By: Kgomotso Lebele - Country Managing Director for Accenture, South Africa

South African organisations are facing a growing cybersecurity challenge at a time when artificial intelligence (AI) is accelerating technological change across every sector of the economy. The country was already one of the most targeted cyber environments in Africa before the latest advances in AI. According to industry research, local organisations experienced a sharp increase in cyberattacks during 2025, while cybercrime continues to impose significant financial and operational costs on businesses, government institutions and consumers.

At the same time, AI is changing how cyber threats emerge and evolve. Tasks that once required significant time, specialised skills and large teams can increasingly be performed faster and at greater scale. For organisations that already have security weaknesses, this creates additional pressure to strengthen their cyber resilience. One development that has attracted global attention is Anthropic's latest AI model, Claude Mythos. Earlier this year, the company announced that the model was able to identify hundreds of previously unknown software vulnerabilities across widely used operating systems and browsers, including some that had gone undetected for decades.

While this demonstrates the potential of AI as a defensive tool, it also highlights a broader reality. As advanced AI systems become more accessible, organisations will need to prepare for a future where cyber threats can be identified, developed and executed far more quickly than before. For South African businesses, the concern is not simply the technology itself. It is whether existing security foundations are strong enough to respond to a rapidly changing threat landscape.

Accenture's State of Cybersecurity research found that only 44% of technology leaders in South Africa acknowledge that AI is advancing faster than their organisations' cybersecurity capabilities. Yet assessments conducted across organisations revealed security gaps that could become increasingly difficult to manage as AI capabilities continue to evolve.

Security foundations remain inadequate

Several areas stand out, including cloud security. Many digital transformation and AI initiatives rely heavily on cloud environments. Yet Accenture's research found that only 18% of South African organisations have full visibility into their cloud security configurations, while just 6% have approved security baselines in place. Without strong governance and oversight, cloud platforms can create unnecessary risk exposure.

With regards to data governance, AI systems depend on access to data, making it increasingly important for organisations to understand what information they hold, where it resides and how it is protected. However, only 18% of South African organisations have classified their data according to sensitivity, and just 24% have established clear policies governing AI use. Without these controls, it becomes harder to manage risk and apply appropriate safeguards.

Identity security remains another critical area. Modern organisations must manage access across employees, contractors, third parties, applications and, increasingly, AI agents. Yet only 28% of organisations have adopted a continuous verification approach to access management, while just 8% enforce least-privilege access controls. As digital ecosystems become more complex, identity management is becoming one of the most important components of cybersecurity.

Software development practices also require attention. Only 8% of South African organisations integrate security testing throughout the software development lifecycle rather than treating it as a final step before deployment. As AI accelerates the discovery of vulnerabilities, embedding security from the outset becomes increasingly important.

South Africa has already experienced the consequences of major cyber incidents. The 2021 cyberattack on the state-owned freight company disrupted operations at key ports and affected supply chains across multiple sectors of the economy. The incident demonstrated that cybersecurity is no longer solely a technology concern. It has direct implications for business continuity, economic activity and public confidence.

As AI capabilities continue to mature, the potential impact of cyber incidents may become even more significant. Recent reports suggest that AI is already being used to support activities such as vulnerability discovery, reconnaissance and elements of attack planning. While human oversight remains involved, automation is increasing the speed and scale at which these activities can occur.

This places greater emphasis on preparation.

Organisations should ensure that security is considered at the beginning of digital and AI initiatives rather than after deployment. Cloud governance, data management, identity controls and application security should form part of planning and implementation processes from the start. As AI becomes more embedded across business functions, security can no longer be treated as a separate workstream. It needs to be integrated into decision-making from the outset.

At the same time, businesses should explore how AI can strengthen their own defensive capabilities. AI-powered monitoring, threat detection and vulnerability management tools can help security teams identify risks earlier and respond more effectively. Used responsibly, these capabilities can improve visibility across increasingly complex technology environments and help organisations keep pace with a rapidly evolving threat landscape.

South African organisations have spent years investing in digital capabilities to improve customer experiences, drive innovation and support growth. Those investments will continue to create opportunities, but they also increase the importance of cyber resilience. As AI becomes more embedded in business operations, organisations that strengthen their security foundations and build resilience into their digital strategies will be better positioned to realise the benefits of AI while managing the risks that accompany it.