For years, South African companies treated cybersecurity as an IT problem: something for the team down the corridor, who mostly spent their time cleaning malware off laptops after staff browsed sites they shouldn’t have. 

That era is over. Cyberattacks are now an existential business risk. Criminal syndicates use ransomware and AI-driven tools to drain millions from organisations, and they are getting faster. Research from cybersecurity firm ReliaQuest shows that the average “breakout time” (the window between an attacker gaining access and spreading across a network) fell from 48 minutes in 2024 to just 18 minutes in 2025. Defenders who rely on manual response cannot move that quickly. 

Yet much of South Africa’s private-sector leadership remains stuck in an analogue mindset. Business Day reports that only 14% of African CEOs believe their companies are keeping pace with AI. Criminals are using AI to probe for weaknesses, while most leaders concede they are behind the very technology being turned against them. 

The cost of falling behind is steep. Rapport reports that hackers are extracting ransoms of R7 million or more from exposed South African firms. And under the Protection of Personal Information Act (POPIA), a company whose systems are compromised must notify both the Information Regulator and affected individuals as soon as reasonably possible. 

Companies cannot control the speed or ferocity of attackers. They can control how they communicate when a breach happens, and that is where much of the damage is either contained or compounded. 

Communication is the ultimate tool for damage control. Delays and vague statements breed panic and erode trust. A swift, clear notice tells customers what happened, what information is at risk and exactly what to do next: block compromised bank cards, monitor their credit records and change passwords. Every hour gained limits the spread of harm. 

This requires preparation, not improvisation. Breach-response messages, spokespeople, customer channels and approval lines should be agreed long before an incident and rehearsed alongside technical recovery plans. In a crisis, there is no time to draft from scratch or debate wording through five layers of sign-off. 

Companies that treat immediate, clear notification as an operational priority rather than a legal chore protect their customers’ livelihoods and their own reputations. Breaches may be increasingly inevitable. Silence and confusion are not. 

– Sashni Pather
Account Manager