Tag: dataprotection

October brought a wave of critical security vulnerabilities that tested how rapidly South African companies could respond. On Tuesday 20 October, details of two critical flaws in PHP, a programming language that powers millions of websites and online applications, leaked online before fixes became available. The PHP project issued emergency patches the following day. That same Wednesday, Node.js repaired ten vulnerabilities.

An internal data breach, even an accidental one, can trigger formal breach notification obligations under the Protection of Personal Information Act (POPIA). The Information Regulator recently fined Central Johannesburg TVET College R500,000 for failing to comply with an enforcement notice. This decision shows that organisations must also complete the corrective actions that the Regulator requires.

Every meeting is now recorded and transcribed by an Artificial Intelligence (AI) notetaker, but nobody knows where the files reside or who has copied them. In August 2026, Dark Reading discovered a vulnerability in tl;dv’s backend. It allowed an authenticated user to access meeting information belonging to other customers. The vulnerability put more than 180,000 meeting records across 80,000 or more users at risk.

Many people are familiar with being asked to accept cookies or agree to the collection of their personal information when using online platforms. But what happens when the choice is to either pay for privacy or consent to even more extensive data collection? Should we have to pay money to protect our privacy? Or should we surrender our personal information to use these platforms?

Backup, disaster recovery, and operational resilience are often used interchangeably in boardroom conversations. However, they are three distinct disciplines. Each carries its own risk if organisations leave it unaddressed. Organisations that conflate the three are frequently the ones caught out when ransomware strikes.

Artificial Intelligence (AI) is no longer something financial institutions are preparing for. It is already embedded in how decisions are made, how products are designed and how risk is managed. Whether through fraud detection, algorithmic trading, customer engagement or compliance monitoring, AI is steadily reshaping the financial services sector.

Attackers aren’t breaking in; they’re being invited, and the invitations are being written by the business. The easiest way to install malware on a business network is to persuade someone inside the business to do it. Attackers don’t always need to bypass the firewall or exploit a zero-day vulnerability. Sometimes, all it takes is a convincing email, a moment of misplaced confidence and trust.

In June, Meta experienced a global outage that disrupted Facebook, Instagram and WhatsApp services for users worldwide. The outage left many businesses temporarily unable to connect with customers through some of their most important digital channels. While the disruption was temporary, it highlighted the risks associated with relying too heavily on a single digital platform.

Regulatory compliance in cybersecurity is no longer an administrative chore that organisations can treat as an afterthought. As digital ecosystems expand, threat actors are leveraging automation, Artificial Intelligence (AI)-driven reconnaissance and supply-chain attack vectors. Consequently, governments are moving from advisory guidelines to enforceable directives.

Boards spend a great deal of time asking questions. They challenge strategy, review financial performance, interrogate financial statements and revisit decisions that made sense six months ago but may no longer make sense today. That is why one question stands out: "Why are executives and boards not doing the same when it comes to their cybersecurity?" My view is simple. As organisations become more digital, it becomes increasingly difficult to justify treating cyber resilience as something that sits outside regular business discussions.