Five cyber worries keeping South African business owners up at night

Almost every vendor on stage at CyberIsle 2026 had a list of threats. These lists mirrored one another more than some vendors would like to admit.

“Take the logos off the slides, and the message is the same,” says Bennie Barnard, chief commercial officer at NEWORDER, which has its global headquarters in Douglas. “Business owners are worried about five different things, yet attackers predominantly gain access through one. For any business, the key question to ask is not which threat to fear most, but rather whether you could still trade tomorrow if any of them landed today.”

South Africa is more worried than the world

The Allianz Risk Barometer for 2026, which surveys risk managers, brokers and insurers across 97 countries, puts cyber incidents at the top of South Africa’s business risks for the second year running. Of the South African respondents, 48% named it, against 42% globally and up from 44% a year earlier.

The figure that should concern a board more sits directly below it. Business interruption ranks second locally at 40%, 11 points above the global figure of 29%, and up seven points in a year. AI entered the South African top three for the first time, at 30%.

“South African businesses are not mainly afraid of losing data,” says Barnard. “They are afraid of losing the ability to operate. We have had a decade of practice at that with both electricity and infrastructure, yet cyberattacks are now the most likely threat to disrupt trading.”

The five worries

Across the major surveys published this year, five concerns recur.

• Being tricked into paying. The World Economic Forum’s (WEF’s) Global Cybersecurity Outlook 2026 found that chief executives now rank cyber-enabled fraud as their top cyber concern, ahead of ransomware for the first time. Nearly three in four respondents were affected, or knew someone who was, in 2025.
• Not being able to trade. Ransomware, and the outage that follows it, is a key concern behind South Africa’s business interruption score.
• AI turned against the business. The WEF found that the leading AI worry is no longer what attackers can do with it, but staff leaking information through generative AI tools.
• The supplier as the way in. Only 3% of Allianz respondents globally describe their supply chains as very resilient.
• Being held accountable. King V applies to financial years beginning on or after 1 January 2026 and places the governance of data, information and technology with the board. Yet concern about legislation and regulation among South African respondents fell from fifth place to ninth this year. The accountability arrived in the same year the worry about it declined.

Two people, two different threats

The WEF data shows something more uncomfortable. Chief executives and chief information security officers no longer defend against the same threats. Chief executives put fraud first. Security leaders still put ransomware first and supply chain disruption second.

“The person signing the budget and the person spending it are guarding different doors,” says Barnard. “That is not a technology problem. It is a leadership one. Security has to sit in the same room as the business decisions it protects, which is what we mean by Integrated Leadership and Execution.”

Five worries, one door

Underneath the five concerns sits a single pattern. Palo Alto Networks’ Unit 42, reviewing more than 750 incident response engagements, found that identity weaknesses played a material role in nearly 90% of investigations, and that preventable gaps enabled the intrusion in more than 90% of breaches. The culprits were limited visibility, inconsistent controls and too much trust in user accounts, not exotic exploits.

In July, researchers at Sysdig documented what they assess to be the first ransomware operation run end to end by an AI agent, with no human directing each step. It got in through a known flaw in an open-source AI tool that had already been patched. None of its techniques was new.

“That is the story of the year in one incident,” says Barnard. “A new kind of attacker, walking through an old door that somebody forgot to close.”

Do not hand the door to a machine

The same capability is now being sold to South African businesses as a security product. Buyers are being offered fully automated, AI-driven penetration testing as a complete answer, cheaper and continuous.

The research does not support the pitch. In a study published in December 2025 by Stanford, Carnegie Mellon and Gray Swan AI, an AI agent tested a live university network of around 8 000 hosts alongside 10 professional penetration testers. It outperformed nine of them, a genuine result. It also produced more false positives than the humans, struggled with anything that required a graphical interface, and finished second. A person finished first.

“AI is very good at finding things. We use it every day,” says Barnard. “What it doesn’t do, however, is decide which of hundreds of findings actually puts the business out of action, or chain three small weaknesses into the one route an attacker would take.

“Human Validation at Scale means every finding we report has been confirmed by a named operator, and Adversary Path Engineering means we show you the route, not a severity list.”

His advice to any South African business evaluating a provider, NEWORDER included, is to ask two questions before signing. Who is the named person who confirmed this finding? And can you show us the path from the outside of our business to the actual vulnerability that would stop us from trading?

“If the answer to the first question is a product name, you’ve bought a scanner,” he says. “Scanners have their place. Unfortunately, they are not a substitute for a human operative who is able to mimic a malicious actor trying to get in.”

Can you trade on Monday?

South Africa’s 40% business interruption score points to a question most boards have never answered out loud. If an attack landed tonight, what has to be working by Monday for the business to keep earning, and who decides what comes back first?

Barnard’s view is that the answer has to exist before the incident, agreed by the people who will have to live with it, and then tested by someone trying to break it.

“Most recovery plans are written for an auditor,” he says. “They need to be written for the morning after. When the chief executive, the finance director and the security lead have agreed in advance which systems, people and suppliers the business cannot trade without, the first hours of an incident go to recovery instead of argument. That is Speed to Insight on the day it counts. And a plan nobody has attacked is unfortunately only a theory.”

One honest answer

The five worries don’t necessarily need five budgets. They need one honest answer to a simple question: have the basics been tested by someone who tried to break them?

“Can your business afford to be hacked?” Barnard asks. “In South Africa, the answer from the people who measure risk for a living is getting clearer every year. The good news is that attackers mostly use doors you already know about. Find out which of yours are open before someone else does.”

About NEWORDER
NEWORDER Group is a tactical managed cybersecurity company headquartered in Pretoria, South Africa, with its global headquarters in Douglas, Isle of Man. NEWORDER delivers offensive security testing and red team operations, continuous threat exposure management, Executive Cyber Risk Management, digital forensics, round-the-clock incident response and AI security governance. A human operator confirms every finding before it reaches the client. NEWORDER is certified to ISO/IEC 27001 and ISO 9001 and serves clients across Africa, the Middle East and Europe. For more information, visit newordergroup.net.