South Africa needs a national strategy for guarding against serious cyber attacks
In an era where borders are no longer physical, South Africa is being drawn into a new kind of conflict, one fought not with tanks and missiles, but with lines of code and silent intrusions. Local municipalities, national ministries and government systems are under relentless attack. The digital battlefield is here and cyber space has become the next frontier of conflict.
Defending the state must start with its digital infrastructure. It’s no longer enough to simply digitise government services – we must protect them with the same strategy, resources and urgency we would devote to any vital organ of the state.
This is a call to action. Cyber security must be elevated to a national priority, placed firmly at the top of the public policy agenda and backed by skilled professionals, enforceable standards and political will. Without this, every investment in digital public services risks collapse under the weight of a single, well-executed breach.
Recent events have highlighted the growing urgency of the issue. Over the past three years, ransomware attacks have disrupted government departments and affected the delivery of some public services. In some cases, hackers stole terabytes of sensitive data. Artificial Intelligence has been used to spread misinformation and undermine state sovereignty. These are not isolated incidents. They are signs of a system under siege.
High risk
The global context only sharpens the concern. South Africa now experiences more cyber attacks than any other country in Africa. According to global cyber-security firms, South Africa ranks among the top three countries in the world for ransomware victimisation.
At the same time, public sector systems remain deeply vulnerable. A 2023 audit by the Auditor-General found that 70% of national and provincial departments had serious cyber-security control weaknesses. Many lacked the basics – strong access controls, regular software patching and encrypted storage. In some cases, the same vulnerabilities flagged by internal audits were later exploited by attackers.
There is a broader danger here. As South Africa’s digital footprint expands from smart cities to e-health to online court systems, the potential attack surface grows. Each new online service, if not properly secured, is another entry point for hostile actors. And these actors are not always anonymous cyber criminals looking for ransom.
South Africa cannot afford to be naïve. It is a member of BRICS, a strategic player on the continent and a country with sophisticated banking, transport and energy infrastructure. Yet, the current approach to cyber resilience remains fragmented. Responsibility is dispersed across multiple departments and agencies. The national cyber-security strategy remains unpublished. And while the Cybercrimes Act of 2020 was a major milestone, its enforcement has been uneven and its reach incomplete.
Come up with a plan
What needs to change is clear. First, South Africa must finalise and implement a comprehensive national cyber-security strategy, one that sets minimum security standards for every government department and entity.
Second, we need to professionalise the state’s cyber capability. That means hiring, training and retaining skilled cyber-security personnel at all levels of government. Third, we must modernise government IT systems, many of which still run on outdated software that is inherently vulnerable. And finally, we need a co-ordinated structure for cyber defence, a central body empowered to set policy, respond to incidents and share threat intelligence in real time.
This is not only a technical project, but also a matter of national resilience. In the same way we think about water security, energy security and fiscal sustainability, we must think about digital sovereignty. Public trust in e-government systems hinges on confidence that their data is protected, their services are uninterrupted and their state is in control.
Companies need to bring global experience in public sector cyber-security transformation, local insights into South Africa’s unique governance landscape and innovative capability in secure digital infrastructure.
New landscape
Governments must assess their cyber maturity, develop strategy, modernise systems and build resilience from the ground up. The work requires designing and implementing national incident response frameworks and embedding zero-trust architecture across government entities. Sustainable internal capability is required.
The answer lies in creating cyber-secure ecosystems, not just point solutions, and doing so with urgency, discipline and foresight. The window for preparation is closing. Cyber threats do not announce themselves with sirens. They enter silently, exploit the smallest crack and often go unnoticed until the damage is done. The question for government is not whether the next major attack will come, but whether South Africa will be ready when it does. We need to choose to fortify the state in this new theatre of conflict. In cyber space, sovereignty is defended in code and the time to defend it is now.
Text | Gugu Nyanda
Photography | Hakinmhan
Gugu Nyanda is Health & Public Service lead for Accenture, Africa. For more information, go to accenture.com.
