President Cyril Ramaphosa admitted that linking corruption-accused former president Jacob Zuma's alleged armed spy army to the deadly unrest that engulfed KwaZulu-Natal and Gauteng last month was not unreasonable.

Ramaphosa resumed his testimony before the Zondo Commission on Thursday, where evidence leader Paul Pretorius probed him on the longstanding mis-governance and criminality at the State Security Agency (SSA).

Pretorius said a list of operatives in Zuma's presidential protection spy army and evidence that they had arms, were "under lock and key" before the unrest broke out.

"It would be very sad indeed had those activities had a relationship to what happened in July. And it is not unreasonable to suspect that it is a matter that should be investigated," Pretorius said.  

Ramaphosa replied: "It is a proposition and not unreasonable. And may I add, it is part of the investigation that is under way because all these things need to be gone into, and as Mr Pretorius correctly says, it's about the security of the people of our country.

"There was a lapse, and we now need to investigate, and we need to find out how it happened and how it manifested itself from a certain beginning right up until what happened in July."

Pretorius then took Ramaphosa on about his publicly maligned characterisation of state capture events as "lapses".

He said what happened at the SSA was "hardly a lapse".

"The events of the State Security saga from 2007 to now, could hardly be termed a lapse. They were a concerted exercise of state governance and executive control. These weren't mistakes. These weren't slip-ups. Minister Dlodlo didn't arrive one morning and say: 'Oops, forgot to do this, or I made a mistake here'. This was a deliberate pattern of mis-government, which has possible had the most serious consequences for our state."

Ramaphosa didn't respond to this directly.

"I think if we look at it broadly, from the time that you have alluded to, 2007, that was the time when not only the incapability of the state was initiated, it also mutated into state capture, which we are dealing with now. All these things are a consequence of either the deliberate incapability of the state or state capture itself. So, an accumulation of all this has resulted in the challenges that we face now.

"But the fortunate part, chairperson, and I keep repeating this, is that we've got your commission, we've got a whole number of other processes that have been embarked upon and have unravelled all these things, and we would be remiss if in our work we do not deal with what is clearly apparent as mis-governance, as Mr Pretorius says, the capture of the state, the malfeasance and the fraud and corruption. We are determined to deal with all those things. We just went into an abyss, and we are clawing our way back to the top, and we are determined to succeed. And we will succeed."

The issue of what intelligence was available in the run-up to the unrest - which Ramaphosa called a "failed insurrection" - remains controversial and still left many unanswered questions.

Last week, Ramaphosa reshuffled his Cabinet and moved Ayanda Dlodlo out of the State Security portfolio, which he brought under the Presidency.

During Pretorius's questioning on the matter, Pretorius said it doesn't take a rocket scientist to see something was seriously wrong at the SSA. He asked Ramaphosa when he became aware of this. 

Ramaphosa didn't answer directly, but said that motivated him to bring the SSA into the Presidency.

He said he took the SSA under his control because it was "an asset of our nation", and it mustn't be seen to be serving factional interests. He didn't rule out the possibility that the SSA would be taken out of the control of the Presidency in the future.

Ramaphosa's testimony was expected to continue on Thursday afternoon.