Somewhere in your business this week, someone will receive an e-mail that looks entirely legitimate. It will carry a familiar logo, reference a real invoice or a real colleague, and ask for something small and reasonable. And someone will click it.
According to Verizon's Data Breach Investigations Report, the median time between a person opening a phishing e-mail and clicking the link inside it is 21 seconds. No filter, no alert and no analyst gets there first. By the time anything in your security stack knows there is a problem, the decision has already been made by a human being.
That is worth sitting with, because it changes what the problem actually is.
Your tools are doing their job
If you run IT for a South African SME, you have almost certainly done the hard work already. Endpoint protection. Mail filtering. MFA. Backups. Those controls stop the overwhelming majority of what comes at you, quietly, every day.
They were never built to stop the last step. Roughly 95% of South African data breaches involve a human element rather than a system failure, according to CSIR research. Not an unpatched server, but a person, acting in good faith, doing something that looked reasonable at the time.
That is not a criticism of anyone's security stack. It is a description of where the remaining risk sits, and it sits somewhere technology cannot fully reach.
The difference between a tool and a culture
A security tool makes a decision on someone's behalf. A security culture changes the decision they make.
That distinction matters more than it sounds, because it determines what you get for everything else you have already bought. A tool holds a line; a culture moves it, and keeps moving it as attackers change tactics. Every other control in your environment works harder when the person at the end of it hesitates for two seconds before clicking.
The evidence here is unusually good. KnowBe4's 2025 benchmarking report, drawn from 67.7 million simulated phishing tests across more than 62 000 organisations, found that before training, roughly one in three employees clicks a simulated phishing link. After 12 months of continuous training and simulation, fewer than one in twenty do. That is an 86% reduction, and improvement starts showing within the first three months. It is worth noting the figure comes from a training vendor's own dataset. The sample is large enough to take seriously, but treat it as directional rather than a promise.
Where this stops being an IT conversation
For a long time, staff awareness training was something businesses knew they probably should do. That has quietly changed, and not because of the threat statistics.
POPIA Section 19 requires responsible parties to take appropriate, reasonable technical and organisational measures to protect personal information. Organisational measures include staff training. A well-written policy that nobody has been trained on does not demonstrate reasonable steps, and “we did not know” has never been a defence. If a breach happens, what you can document is what you can defend.
For financial institutions it is no longer a matter of interpretation. The FSCA and Prudential Authority's Joint Standard 2 of 2024, effective 1 June 2025, requires a comprehensive cyber security awareness programme at least annually, covering all users and the governing body, reviewed regularly against evolving threats.
Then there is insurance. Cyber insurers have tightened underwriting considerably. Documented training programmes, phishing simulation logs and evidence of measurable risk reduction now appear routinely on questionnaires. Most South African insurers do not publish their full criteria, so it is worth checking your own policy wording, but the direction of travel is clear. Undocumented controls are a risk you carry at claim time, not just at application.
The same evidence is turning up in a third place. Enterprise procurement teams are pushing supply chain security requirements down to their smaller suppliers, and RFPs increasingly include a security questionnaire. If you sell into large organisations, a documented training programme is becoming something you answer for before the commercial conversation even starts.
What it costs to not have this
The average ransomware incident costs a South African business around R19 million once ransom, downtime, remediation and recovery are counted, according to Sophos's 2025 State of Ransomware report for South Africa. For most SMEs that is not a bad quarter; it is the end of the business.
Awareness training costs a fraction of that. The economics are not close.
Why most programmes fail anyway
Most security awareness programmes do not lose momentum because the content is poor. They fail because nobody has time to run them. Scheduling modules, chasing completions, building simulations and pulling reports adds up to three to five hours a month, every month, and it is the first thing to fall off an IT lead's list the moment something breaks.
This is uncomfortable to face but it does account for why a security culture does not take hold in most SMEs. Not indifference. Capacity.
IronTree's Security Awareness Training is available as a fully managed service, which means the company schedules it, runs the simulations, chases the completions and hands you the reporting that your board, your POPIA file and your insurer all want to see. If you would rather know where you stand before committing to anything, start with IronTree's free Phishing Risk Check.
Get your free Phishing Risk Score. Five minutes, no obligation.
Share
Editorial contacts