Insights and guidance
Cybersecurity and compliance articles.
Practical guidance on regulations, frameworks, and best practices relevant to South African businesses.
-
South Africa's AI Policy Gets a Second Draft: The Governance Firms Should Build Now
A revised national AI policy is due for ministerial input before the end of November 2026, after the first draft was withdrawn in April over AI-generated citations that were never verified. South African firms do not need to wait for the policy to act. The failure that sank the first draft is the same one most organisations have not yet controlled.
Read article -
Reporting a Material Cyber Incident Within 24 Hours: The New FSCA and Prudential Authority Template
Since 1 September 2026, South African financial institutions must notify the FSCA and Prudential Authority of a material IT or cyber incident within 24 hours of classifying it as material, using a prescribed template. The template asks questions many firms cannot answer on day one. Here is what it requires and how to prepare.
Read article -
Being Hacked Is Not the Offence: What the Information Regulator's SABS Finding Means
At its media briefing on 31 August 2026 the Information Regulator explained why it took enforcement action against the SABS after a 2024 ransomware attack: not because the organisation was attacked, but because its own assessment found underlying POPIA failures. It also reported more than 1,220 security compromise notifications since 1 April.
Read article -
When a Hacker Claims to Have Your Data: How to Verify Before You Respond
On 26 July 2026 a threat actor claimed on a hacker forum to have breached one of South Africa's largest companies. Analysis published the next day found the data was largely developer-portal registrations and recycled records. Breach claims are now a tactic in their own right, and organisations need a disciplined way to test them before they react.
Read article -
Two POPIA Enforcement Actions, One Lesson: Safeguards and Notification Are Not Optional
In the space of five weeks the Information Regulator had an administrative fine confirmed by the High Court and issued an enforcement notice that included a failure to notify under section 22. Neither case involved a sophisticated hacker. Both turned on internal controls that most organisations assume they already have.
Read article -
Shadow AI in South African Organisations: The Audit-First Answer
Most South African organisations have no inventory of which AI tools their employees use, what personal information flows to them, or what the vendor terms grant. POPIA does not let you say 'we did not know.' The honest answer starts with discovery.
Read article -
POPIA Section 71 and Automated Decision-Making: What Counts, What's Required
Section 71 of POPIA is the section that catches AI workflows. It governs decisions made 'solely on the basis of the automated processing of personal information' - and it gives the data subject the right to refuse them. Information Officers in 2026 cannot afford to misread it.
Read article -
The FSCA and SARB Prudential Authority Position on AI in Financial Services
The FSCA and Prudential Authority published their joint position on AI in financial services in November 2025. The signal is principles-based, technology-neutral, and harder to defend against than an EU-style horizontal Act. Here is what South African financial organisations should expect supervisory dialogue to look like in 2026.
Read article -
AI-Augmented Attacks in South Africa: Deepfakes, BEC and Ransomware in 2026
South Africa is the most targeted country in Africa for cyber attacks. In 2026 the attacks are no longer foreign-flavoured templates - they speak SARS, eFiling, and load-shedding. Mid-market organisations need to update their controls or accept the new loss rate.
Read article -
SAHPRA's AI/ML SaMD Framework: What South African Healthcare Organisations Must Know
SAHPRA published one of the more advanced sector AI documents in South Africa in September 2025 - an AI/ML Software-as-a-Medical-Device framework. For healthcare organisations deploying or developing AI-driven clinical decision-support, SaMD classification is no longer optional.
Read article -
The Prudential Authority on Frontier AI: Why Point-in-Time Security Testing Is No Longer Enough
On 24 April 2026 the Prudential Authority told every supervised financial institution that frontier AI compresses the time between a vulnerability being found and being exploited. Its supervisory focus is moving from awareness to execution. Here is what that means for testing, patching and board decision-making, inside and outside financial services.
Read article -
The Land Bank Ransomware Reply: What It Teaches Boards About Internet-Facing Systems
On 4 March 2026 the Minister of Finance confirmed in Parliament that Land Bank was hit by ransomware through a vulnerability on an internet-facing server, and that a separate environment kept its core banking systems out of reach. For regulated mid-market firms, the reply is a rare, first-hand lesson in exposure management and segmentation.
Read article -
POPIA Compliance in 2026: What South African Businesses Must Have in Place
The Information Regulator has ramped up enforcement since 2023. South African businesses handling personal information need documented controls, a designated Information Officer, and a tested breach response process - here's the full picture.
Read article -
CIPC Registration and Cybersecurity: What Companies Must Know
The Companies and Intellectual Property Commission holds sensitive company records for millions of South African entities. Recent CIPC breaches have raised the bar for what regulators expect from registered companies around data and system security.
Read article
Free consultation
Ready to strengthen your security posture?
Book a free consultation with a senior consultant to discuss your cybersecurity posture and next steps.
Or call 012 012 5072 or message us on WhatsApp.
What happens next
- 01You tell us briefly what has landed on your desk.
- 02We respond within one business day to arrange a time.
- 03A 30-minute call with a senior consultant, and an honest view of what to do first.