Yaron Assabi | CEO | Founder | Digital Solutions Group (DSG) | mail me |
A cyberattack does not end when malicious activity has been contained. For the affected business, that is usually when the most expensive phase begins.
When an attacker breaches a system, the problem quickly extends beyond IT. Systems may go offline while staff try to keep the business running. Customers demand answers, and the business may need to meet regulatory obligations. All these activities cost money, often when revenue is already under pressure.
INTERPOL’s 2025 Africa Cyberthreat Assessment recorded 17,849 ransomware detections in South Africa during 2024. This was the highest number among the African countries included in its assessment. Meanwhile, IBM put the average cost of a South African data breach at R44.1 million in 2025.
Prepared for the attack, less prepared for the aftermath
South African businesses have spent years improving prevention. Endpoint protection, stronger access controls, employee awareness, backups and security monitoring are now familiar parts of the conversation. These measures remain essential. However, no credible security programme can guarantee that it will stop every attack.
The bigger test is whether a business can continue operating while recovery takes place. Cohesity’s September 2026 Global Cyber Resilience Report found that 78% of surveyed organisations prioritised restoring systems over maintaining business operations. Only 22% had tested how they would maintain critical operations during recovery.
Bitdefender telemetry from July 2026 illustrates the concentration of local threat activity. Of more than 9.09 million Africa-targeted email threats captured over the preceding 30 days, 98.95% landed in South Africa.
Detection volume does not equate to a successful breach. Nevertheless, it highlights the pressure businesses face. Financial preparedness remains a separate consideration from having controls designed to prevent attacks. Therefore, addressing financial exposure must complement technical security measures.
Making sense of the insurance gap
Santam’s 2025 Insurance Barometer found that eight in 10 commercial respondents had introduced additional cyber risk protections. Yet only 17% had purchased cyber insurance. Many businesses are investing in measures that reduce the likelihood and severity of an incident. However, they continue to retain much of the financial exposure themselves.
This contrast is significant. Businesses may reduce the likelihood and severity of an incident while remaining financially exposed to its consequences. If recovery takes several days, the business must absorb any uninsured costs itself.
Cyber insurance should form part of a business’s security and continuity planning. Depending on the policy, cover can help with incident response, recovery expenses, downtime, and financial losses following events such as ransomware attacks, data breaches, or digital fraud.
However, businesses must understand their coverage before an incident occurs. Addressing financial exposure requires more than purchasing a policy. It also involves assessing potential losses, understanding policy limitations, and identifying costs the business would still need to fund.
Know what the business can carry
Boards need a clear answer to one question: if a successful attack occurred tomorrow, what would the business have to fund itself?
Answering this question requires businesses to understand how long critical operations could continue. They must also assess how several days of disruption would affect cash flow. In addition, they need to establish where their insurance would respond and where the company would remain exposed.
We increasingly treat cyber defence and risk transfer as part of a single resilience strategy. Digital Resilience provides round-the-clock security operations, threat detection, testing and governance capabilities.
Together, these capabilities help businesses strengthen their defences and prepare for the financial consequences of a successful attack. Addressing financial exposure alongside operational resilience enables organisations to understand their potential losses and plan for the costs they may need to absorb.
Ultimately, the goal is to make a successful breach less likely while preparing the business for the financial and operational shock if an attacker gets through.
