As CISOs head into their annual budget planning season, many will be looking for more available spend to battle a rapid increase in the scale and sophistication of cyber threats.
Research from Mimecast shows that although security leaders are urgently seeking access to more budget, security effectiveness fell more than 10 points year-over-year, indicating a growing and worrying effectiveness paradox.
The result is greater risk to customer records, source code, financial models and other work that keeps organisations running.
According to data from the 2026 State of Human Risk report, 96% of local security leaders acknowledged they had incomplete protection, and 76% placed the need for increased cyber security staffing and services budget as their top priority.
In fact, 100% of the South African IT and security decision-makers interviewed said they would be looking for more budget to deal with threats. The same dataset showed security effectiveness falling across people, process and technology.
What security leaders are dealing with is not under‑investment, it’s mis‑architected investment.
This is creating cognitive dissonance among security leaders as they ask themselves why their investments aren’t delivering results.
The answer lies in how that investment is being deployed. As organisations continue to add tools, coordination becomes more complex, not less. It is within these gaps that risk accumulates, particularly from malicious insiders, whose activity has surged by 46% over the past two years, according to the report.
This clearly shows leaders that they can't simply buy their way out of a structural problem.
Uncovering the gap
Of particular interest in this year’s report is that malicious insider incidents have risen at exactly the same rate as negligent ones (46% each).
This parity is pointing to an acute structural challenge. You can partially train your way out of negligence, but can’t train your way out of malicious intent. That requires detection infrastructure that's coordinated with human oversight.
What security leaders are dealing with is not under‑investment, it’s mis‑architected investment.
Let’s unpack the problem across the people, process and technology vectors.
How the problem shows up in people
On the human side, risk is highly concentrated but poorly managed. Just 8% of employees account for 80% of incidents, but most organisations fail to translate that insight into differentiated controls for the people and AI agents generating the greatest risk.
While security awareness training and monitoring programmes exist, only 28% of organisations globally meaningfully connect the two. The result is that high-risk behaviours rarely trigger targeted interventions or adaptive controls.
Compounding this, organisations continue to treat ‘the user’ as a single entity, despite clear distinctions between negligent, compromised and malicious actors. This must now be extended to the AI agents users create, which inherit their access and intent, and require the same level of monitoring.
Each requires a different response model, but current behavioural analytics, identity controls and training programmes are typically designed and operated in isolation.
Without orchestration, there is no clear mechanism to determine who should receive which control, when, and based on which risk signals.
How the problem shows up in technology
This fragmentation is mirrored in the technology stack. While 55% of South African security leaders cite integration as too complex, those that succeed see 56% faster remediation and significantly improved visibility.
Unfortunately, most organisations still remain trapped in tool sprawl with multiple point solutions generating fragmented data and disconnected alerts, without a unifying layer to provide context or enable a coordinated, autonomous response.
At the same time, the attack surface has shifted. Threat actors are no longer confined to e-mail and they operate seamlessly across collaboration platforms such as Teams, Slack and Zoom, as well as AI‑driven workflows. Many organisations continue to rely on native, channel-specific controls that were never designed to detect sophisticated, human-targeted attacks.
The result is attackers that simply move laterally between channels, exploiting the gaps between isolated systems, and the blind spots between people, data and AI.
How the problem shows up in process and governance
Process and governance further reinforce this disconnect. About 52% of local organisations lack confidence in their ability to rapidly retrieve communications data for regulatory purposes, while 92% report ongoing governance and compliance challenges.
Monitoring, policy enforcement and incident response remain heavily manual, creating bottlenecks as data volumes increase.
More critically, governance frameworks fail to close the loop between human behaviour, policy breaches and technical enforcement. Risk signals (such as repeated data mishandling or anomalous behaviour), are often identified, but not systematically translated into access restrictions, targeted training, or executive escalation. This is not a tooling failure, but a design failure.
Taken together, these structural gaps help explain a broader and more concerning trend which is that as organisations add more tools, insider risk increases. Each new system introduces additional complexity, new data silos and more operational overhead.
Without an integrated strategy that secures humans, data and AI as one risk surface, security teams become overwhelmed, signals are missed, and attackers, particularly malicious insiders, exploit the inconsistencies.
In short, we don’t see the reported increase in malicious insider threats as an anomaly. It is a predictable outcome of a security model that remains fragmented, reactive and insufficiently aligned around human risk and the work it is meant to protect.
Unless there is an intervention at a structural level, the effectiveness paradox will continue to grow, with more organisations seeing their most valuable work leave the building.
Share
