An urgent payment request arrives from an executive. A supplier e-mails new banking details. An employee receives an unexpected sign-in notification while working towards a deadline.
These may appear to be ordinary workplace moments, but each can expose an organisation to financial loss, data compromise or operational disruption. The vulnerability may lie not only in the technology, but in an approval that is bypassed, an identity that is not verified or access that remains active longer than necessary.
South African organisations experienced an average of 2 065 cyber attacks per organisation per week in June 2026, according to Check Point Research figures reported by ITWeb. The scale of this activity reinforces the need to treat cyber security as an operational priority, not only an IT responsibility.
Cybersecurity Awareness Month gives leaders an opportunity to ask a practical question: Do our processes help people make secure decisions under everyday working pressure?
Build verification into the workflow
Phishing and impersonation exploit the trust that keeps businesses running. Employees respond to managers, finance teams act on supplier instructions and service teams exchange sensitive information with clients.
Attackers use urgency, authority and familiarity to make an unsafe action appear routine. Verification should therefore be built into the process rather than left to an employee's judgment at the moment of risk.
A request to change a supplier's banking details, for example, should automatically trigger an independent check using established contact information – not the contact details supplied in the request. An unusual executive instruction should receive the same scrutiny as any other exception, regardless of the sender's seniority or the apparent urgency.
"Cyber security cannot be added at the end of a process and expected to correct weaknesses that are already built into the way work gets done. When organisations redesign workflows or introduce automation, they need to identify where trust is being assumed, where decisions can bypass approval and where accountability may become unclear. The objective is not to slow the business down, but to design controls that allow it to move quickly and securely," says Thabo Rapodile, Business Executive for Tech Enablement at SoluGrowth.
This means placing the right control at the point where risk arises. High-risk actions may require stronger identity checks, separation of duties, automated approval rules or alerts when an instruction falls outside normal patterns. Well-designed controls should make the secure action the easiest and most natural action to take.
Design automation around control, not speed alone
Automation can improve efficiency and consistency, but it can also amplify weaknesses. If an unreliable process is automated without first being reviewed, the organisation may simply execute unsafe actions faster and at greater scale.
Leaders should consider what a system is permitted to do, what evidence is required before it acts and when a human decision is necessary. They should also establish who owns the outcome when a task passes between employees, automated workflows and third-party platforms.
"Technology enablement is not simply about digitising an existing sequence of tasks. It is an opportunity to redesign the process so that verification, approval and traceability happen by default. Every automated workflow should answer three questions: who initiated the action, who or what authorised it, and can the organisation reconstruct what happened afterwards? If those answers are unclear, the process is not ready to be automated," Rapodile adds.
Make ownership and reporting clear
Technical controls such as multi-factor authentication, appropriate access permissions, software updates and monitoring remain essential. However, they require clear ownership and a co-ordinated response when something goes wrong.
Employees should know where to report suspicious activity and what to do if they have already clicked a link, shared information or approved an unusual request. Reporting should be simple, immediate and free from blame. Managers should actively welcome verification, including when their own instructions are being questioned.
"Cyber security awareness only creates value when employees know how to act and the organisation is structured to respond. Reporting channels, access governance, monitoring and recovery planning cannot operate in silos; they form part of the same organisational resilience capability," says Sakhiwo Ngobese, Chief Information Officer at SoluGrowth.
Training should reflect employees' responsibilities and the risks they encounter. Finance teams need clear payment verification procedures. HR teams need practical rules for handling employee information. Client-facing teams need guidance on sharing documents, granting access and protecting confidential information.
Extend controls across delivery partners
For organisations considering outsourcing, data security and management oversight are significant concerns, particularly where sensitive financial, employee or client information is involved.
Delivery arrangements should clearly define how information is protected, who may authorise access, how activity is monitored and how incidents are escalated. Access should be limited to what each role requires and removed promptly when a person's responsibilities or employment status change.
Clear governance gives clients visibility and accountability as work moves between their organisation, service providers and technology platforms. It also ensures that security responsibilities do not become blurred at organisational boundaries.
The same principles apply to automation and artificial intelligence. Increasing speed or capacity without preserving verification, traceability and human accountability can magnify an existing weakness.
SoluGrowth's process-led, technology-enabled approach brings together process improvement, governance and operational delivery. The company helps organisations examine critical workflows, strengthen controls and use technology to improve accountability, resilience and business performance.
Turn awareness into action
Organisations can begin with one sensitive workflow, such as payment authorisation, supplier detail changes or system access provisioning. Map the process from the original request to final execution and ask:
- Where could an unauthorised or fraudulent request succeed?
- Which assumptions are being made about identity, authority or information?
- Who owns verification, approval and escalation at each stage?
- What evidence is retained to support monitoring and investigation?
- How quickly can inappropriate access or an unsafe action be stopped?
"Cyber resilience improves when organisations translate awareness into process design. The most effective control is one that operates consistently during the normal course of work – especially when people are busy, under pressure or dealing with an unusual request. Secure behaviour should not depend on someone remembering an extra step, it should be supported by the workflow itself," Rapodile concludes.
Progress should be visible in the way work gets done: unusual instructions are checked, sensitive actions require appropriate approval, unnecessary access is removed and concerns reach the right people promptly.
For organisations reviewing their critical processes, SoluGrowth's Tech Enablement and Operations teams can help identify where stronger controls, appropriate automation and clearer ownership could support more secure and efficient delivery.
Share
