Lucas Molefe | Cybersecurity Expert | ESET Southern Africa | mail me |
The enterprise Goliath is worried about its suppliers. These Small and Medium-sized Enterprises (SMEs) are underprepared. They are also disproportionately targeted.
In fact, 43% of cyber-attacks target their digital front door. In addition, the Protection of Personal Information Act (POPIA) holds large organisations legally responsible when a supplier is breached. As a result, SME suppliers now represent one of the most important entry points in the corporate supply chain.
This creates a growing concentration of risk. It is also becoming increasingly expensive and difficult to manage. The concept of turning SMEs into secure assets becomes central to this discussion.
SMEs as trusted assets
The small accounting firm, the logistics provider, and the IT support company do not usually see themselves as cybersecurity targets. However, this perception is precisely what makes them attractive to attackers. At the same time, it makes them less attractive to enterprises.
There is also a growing body of evidence that links suppliers to major data breaches. In 2025, 17% of breach incidents resulted from third-party vendor and supply chain compromise. The average cost reached R29.6 million. In South Africa, the average breach cost is around R44.1 million, according to IBM.
Although this figure dropped from R53.1 million in 2024, it still represents a significant financial burden. It is often driven by poorly secured third-party suppliers. The Information Regulator of South Africa adds further context. In its 2025/26 Strategic Plan, it reports 1,727 security compromise notifications in 2024/25. It also expects nearly 2,500 breach reports in 2025/26.
Legal exposure and supply chain liability
There is also a significant legal risk tied to breaches. Under POPIA Sections 21 and 22, the responsible party carries full liability. This applies even when the breach originates in the supply chain. The enterprise, therefore, absorbs legal and financial exposure that it cannot fully control. This reality pushes organisations to tighten supplier evaluation processes. As a result, cybersecurity posture has become a procurement requirement. In this context, turning SMEs into secure assets is no longer optional. It is a commercial necessity for enterprise resilience.
For SMEs, the message is direct. They must demonstrate security maturity. They must also show POPIA compliance during audits or tenders. Otherwise, they risk non-renewal of contracts. This dynamic reinforces turning SMEs into secure assets as a baseline expectation in enterprise engagement.
This shift reframes cybersecurity for SMEs. It is no longer a cost to minimise or delay. Instead, it has become a credential for market access. It also determines whether SMEs retain enterprise contracts. The cost of being the weakest link is simply too high. Therefore, turning SMEs into secure assets becomes a competitive requirement rather than a technical preference.
Security as trust and commercial positioning
The traditional SME mindset often treats cybersecurity as an overhead. However, this approach now creates a commercial disadvantage. In contrast, a strong security posture improves procurement outcomes.
For example, SMEs that demonstrate POPIA compliance, endpoint protection, incident response readiness, and staff training gain a clear advantage. They move ahead of competitors who still ignore security as a priority.
Compliance now signals trustworthiness. When SMEs close security gaps, they protect their own operations. At the same time, they position themselves as lower-risk partners for enterprise buyers. These buyers actively seek to reduce systemic exposure across their supply chains. However, security investment must also support resilience.
No system guarantees full protection from attacks. Therefore, SMEs must ensure they can contain incidents. They must also restore operations quickly. In addition, they must maintain continuity with minimal losses. In this model, turning SMEs into secure assets strengthens both trust and operational stability.
In conclusion
For constrained SMEs, security requires a layered approach. It must also follow a sequential structure. Endpoint protection forms the technical foundation. Cybersecurity training strengthens human awareness. This is especially important for finance and operations teams exposed to phishing and fraud. Business continuity planning adds operational resilience. In addition, tested and verified backups reduce ransomware leverage.
Documented POPIA compliance further strengthens accountability. It also converts the business into a visible and auditable asset. Across these layers, turning SMEs into secure assets becomes a practical implementation goal rather than a conceptual idea.
Security costs money. It also affects the bottom line. However, the real question is not affordability. Instead, SMEs must ask whether they can afford the absence of security. In today’s environment, turning SMEs into secure assets defines survival within enterprise supply chains.
