South African organisations must intensify cyber security and AI training and strengthen collaboration between education institutions and industry to address critical technology skills shortages, cyber security professionals and educators say.
A 2024 CSIR survey found that 63% of cyber security positions in South African organisations were partially or fully unfilled. More than a third of applicants had less than 25% of the qualifications required for the positions they applied for, while only 4% had 75% to 100% of the required qualifications.
ISACA’s 2025 State of Cybersecurity report found that 65% of organisations had unfilled cyber security positions, while 70% expected demand for technical cyber security professionals to increase over the following year.
Eniola Lisoyi, head of the department of networks, maths and systems engineering at private higher education institution Richfield, says the skills shortage concerns not only the number of people entering the field, but also whether they have the technical knowledge and practical skills employers require.
“This requirement is becoming more important as AI reshapes the threat landscape with increasingly legitimate messaging and more sophisticated methods of breaching security measures. Cyber security professionals need to stay ahead of the curve when it comes to understanding how AI-enabled attacks work as well as how AI-supported technologies can be used to identify and respond to them,” says Lisoyi.
According to INTERPOL's African Cyberthreat Assessment Report 2026, AI was linked to more than half of the cyber crime cases recorded in Africa in 2025. Southern Africa was the continent's most targeted region, accounting for 92% of Africa's ransomware detections and 70% of business e-mail compromise detections.
Riaz Moola, founder and CEO of HyperionDev, says AI is making attacks more convincing and easier to scale, exposing employees beyond IT departments to threats involving payments, passwords and access permissions.
"Attackers have adopted AI faster than most organisations have learned to recognise it," says Moola. "A phishing e-mail used to give itself away with poor spelling or a generic greeting. AI can now produce something that mentions your manager by name and the invoice you're expecting this week. Some of the warning signs staff were trained to look for are disappearing."
Training should extend beyond security teams to finance, executives and their assistants, human resources and recruitment, customer service and call centre staff, and legal and compliance teams, Moola says.
"Many of these attacks depend on someone being persuaded to act," he says. "A once-a-year awareness session doesn't prepare people for increasingly convincing, role-specific attacks. Finance, HR and customer service teams need to understand what an AI-enabled attack looks like in the context of their own work."
AI-driven malicious breach
Allan Juma, lead cyber security engineer at ESET, cites the IBM 2026 Cost of a Data Breach Report, which notes that AI-driven attacks have increased by 56% year on year, with one in four organisations suffering an AI-driven malicious breach.
Juma says the Microsoft State of the SOC 2026 study highlights the resulting volume of alerts: 46% are false positives, 42% are not investigated, and 59% of tools push data to the SIEM, leaving security operations centres (SOCs) to manage data manually with limited visibility.
Automation and managed detection and response (MDR) are increasingly necessary. Skills shortages compound the problem, Juma adds. The 2025 ISC2 Cybersecurity Workforce Study found that 59% of respondents reported team skills shortages, up from 44% in 2024. Traditional detection alone is insufficient; SOCs must prioritise threats according to asset criticality, identity privileges, live threat intelligence and operational impact.
“AI-native detection reduces noise by correlating events and suppressing low-value alerts, allowing analysts to focus on genuine threats," says Juma. "Extended detection and response combines endpoint and identity telemetry into coherent incidents, while MDR provides automation to contain threats, isolate devices and reduce workloads without removing humans from critical decisions. Automation must reflect business context, with escalation paths, workload thresholds and accountability established beforehand."
Zuleika Pinda, head of recruitment and talent sourcing at Paracon by Adcorp, says cyber security now requires expertise in cloud security, identity and access management, security operations, threat intelligence, incident response, security engineering and governance.
“This makes the traditional approach to cyber security recruitment increasingly difficult," she says. "Organisations cannot always wait for candidates who already have every technical skill required for a role, particularly when these skills are in high demand and the technology itself continues to evolve. However, when employers prioritise experienced professionals who understand legacy systems and can adapt to new technologies, this approach risks overlooking younger candidates with strong learning agility who can be upskilled.”
She says younger professionals are entering a field with rapidly expanding opportunities but are often looking for more than a job title. Exposure to emerging technologies, chances to develop specialist expertise and visible career progression influence where they choose to build their careers.
Pinda says sustainable skills development requires existing employees to upskill and emerging professionals to gain practical experience through training, certification, learnerships, internships and structured development programmes.
“Technical qualifications can provide a foundation, but practical exposure is equally valuable in a field where the ability to apply knowledge in a live environment is as important as knowing the theory," she says.
Lisoyi cites 2025 research by the South African Graduate Employers Association, which found that employers value resilience, communication skills and a willingness to keep learning alongside technical literacy.
“For cyber security in particular, the ability to keep learning is critical," he says. "The technologies being protected are changing, the methods used to attack them are evolving, and the skills required to defend them cannot remain static. A qualification provides an important foundation, but it cannot be the endpoint of professional development.”
Lisoyi says closer collaboration between tertiary institutions and industry is essential.
“Work-integrated learning, internships, supervised projects and mentorships can give students exposure to the realities of cyber security operations before they enter full-time employment.”
He notes that in March 2026, the Department of Higher Education and Training announced a partnership with Google that includes 5 000 Career Certificate scholarships in AI, cyber security and data analytics. Universities and technical and vocational education and training (TVET) colleges should strengthen practical AI and cyber security training through industry partnerships, internships, simulated cyber attack environments and real-world projects.
"Every AI tool that helps defenders is also available to attackers," adds Moola. "Start with the teams that handle money, people and customer data. That's where attackers are starting too."
Linda Saunders, country manager and senior director of solution engineering for Africa at Salesforce, says South African businesses are ready for AI, but specialist skills remain scarce.
“The enthusiasm is there, but the depth of broadly accessible specialist skills isn't there yet," she says. "Demand for advanced AI skills is growing faster than the capability available to deliver at scale, and those skills are scarce across the country and the continent. The gap is not about interest. It is about moving agents from pilot to production with confidence. As agents move from pilot to production, the constraint is increasingly people who can design, govern and scale them.”
Mohammed Pochee, cyber security product manager at Vox, says a persistent vulnerability gap exists between implementing security tools and believing a company is rigorously protected.
“Firewalls, anti-virus, endpoint solutions and multi-factor authentication tools sit at the heart of most cyber security systems. They have been built to stop known threats, but modern attacks aren’t approaching the business in the same way, and as companies invest, security keeps falling behind," he says. "According to Expert Insights, there is still a persistent gap between investment in tech and the outcomes it provides, with 63% of those surveyed experiencing a breach in the past year.”
Pochee says attackers are not breaking in but logging in using stolen credentials, acting like employees and moving through systems with relative ease. “The security systems put in place to detect anomalous behaviour aren’t flagging this activity because they can’t see anything wrong."
He cites the Mandiant M-Trends 2026 report, which puts the median dwell time for cyber-espionage groups at more than 122 days. It also found that 45% of business vulnerabilities are never addressed, while those that are addressed take 74 days to repair. The time between a breach and ransomware deployment has fallen from eight hours in 2022 to 22 seconds.
“What’s making this even harder to manage and detect is the technology behind the attacks," says Pochee. "Most cyber criminals are using AI to adapt, personalise and hide inside normal activity, and older defences aren’t built to detect these threats. AI-powered attacks need to be met with AI-powered defences.”
Share
