Cyber Insight: Before you sign off the 2027 security budget, ask what this year's spend actually changed

Look to Cyber Insight for a security report review.

---

As South African businesses finalise their 2027 budgets, many security conversations will start with the same document: a monthly report full of blocked threats, closed tickets and response times. It shows the team has been busy. It rarely tells management what to do next.

That gap matters more at budget time than at any other point in the year. Executives are being asked to approve renewals, new tools and additional services, often on the strength of reports that describe activity rather than outcomes. The result is familiar: security spend that grows each year without a clear answer to whether the business is actually better protected.

Cyber Insight, the South African cyber security consultancy and Sophos-backed managed security provider, is urging executives to put their security reporting through a simple test before they approve new spend.

"A blocked threat matters. But a long list of blocked threats doesn't tell a client which weaknesses have been fixed or what still needs attention," says Deon Smal, CEO of Cyber Insight. "Before anyone spends another rand, they should know what the last one changed."

1. What actually changed?

Not how much activity there was, but which weaknesses were closed during the period. A report that lists 10 000 blocked events and no closed weaknesses has told you about the threat landscape, not about your protection.

2. Was the fix checked?

Taking action and confirming that it worked are two different steps. Restricting a compromised account is an action. Confirming that the access was actually removed is a separate check, and both should be visible.

3. What is still open, and why?

An open issue isn't a failure. It may be waiting on a business decision, an application change or further investigation. An unexplained open issue, carried quietly from one report to the next, is a risk.

4. Who owns the next step?

Every open issue should name the business service it affects and the person responsible for moving it forward. "Access issue on the customer-ordering system, application owner to review permissions by month-end" is something management can act on. A red score on a dashboard is not.

5. Does the next purchase solve a named problem?

Or could a configuration change, an access clean-up or better use of tools the business already licenses close the gap first?

"If a report can't answer those five questions, it's describing effort, not protection," says Smal.

Consider a typical entry: suspicious activity on an account linked to an important business system, response completed, ticket closed. On paper, the job is done.

A more useful version of the same entry tells management three things. The affected access was restricted. The restriction was checked and confirmed. A review of the account's remaining permissions still needs input from the application owner. One line has become a completed action, a verified result and a clearly owned piece of outstanding work.

Cyber Insight argues that this level of clarity doesn't require longer reports. It requires a different structure: what was observed, what was done, what was verified and what remains open. The detailed technical records still matter, and they stay available for the people who need them. The management summary simply has a different job.

A quiet month isn't proof that every risk has been dealt with, and a busy month isn't proof that the business is better protected. What matters is whether the report makes progress, limits and responsibility visible.

Often the most valuable next step costs less than a new product. Tightening access, correcting a misconfiguration or switching on a capability the business already pays for can close a real gap faster than another tool. Where the evidence does point to a genuine coverage gap, a named problem makes the investment far easier to justify to the board, and far easier to measure afterwards.

"I would rather show a client a clearly explained gap than a reassuring number that hides it," says Smal. "Once we understand the gap, we can agree what to do about it."

Clearer reporting doesn't only help executives. Internal IT teams and managed service providers often struggle to win attention for important fixes because the risk is buried in technical detail or reduced to a colour on a chart.

A specific issue, tied to a named service and a responsible owner, is far easier to explain and prioritise. It gives IT leaders a practical way to show why a change deserves budget and time, and a way to show the board afterwards that the change made a difference.

Cyber Insight's 24/7 security operations team works on Sophos technology, which keeps the context needed to show what was done and what remains. Technology supplies the evidence. Cyber Insight's role is to turn that evidence into clear decisions the business can act on, in language that the boardroom and the IT team both understand.

Cyber Insight recommends three practical steps before the 2027 budget is finalised:

Take your most recent security report and run it through the five questions.

Pick one completed action and one open issue, and check whether someone outside the security team could explain what happened, what it means and what happens next.

Before approving any new security spend, ask which named gap it closes and how you'll know it worked.

For the rest of 2026, Cyber Insight is offering business and IT leaders a free 30-minute security report review. Bring your latest report, and the team will work through the five questions with you. E-mail info@cyberinsight.co.za with the subject "Security review".

Local experts. Global intelligence. Trusted protection.