South African organisations should adopt and enforce an executive-level resilience mandate to defend against agentic AI-powered ransomware, fraud and phishing, according to cyber security and technology professionals.
Andre den Hond, solutions architect at Arctic Wolf, says AI is reshaping an already sophisticated threat landscape.
"AI is accelerating cyber risk. We've already seen ransomware evolve from manual attacks to scripted automation and then to ransomware as a service. Agentic operations are the next phase of that evolution."
He says autonomous AI-driven orchestration has been demonstrated as feasible in real-world attacks, but it is not yet the dominant model for ransomware operations.
Traditional ransomware attacks rely on sequential, human-led operations, while agentic attacks can operate autonomously at machine speed.
"Humans get tired. Machines don't," warns Den Hond, who says AI agents could reduce the skill and effort required, allowing one operator to supervise multiple campaigns.
"There will most certainly be more attacks. The reason is cost. A ransomware attack no longer requires skilled operators, time, co-ordination and supervision," he explains.
Den Hond says South African organisations may underestimate the threat.
"I don't think companies in South Africa have fully realised just how impactful this could potentially be for them."
He says cyber crime does not discriminate. "It doesn't care where you live, what industry you're in or how big your organisation is."
Den Hond says defenders must match attackers' speed as exploitation windows shrink.
"Cyber attacks are becoming increasingly automated, and the time from vulnerability identification to exploitation is shrinking drastically. Security teams will get to a point where they simply cannot patch vulnerabilities fast enough."
Organisations should therefore prioritise remediation based on actual exposure, business and user context, and exploitability.
Business continuity
Richard Ford, group CTO at Integrity360, says while business leaders continue to question whether their organisations are secure enough, the more relevant question is whether the business can still operate when security fails.
“In a threat environment shaped by ransomware as a service, AI-assisted social engineering and machine-speed vulnerability discovery, prevention has a ceiling. Sooner or later, something will get through, which means recovery time is both a strategic number and a competitive one,” says Ford.
Boards are increasingly prioritising recovery speed over the height of the firewall as organisations build cyber resilience.
“Organisations are building operational muscle memory around the assumption that infrastructure can go down, but life must still carry on,” says Ford.
Integrity360 cites the World Economic Forum’s Global Cybersecurity Outlook 2026, which notes that ransomware remains the primary concern for CISOs, while cyber-enabled fraud and phishing have become the leading concerns for CEOs.
Ford says organisations must distinguish between having backups and having the ability to recover.
“Backups are still vital, but the presence of a backup is not the same as recovery capability. Boards need to know whether backups are protected, whether identity systems can be restored, whether clean environments are available and whether the organisation has actually tested the sequence of recovery under pressure,” he says.
He says while a “chief resilience officer” may not exist in every organisation, an executive-level resilience mandate should exist. Whether responsibility sits with the COO, CIO, CISO or another senior leader, ownership is what matters.
“The spirit of being a figurative defence minister is what needs to be instilled in the roles.”
Under SA’s POPI Act, responsible parties must notify the Information Regulator and affected data subjects where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person.
“If recovery is everyone’s responsibility in theory, it often becomes nobody’s responsibility in practice. A named owner gives the board a line of sight across the full life cycle: detect, respond, contain, recover, communicate and learn,” says Ford.
Integrity360 says the business case for resilience is particularly strong in SA, where organisations face tight margins, stretched skills and costly downtime.
“Resilience means accepting that cyber incidents are business events. It requires tested incident response plans, clear escalation routes, defined communication protocols, measurable recovery time objectives and visibility of the systems that matter most,” Ford adds.
“The maturity marker for boards should encompass how much the organisation spends on defence, but equally important is whether it has named an owner for recovery and tested how fast that recovery actually happens.”
Share
