Risk managers in South Africa assess cyber incidents and business disruptions to be significantly higher than the global average. Benny Barnard from NEWORDER, returning from the CyberIsle 2026 conference on the Isle of Man, notes that five main concerns of business owners share a common root cause, and warns that handing over decisions to an AI-based automated tester leaves vulnerabilities unaddressed.
Most participants at the CyberIsle 2026 exhibition presented threat lists that largely overlapped. Benny Barnard, Commercial Director at NEWORDER, whose global headquarters are in Douglas, states: 'If you remove the logos from the slides, the message remains the same. Business owners are worried about five different things, but attackers primarily gain access through one channel. For any business, the key question is not which threat to fear the most, but whether it can continue trading tomorrow if any of them happen today.'
South Africa is More Worried Than The Rest of the World
According to the Allianz Risk Barometer for 2026, which surveys risk managers, brokers, and insurers in 97 countries, cyber incidents rank first among business risks in South Africa for the second consecutive year. Among those surveyed in South Africa, 48% cited this threat, compared to 42% globally, which is higher than 44% the previous year.
An even more alarming indicator is the next most significant risk. Business disruptions rank second locally with a figure of 40%, exceeding the global figure of 29% by 11 points and being seven points higher than last year. Artificial intelligence entered the top three for the first time in South Africa, taking third place with 30%.
Barnard emphasizes that 'South African enterprises are mainly not afraid of data loss; they are afraid of losing the ability to function. We have ten years of experience with this regarding electricity and infrastructure, but now cyberattacks are the most likely threat to disrupt trade.'
The Five Main Concerns
In major studies published this year, five issues consistently appear:
- 'Being tricked and paying.' The World Economic Forum's (WEF) global cybersecurity outlook for 2026 showed that company leaders now rank cyber fraud first among cyber threats, surpassing ransomware programs for the first time. In 2025, nearly three out of four respondents were affected or knew someone who was affected.
- 'Inability to trade.' Ransomware and subsequent shutdowns are the key issue behind South Africa's business disruption rate.
- 'AI turning against the business.' The WEF found that the main AI-related problem was not what attackers could do with it, but information leakage by employees through generative AI tools.
- 'Supplier as an entry point.' Only 3% of Allianz respondents worldwide consider their supply chains very resilient.
- 'Accountability.' The King V principle, applicable to financial years starting January 1, 2026, or later, places data, information, and technology management on the board of directors. Nevertheless, the level of concern regarding legislation and regulation among respondents from South Africa decreased from fifth to ninth place this year. Concern over accountability decreased in the same year as the issue itself.
Two People, Two Different Threats
WEF data demonstrates something more worrying: company executives and Chief Information Security Officers no longer defend against the same threats. Company executives rank fraud first, while security leaders still rank ransomware first, and supply chain disruption second.
Barnard comments: 'The person signing the budget and the person spending it protect different doors. This is not a technological problem, but a leadership problem. Security must be in the same room as the business decisions it protects, which we mean by Integrated Governance and Execution.'
Five Concerns, One Door
Under these five problems lies a single pattern. Unit 42 from Palo Alto Networks, which analyzed over 750 incident response cases, found that identification weaknesses played a significant role in almost 90% of investigations, and preventable gaps allowed intrusion in over 90% of hacks. The culprits were limited visibility, inconsistent controls, and excessive trust in user accounts, not exotic exploits.
In July, researchers from Sysdig documented what they assess as the first ransomware operation conducted entirely by an AI agent without human control at every stage. It penetrated through a known vulnerability in an open-source AI tool that had already been patched. None of its techniques were new.
Barnard concludes: 'This is the story of the year in one incident. A new type of attacker going through an old door that someone forgot to close.'
Do Not Hand the Door to a Machine
The same opportunity is now being sold to South African companies in the form of a security product. Buyers are offered fully automated AI penetration testing as a ready-made, cheaper, and continuous solution.
Research does not support this claim. A study published in December 2025 by Stanford University, Carnegie Mellon, and Gray Swan AI saw an AI agent test a live university network consisting of approximately 8000 hosts, alongside 10 professional pentesters. It outperformed nine of them, which is a real result. It also generated more false positives than humans and struggled with anything requiring a graphical interface, finishing in second place. The human took first place.
Barnard notes: 'AI is very good at finding things. We use it every day. However, it does not decide which of the hundreds of discovered issues actually cripple the business, nor does it connect three small vulnerabilities into one path an attacker would choose.'
He advises any South African business evaluating a vendor, including NEWORDER, to ask two questions before signing. Who is the human who confirmed this finding? And can you show us the path from the outside of our business to the actual vulnerability that will prevent us from trading?
'If the answer to the first question is a product name, you bought a scanner,' he says. 'Scanners have their place. Unfortunately, they do not replace a human operator capable of simulating a malicious actor trying to break in.'
Can You Trade on Monday?
The 40% business disruption rate in South Africa points to a question that most boards never answer aloud. If an attack happens tonight, what needs to be operational by Monday for the business to keep earning, and who decides what to restore first?
In Barnard's view, the answer must exist before the incident, be agreed upon by the people who have to live with it, and then tested by someone trying to break it. 'Most recovery plans are written for an auditor. They should be written for the morning after. When the CEO, CFO, and CISO agree in advance on which systems, people, and vendors are necessary for the business to operate, the first hours of an incident are spent on recovery, not debate. This is the speed of gaining understanding when it matters. And a plan that no one has attacked unfortunately remains just a theory.'
One Honest Answer
The five main concerns do not necessarily require five budgets. They need one honest answer to a simple question: have the foundations been tested by someone trying to hack them?
Barnard asks: 'Can your business afford to be hacked? In South Africa, the answer from people making a living measuring risks becomes clearer every year. The good news is that attackers mostly use doors you already know about. Find out which ones are open before someone else does.'
