Why cyber security is a business risk, not an IT ticket

What an attack costs a business

Cyber security is the set of controls that protect a business's systems, data and people from attack. A breach is a case where someone gets into those systems or data without permission.

Many firms treat it as a job for the IT team, so they buy a firewall, install antivirus and close the matter. That misses the point, because attackers are patient and aim at the systems you cannot do without.

One attack can stop work, lose data and damage a name built over years. Those outcomes land on the desk of the owner, the managing director and the board. So how well you are protected is a leadership question.

Four questions show where you stand. Could we keep trading if our systems were locked? What would that cost us? Which suppliers can reach our systems? Could we actually recover?

Could you actually recover?

Ransomware is software that locks your files and demands payment. Some attacks steal data first, then ask for payment twice. Attackers can also target backups, which is why recovery is the real test.

The question for a CFO is not whether you have backups. It is how long it would take to be back at work, and what that would cost. The layered defence section and the first-five list show how to test it.

Your suppliers are part of your exposure

Supplier compromise means attackers reach you through a firm you trust. It was the top initial cause in IBM's 2025 South African figures, so your security depends partly on the suppliers who can reach your systems.

TechCentral also reported that supplier incidents carried an average cost of R29.6-million in 2025.

Start with a complimentary security assessment

THUSA offers a complimentary security assessment of your current controls, vulnerability exposure and compliance gaps, with prioritised recommendations. Read about the service, or ask for the assessment.

How exposed are South African businesses?

The Council for Scientific and Industrial Research (CSIR) published national survey results with the Cybersecurity Hub of the Department of Communications and Digital Technologies. Fieldwork ran at the end of the 2023/24 financial year. People answered by phone or online, and over 300 responses came in for each survey.

The CSIR reported that 88% of participants admitted to suffering at least one security breach. It also reported that 90% of those organisations were targeted more than once.

A separate source measures something different. Santam, a South African insurer, published a media article on 31 January 2025. It says its SHA Risk Review found that one in three small and medium enterprises had been the victim of a cyber-attack. Treat it as a pointer.

A South African risk snapshot

Here is what each source measured. Read the last column before you quote a number.

The two IBM editions name different top causes, and their samples are not comparable.

How do attacks usually start?

Attacks are rarely exotic. Beyond suppliers, they commonly arrive through a few well-known doors.

Phishing

Phishing is a fake message that tricks someone into giving up a password or paying a false invoice. It looks ordinary, and that is the point. IBM's 2025 figures put it at 13% of South African breaches.

Stolen or compromised credentials

Credentials are usernames and passwords, so when they are stolen or compromised, an attacker can just sign in. IBM's 2025 figures put them at 13%, and its 2024 edition ranked them first, at 17%.

Old software and cloud mistakes

Known weaknesses stay open when updates are late, and cloud storage that is set up wrongly can leave data exposed.

What does POPIA expect?

If you hold personal information about customers, staff or suppliers, the Protection of Personal Information Act (POPIA) applies to you. It expects proper safeguards. Section 22(1) requires a responsible party to tell the Information Regulator about a security compromise. A responsible party is the business that decides why and how personal information is used. The people affected must be told too, subject to the Act's conditions.

That makes cyber security part of your compliance position. Good controls help prevent a breach, and good records show what you did. Our article on governance, risk and compliance explains what the Regulator can do when a business falls short.

THUSA's cyber security programme is aligned to ISO/IEC 27001, with the NIST Cybersecurity Framework and CIS Controls as references. For formal POPIA sign-off, ask your legal adviser, because this article is not legal advice. Our privacy policy shows how we handle personal information.

How does layered defence work?

No single control is perfect, and none has to be. The aim is that a threat which gets past one control meets another. Four layers matter most for a typical business.

• People. Staff who have not learned the basics click bad links and pick weak passwords. Training, monthly phishing tests and clear reporting turn staff into an early warning.
• Devices. Workstations and servers need more than antivirus. Endpoint detection and response records what happens on the device. According to THUSA's cyber security service, malicious activity is isolated within seconds.
• Email. Email is a common way in, so it needs several defences. Known bad mail is filtered, links are checked on click, and odd attachments are opened in isolation first.
• Backup. Recovery decides how bad the day gets. Keep backups out of ransomware's reach.

The first five things to do

You do not need a big project to start, so work through this list in order. It is our suggested baseline, not a legal checklist.

1. Turn on multi-factor sign-in. It asks for a second proof, such as a phone prompt, besides the password. Start with email and administrator accounts.
2. Restore a backup. Pick one important system and restore it from backup. A backup that reports success is not the same as a recovery that works.
3. Brief your staff. Show them what a fake invoice or password request looks like, and who to tell.
4. List your suppliers. Note which ones can reach your systems or data, and what they can do.
5. Name an incident owner. Decide who makes the first calls if something goes wrong, and write the numbers down.

Then ask your leaders two questions. If our email were hacked today, who would notice? Could we show an auditor or insurer what we have in place?

THUSA Cyber Security: three tiers, four steps

THUSA Cyber Security is a managed security service for South African businesses. You can start with the baseline and add more as you are ready.

• Cyber Essentials. Endpoint protection, email security, security awareness training, monthly phishing simulations, vulnerability scanning and patch management.
• Cyber Defence. Everything in Essentials, plus 24/7 security operations centre monitoring and incident response.
• Enterprise Cyber Resilience. Everything in Defence, plus governance, compliance programme management and a dedicated account lead.

THUSA works in four steps: assess what is exposed, prioritise by business impact, implement the fixes, and keep improving as threats change. The 24/7 cover comes from an operations team, a security team and a monitoring centre. THUSA has been in operation for more than 25 years.

The place to start is the complimentary assessment. If you use Microsoft 365, see how its plans differ on security.

Questions leaders ask

Is cyber security the IT team's job?

The IT team or provider runs the controls, but leadership owns the risk. The first section explains why. Leaders should ask often how well the business is protected, and the two questions after the first-five list are a good place to start.

What is the most common cause of breaches in South Africa?

It depends on the source. Supplier compromise led in IBM's 2025 research, as reported by TechCentral, but credentials led in the 2024 edition, so the order can change. The risk snapshot table gives each figure with its source and limits, and the section on how attacks start describes each way in.

Do I have to tell the Information Regulator about a breach?

Yes, if POPIA applies to you. Section 22(1) requires a responsible party to notify the Information Regulator of a security compromise. The people affected must be told too, subject to the Act's conditions. The POPIA section above has the detail, and your legal adviser can confirm how it applies to you.

How much can a breach cost?

It depends on the incident. The only cost figure in this article is for one kind of incident, supplier compromise, so it is not an average for every breach. The supplier section gives the figure with its source, and the risk snapshot table shows the limits of each source.

What does the complimentary security assessment cover?

THUSA's assessment looks at your current controls, vulnerability exposure and compliance gaps, and gives you prioritised recommendations. A simulated phishing campaign or penetration test can also show how your people and systems respond. It is a way to learn where you stand before an attacker does.

Sources

• CSIR national survey results on the state of cybersecurity in South Africa (csir.co.za), read 3 November 2026.
• Santam media centre, article on cyber risk for small businesses, 31 January 2025 (santam.co.za).
• TechCentral, article on the average cost of a data breach in South Africa, 1 August 2025, reporting IBM's 2025 research (techcentral.co.za).
• Engineering News, 2 August 2024, reporting IBM's 2024 edition.