [Online] Available at: https://www.cfr.org/cyber-operations/compromise-power-grid-eastern-ukraine [accessed: 4 March 2026].

CSIR Information and Cybersecurity Centre (CSIR). 2024. About the CSIR Information and Cybersecurity Research Centre. [Online] Available at: https://www.csir.co.za/sites/default/files/ Documents/250154_CSIR%20ICSC%20Booklet_Mining.pdf [accessed: 4 March 2026].

Cybersecurity Agency (CSA). 2025. Better Cyber Safe Than Sorry. [Online] Available at: https://www.csa.gov.sg/our-programmes/cybersecurity-outreach/cybersecurity-campaigns/ better-cyber-safe-than-sorry-campaign [accessed: 4 March 2026].

Cybersecurity and Infrastructure Security Agency (CISA). 2025. What is Cybersecurity? [Online] Available at: https://www.cisa.gov/news-events/news/what-cybersecurity? utm_source=chatgpt.com [accessed: 4 March 2026].

Cybersecurity Hub. 2025. Official website of the South African National CSIRT. [Online] Available at: https:// www.cybersecurityhub.gov.za/ [accessed: 4 March 2026].

Decision Inc. 2025. SA under siege: Why cybersecurity must be a business imperative.  [Online] Available at: https://www.itweb.co.za/article/sa-under-siege-why-cyber-security-must-be-abusiness-imperative/PmxVEMKE6ZpvQY85 [accessed: 4 March 2026].

DefenceWeb. 2023. SANDF Cyber Command operating in “limited space”. [Online] Available at: https://defenceweb.co.za/featured/sandf-cyber-command-operating-in-limited-space/ [accessed: 4 March 2026].

DefenceWeb. 2025. South Africa faces escalating cybersecurity threats to critical infrastructure. [Online] Available at: https://defenceweb.co.za/cyber-defence/south-africa-faces-escalatingcybersecurity-threats-to-critical-infrastructure/ [accessed: 4 March 2026].

Democratic Alliance (DA). 2025. Over 100 000 cyber-attacks while SAPS records just 544 cases – DA pushes for Cyber Commissioner. [Online] Available at: https://www.da.org.za/ 2025/09/over-100-000-cyber-attacks-while-saps-records-just-544-cases-da-pushes-for-cyber-commissioner [accessed: 4 March 2026].

Department of Public Works and Infrastructure, Government of South Africa (Public Works). 2024. Minister Dean Macpherson on R300 million cyber crime theft unearthed at Department Public Works and Infrastructure. [Online] Available at:https:// www.gov.za/news/media-statements/minister-dean-macpherson-r300-million-cyber-crime-theft-uneartheddepartment [accessed: 4 March 2026].

Digital Watch SA. South African weather service hit by cyberattack, affecting critical operations. [Online] Available at: https://dig.watch/updates/south-african-weather-service-hit-by-cyberattack-affecting-critical-operations [accessed: 4 March 2026].

Fraser, L. 2025. Trevor Manuel’s warning for South Africa. [Online] Available at: https://businesstech.co.za/news/business-opinion/838959/trevor-manuels-warning-for-south-africa/ [accessed: 4 March 2026].

Gumede, L. 2022. Economic Growth Requires Intelligent Design. [Online] Available at: https://www.sundaytimes.timeslive.co.za/opinion-and-analysis/2022-02-27-economic-growth-requiresan-intelligent-design/ [accessed: 4 March 2026].

Gumede, L. 2024. AI-powered hackers loom large for SA. [Online] Available at: https://www.businesslive.co.za/bd/opinion/2025-04-15-lars-gumede-ai-powered-hackers-loom-largefor-sa/ [accessed: 4 March 2026].

HYAS Infosec Inc (HYAS). 2024. BlackMamba: AI-synthesized, polymorphic key logger with on-the-fly program modification. [Online] Available at: https://www.hyas.com/hubfs/ Downloadable%20Content/HYAS-AI-Augmented-Cyber-Attack-WP-1.1.pdf [accessed: 4 March 2026].

Illridge, M. 2025. High-tech crime surge in South Africa. [Online] Available at: https://mybroadband.co.za/news/security/611683-high-tech-crime-surge-in-south-africa.html [accessed: 4 March 2026].

International Business Machines (IBM). 2025. Types of cyberthreats. [Online] Available at: https:// www.ibm.com/think/topics/cyberthreats-types [accessed: 4 March 2026].

International Police Service (Interpol). 2022. Africa Cyberthreat Assessment Report 2022. [Online] Available at: https://www.interpol.int/content/download/19174/file/ 2023_03%20CYBER_African%20Cyberthreat%20Assessment%20Report%202022_EN.pdf [accessed: 4 March 2026].

Interpol. 2025. Africa Cyberthreat Assessment Report 2025. International Police Service. [Online] Available at: https://www.interpol.int/en/content/download/23094/file/25COM009248%20- %20Cybercrime_Africa%20Cyberthreat%20Assessment%20Report_Design_2025-05%20v11.pdf [accessed: 4 March 2026].

Kauder, S. 2025. Why is Africa Losing Billions to Cybercrime? [Online] Available at: https://www.crowe.com/za/insights/af-53-why-is-africa-losing-billions-to-cybercrimeinsight-web-article [accessed: 4 March 2026].

Lafarge, T. 2022. China’s Hacker Army: The World’s Largest Surveillance Network. [Online] Available at: https://www.youtube.com/watch?v=yNQ8KRfnVYU [accessed: 4 March 2026].

Lesedi, S. 2023. Funding mars SANDF Cyber Command. [Online] Available at: https://www.military.africa/2023/01/funding-mars-sandf-cyber-command/ [accessed: 4 March 2026].

Mail & Guardian (M&G). 2003. Hacker stole half-a-million rand from Absa clients. [Online] Available at: https://mg.co.za/article/2003-07-22-hacker-stole-halfamillion-rand-from-absa-clients/ [accessed: 4 March 2026].

Maliti, S. 2022. FBI beat security cluster in identifying cyber hack of the SA Reserve Bank, says Godongwana. [Online] Available at: https://iol.co.za/capeargus/news/2022-12-15-fbi-beatsecurity-cluster-in-identifying-cyber-hack-of-the-sa-reserve-bank-says-godongwana/ [accessed: 4 March 2026].

MyBroadband. 2025a. Interview with the hackers who broke into South Africa’s Department of Defence. [Online] Available at: https://mybroadband.co.za/news/security/505982- interview-with-the-hackers-who-broke-into-south-africas-department-of-defence.html [accessed: 4 March 2026].

MyBroadband. 2025b. Chinese hackers may have breached the South African State Security Agency. [Online] Available at: https://mybroadband.co.za/news/security/612367- chinese-hackers-may-have-breached-the-south-african-state-security-agency.html [accessed: 4 March 2026].

Nozulela, M. 2025. South African Reserve Bank warns public about deepfake investment scam. [Online] Available at: https://iol.co.za/business/2025-09-25-south-african-reserve-bankwarns-public-about-deepfake-investment-scam/ [accessed: 4 March 2026].

O’Neil, C. 2023. Press Conference: Cybersecurity Strategy & High Court Decision. Office of Minister for Home Affairs, Government of Australia. [Online] Available at: https:// minister.homeaffairs.gov.au/ClareONeil/Pages/Press-conference-22112023.aspx [accessed: 4 March 2026].

OpenGov Asia. 2021. CSA Launches Campaign to Drive Awareness and Adoption of Cybersecurity Practices. [Online] Available at: https://archive.opengovasia.com/2021/06/28/csa-launchescampaign-to-continue-to-drive-awareness-and-adoption-of-cybersecurity-practices/? c=za [accessed: 4 March 2026].

Parliament of the Republic of South Africa. 2002. Electronic Communications Act of 2002. [Online] Available at: https://www.gov.za/sites/default/files/ gcis_document/201409/a25-02.pdf [accessed: 4 March 2026].

Parliament of the Republic of South Africa (Parliament). 2020. Cybercrimes Act of 2020. [Online] Available at: https://cybercrimesact.co.za/ [accessed: 4 March 2026].

Recorded Future. 2024. TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies. [Online] Available at: https://www.recordedfuture.com/research/tag-100-uses-open-source-tools-in-suspected-global-espionage-campaign [accessed: 4 March 2026].

SABRIC. 2024. Annual Crime Statistics 2024. South African Banking Risk Information Centre. [Online] Available at: https://www.sabric.co.za/wp-content/uploads/2025/09/CRIME-STATISTICS-REPORT- 2024.pdf [accessed: 4 March 2026].

The Guardian. 2021. Saudis behind NSO spyware attack on Jamal Khashoggi’s family, leak suggests. [Online] Available at: https://www.theguardian.com/world/2021/jul/18/ nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus [accessed: 4 March 2026].

Trenta, L. 2024. Nowhere to Hide: Israel’s Pager Attacks on Hezbollah. [Online] Available at: https://www.rusi.org/explore-our-research/publications/ commentary/nowhere-hide-israels-pager-attacks-hezbollah [accessed: 4 March 2026].

United States Cyber Command (USCYBERCOM). 2025. Mission & Vision of United States Cyber Command. [Online] Available at: https://www.cybercom.mil/About/Mission-and-Vision/ [accessed: 4 March 2026].

World Bank. 2025. Open Data: Individuals using the Internet (% of population) — China.  [Online] Available at: https://data.worldbank.org/indicator/IT.NET.USER.ZS?locations=CN [accessed: 4 March 2026].

World Economic Forum (WEF). 2025. Global Cybersecurity Outlook 2025. [Online] Available at: https://reports.weforum.org/docs/ WEF_Global_Cybersecurity_Outlook_2025.pdf#:~:text=Nearly%2047%25%20of%20organization s%20cite%20adversarial%20advances,with%2042%25%20of%20organizations%20reporting%2 0such%20incidents [accessed: 4 March 2026].

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

This report has been published by the Inclusive Society Institute

The Inclusive Society Institute (ISI) is an autonomous and independent institution that functions independently from any other entity. It is founded for the purpose of supporting and further deepening multi-party democracy. The ISI’s work is motivated by its desire to achieve non-racialism, non-sexism, social justice and cohesion, economic development and equality in South Africa, through a value system that embodies the social and national democratic principles associated with a developmental state. It recognises that a well-functioning democracy requires well-functioning political formations that are suitably equipped and capacitated. It further acknowledges that South Africa is inextricably linked to the ever transforming and interdependent global world, which necessitates international and multilateral cooperation. As such, the ISI also seeks to achieve its ideals at a global level through cooperation with like-minded parties and organs of civil society who share its basic values. In South Africa, ISI’s ideological positioning is aligned with that of the current ruling party and others in broader society with similar ideals.

Email: info@inclusivesociety.org.za

Phone: +27 (0) 21 201 1589

Web: www.inclusivesociety.org.za