by I AM

Faster Attacks, Cheaper Breaches: The Paradox Defining South Africa's Cyber Risk

South African organisations are, by one measure, getting better at surviving a data breach. By almost every other measure, the threat is accelerating. That tension, falling average breach costs alongside faster, more organised and more frequently successful attacks, is the defining feature of the country's cyber landscape heading into 2027, and it carries lessons well beyond our borders.

South Africa: a mature target with uneven defences

South Africa's digital economy is the most developed on the continent, and criminals have noticed. According to Mastercard's 2026 report on Africa's digital defence race, as summarised by Africa Data Talk, four countries account for 54.7% of online crime on the continent: Nigeria (24.4%), South Africa (12.6%), Morocco (10.6%) and Kenya (7.1%). The report links that concentration to the growth of fintech and mobile money, which it says has grown sixfold in ten years. Where money moves digitally, attackers follow.

Inside the country, the picture from incident responders is one of speed. Cyber security firm Cyanre told ITWeb in August that the average time an attacker stayed inside a victim's network before being detected fell from 117 days in 2024 to 18 days in 2025, and that in several cases attackers completed their operations within a day of gaining access. Its analyst's summary is blunt: data has replaced systems as the primary asset under threat. Encrypting servers is no longer the whole game; stealing and threatening to leak information is.

The pressure to pay is also rising. Sophos survey data cited in the same article shows the share of South African organisations whose data was encrypted and who then paid the ransom rising from 43% in 2024 to 71% in 2025. Cyanre's own engagements tell a similar story, with payments in 30% of cases in 2025 and 46% across January to July 2026, albeit from a small sample of 15 and 13 engagements respectively.

The paradox: breaches are costing less

Against that backdrop, IBM's 2025 Cost of a Data Breach Report, conducted by the Ponemon Institute, offers a surprising data point. The average cost of a breach in South Africa fell almost 17% year on year, from R53.1 million to R44.1 million (US$2.45 million). Globally, the average fell 9% to US$4.44 million, the first decline in five years. South Africa made up about 4% of the report's sample of more than 600 organisations, so the figures are indicative rather than definitive.

Averages hide wide variation. Financial-sector breaches in South Africa averaged R70.2 million, the highest of any industry in the study, ahead of hospitality (R57.5 million) and services (R56.76 million). The most expensive single cause was third-party vendor and supply chain compromise, responsible for 17% of incidents at an average of R29.6 million each, while compromised credentials, phishing and denial-of-service attacks each accounted for 13%.

What drove costs down? IBM found that organisations making extensive use of AI and security automation had breach costs 32% lower than those that did not. In South Africa, data security software, AI and machine-learning insights, and DevSecOps practices were the three factors that most reduced cost. In other words, the same technologies that criminals are adopting are also the strongest lever for defenders.

Africa and the world: a skills and spending gap

Zooming out, Mastercard's report states that cyberattacks in Africa have risen 421% since 2016, against a global average of 307%, with a major attack occurring on average every eight minutes in 2025. It cites an estimated direct cost of US$5 billion a year, a shortfall of roughly 200,000 cybersecurity professionals, and average cybersecurity spending in Sub-Saharan Africa of 0.03% of GDP, versus 0.25% in mature economies. (Note that the source describes the 421% figure both as covering “since 2016” and “less than ten years”, so treat the exact period with care. It also reports that around 60% of incidents are now orchestrated by organised criminal groups rather than opportunistic individuals.

The global comparison is instructive. IBM reports that one in six breaches worldwide now involves AI-driven attacks, most commonly AI-generated phishing (37%) and deepfake impersonation (35%). Yet only about 47% of South African organisations surveyed have a formal AI governance policy, with another 14% developing one, and 37% are implementing access controls on AI systems. The attack surface is expanding faster than the governance around it, a pattern seen in the United States and Europe too, though those markets benefit from deeper security budgets and talent pools.

What this means for business leaders

The data points to a few practical priorities. First, assume speed: if attackers can operate within a day, detection and response measured in weeks is no longer acceptable. Second, treat identity as the perimeter, since compromised credentials and access-control failures feature in many successful breaches. Third, manage the supply chain, because third-party compromise was the single costliest initial cause in South Africa. Fourth, invest in automation and monitoring, where IBM's data shows the clearest cost benefit. And finally, remember the human layer: as one executive quoted in the Mastercard report put it, cybersecurity is roughly 30% technical and 70% human governance.

For organisations that hold personal information, these are not only commercial concerns. Under POPIA, a breach is also a compliance event, and regulators are increasingly willing to act.

Looking ahead

The falling cost of the average breach is good news, but it is not a reason for comfort. It reflects better detection and automation at some organisations, not a retreat by attackers, whose methods are industrialising through ransomware-as-a-service, automation and AI. The organisations that will fare best are those that close the gap between how quickly they can be attacked and how quickly they can respond. For South African businesses, and for the continent's fast-growing digital sector, that gap is now the most important number to watch.

Sources: Mastercard “Africa's Digital Defense Race” (2026), via Africa Data Talk; IBM/Ponemon 2025 Cost of a Data Breach Report, via Connecting Africa; ITWeb (11 August 2026) citing Cyanre and Sophos data.