Tag: cyberrisk

Boards spend a great deal of time asking questions. They challenge strategy, review financial performance, interrogate financial statements and revisit decisions that made sense six months ago but may no longer make sense today. That is why one question stands out: "Why are executives and boards not doing the same when it comes to their cybersecurity?" My view is simple. As organisations become more digital, it becomes increasingly difficult to justify treating cyber resilience as something that sits outside regular business discussions.

The local business news cycle has taken a dark and repetitive turn. Week after week, headlines are dominated by a relentless spike in organisations falling victim to sophisticated hacks, data breaches, and crippling ransomware attacks. From local municipalities to major political parties like the ANC, no sector seems immune.

South African businesses have evolved alongside the reality of the country’s physical infrastructure challenges. Organisations instinctively build redundancies for power. These include solar installations, battery backup solutions, UPS systems and generators. When the grid fails, the failover system kicks in. Similarly, most businesses have multiple connectivity failovers because they understand operational disruption intimately.

Most people understand what it means to protect a human identity. The dangers of someone impersonating you online or stealing and cloning your card are immediately obvious. Today, organisations rely on thousands of non-human identities. These identities belong to software applications, cloud workloads, APIs, bots and now AI agents.

Organisations have spent the last decade strengthening prevention capabilities. They deployed advanced firewalls, endpoint protections, identity controls and AI-powered threat detection. However, even as security stacks grow more sophisticated, a subtle and dangerous gap continues to widen beneath the surface.

Payment Card Industry Data Security Standard (PCI DSS) compliance has often been viewed as a requirement only when circumstances force action. For example, organisations respond after a breach makes headlines or when a bank requests proof. This reactive approach exposes organisations to avoidable risk.

In South Africa, the Protection of Personal Information Act (POPIA) is reshaping how organisations handle personal data, both locally and across borders. For businesses operating internationally, the challenge extends beyond compliance. They must also reconcile POPIA with global standards such as the EU’s General Data Protection Regulation (GDPR).

So, what do most comprehensive cyber insurance policies usually cover? First, they cover the costs of investigating and responding to a breach. Forensic teams do not work for free. You will need them to determine what happened, how severe the breach is and whether the attacker left evidence behind. Understanding these response costs is essential when assessing cyber insurance limits.