The cyber security threat landscape is evolving rapidly, and security leaders must stay ahead to keep their organisations resilient. At the ITWeb Security Summit 2026, ITWeb TV spoke to several cyber and technology leaders about the realities of the job.
Alisha Sarabjeeth, head of information security at Mr Price Group, spoke about the pace of change and the challenges it creates for the CISO's role. “Everyone has to adapt to the evolution, the pace and the sophistication – you either adapt or die,” she said.
Galeboe Mogotsi, CIO of the Central University of Technology and former CISO of Wits University, stressed the importance of ensuring that an organisation's most senior leadership – whether the boardroom or university council – accurately understands the fundamentals of cyber security. He said the questions that councils typically ask revolve around the organisation's risk posture and how to mitigate it.
Dr Maiendra Moodley, senior analyst at Wikistrat, pointed to an emerging trend, both locally and internationally, that he said illustrates how a lack of clarity at the top is affecting cyber security management. He noted that organisations which have not clearly defined their security objectives often create roles with inflated titles – appending "chief" and "officer" to any number of words – without a clear sense of what those roles are meant to achieve.
This, he said, has led to a proliferation of C-level cyber roles beyond the CISO
, including chief privacy officer and chief trust officer. But it does little to address the underlying problem.
“Instead of actually identifying what it is we are trying to secure, we have a proliferation of chiefs," he said
, adding that this results in a "diffusion of budget, diffusion of focus and a proliferation of committees."
Moodley said that while these committees create the impression of governance, they ultimately add complexity without bringing clarity or coherence to the organisation's security efforts.
Kerissa Varma, president of Women in Cybersecurity Southern Africa, said a key part of the cyber leader's role is championing security and educating staff at all levels – including leadership.
She said education often begins with one-on-one conversations, citing her own experience of meeting quarterly with her CFO for a year. "The conversation has gone from me asking for money to the CFO saying, ‘do you have enough money now?’ because he understands the context of the risk in which we are operating.”
For Dr Sylvia Sathegke, CIO of the National Health Laboratory Services, cyber leadership is about communicating that everyone has a role to play. “Cyber security is a team sport," she said. "If people understand where they fit in the value chain towards the goal, it works better.”
Asked what keeps her awake at night, Sathegke said it is the reality that a breach is possible despite the best efforts. “Are we resilient enough to know what to do next? Do we understand our crown jewels? Do we know what to run for first? And what do we protect to keep continuity and keep the business going? Yes, we are protected, we have controls in place, we have tech in place, but we are not immune.”
On the leading threats, a common concern was third-party risk. Mogotsi cited a breach of Canvas, a learning management system, that affected higher education institutions earlier this year. “It's always about third-party risk," he said. "We are dependent on SaaS platforms as we move our workloads to the cloud, and we thought we were going to be on-point when it comes to resilience. But we’re seeing now that cloud platforms are being breached and that then comes back to us.”
Another area of concern is the impact of AI. Sarabjeeth said organisations must consider the technology's implications from multiple angles. “There’s a lot to consider from an ethics perspective, a governance perspective and a risk perspective,” she said.
Dr Stanley Mpofu, CIO at Wits University, offered a perspective on AI and security within higher education. He said the primary concern is balancing data and security. “We know that students want to break the rules and do what they want to do, which is part of the learning process, but the important thing is to ensure that it takes place within a controlled, regulated environment.”
Share
