As artificial intelligence and increasingly connected technologies reshape the way businesses operate, South African organisations must rethink how they manage cybersecurity, with greater accountability at board level and a stronger focus on resilience, trust and collaboration.
This was the central message to emerge from SNG Grant Thornton South Africa’s Cybersecurity Summit, held recently with MTN as host and sponsor. Bringing together business leaders, risk specialists and technology experts, the summit examined how the convergence of digital technologies is creating new opportunities for growth, but also exposing organisations to increasingly interconnected risks.
Held under the theme The Converged Enterprise: Navigating Risk as IT, OT, IoT and AI Converge, the summit highlighted how cybersecurity has moved beyond the traditional domain of IT departments to become a critical business issue, with implications for operational continuity, financial performance and customer confidence.
In his wrap-up of the day’s proceedings, Oupa Mbokodo, Managing Director of Advisory Services at SNG Grant Thornton, emphasised that the messages delivered at the event repeatedly highlighted the urgency for cyber risk to be elevated to the level of boards and executive management, where decisions about organisational strategy and risk appetite are made. “While organisations cannot realistically expect to prevent every cyber incident, their ability to withstand and recover from disruption will increasingly determine their resilience.” Mbokodo said, identifying preparedness and trust as two of the most important cornerstones of such resilience.
The event also highlighted that growing adoption of AI is adding further urgency to this challenge. As businesses embrace AI’s potential to improve productivity, employees are already using AI tools in ways that may fall outside of established governance frameworks. At the same time, AI is changing the nature of cybercrime, making sophisticated attacks more accessible to less experienced criminals and increasing the pressure on organisations to strengthen their defences.
Against this backdrop, Dominic White, Managing Director of Orange Cyberdefense, explored how AI is altering the capabilities of both attackers and defenders, and reinforced the need for organisations to keep pace with rapidly evolving threats without losing sight of the opportunities that AI presents.
A recurring theme throughout the summit was that as IT, OT, IoT and AI increasingly converge, organisations must rethink traditional approaches to accountability and risk ownership. For Kudakwashe Charandura, SNG Grant Thornton’s Cyber Advisory Service Line Leader, effective cybersecurity begins with the tone set by leadership. During the executive panel discussion on governance and accountability, he stressed that boards need to understand their organisations’ cyber exposure and make security a regular part of their oversight responsibilities, rather than engaging only when an incident occurs.
“Don’t ask questions when an attack occurs. Start asking questions as you go,” he urged, emphasising the importance of sustained investment and a culture in which cyber risk is understood as a shared responsibility.
Charandura drew a comparison with the fire drills that organisations routinely conduct to prepare employees for emergencies. He argued that similar preparation is needed for cyber incidents, supported by clear responsibilities and an organisational culture that encourages people to raise concerns without fear of blame.
The importance of preparation was also brought into sharp focus during one of the day’s most engaging sessions, when Vijay Rathour, Partner and Head of Cyber and Digital Investigations at Grant Thornton, London led attendees through an interactive cyberattack simulation. Drawing on his experience supporting organisations through major cyber incidents and data breaches, Rathour challenged attendees to respond to a fictional developing cyber crisis, confronting the pressures that arise when security failures threaten broader business operations and customer trust.
The exercise demonstrated that technical defences are only one part of effective cyber resilience. Organisations also need leadership teams capable of making difficult decisions under pressure, supported by tested response plans and clear communication procedures. Rathour highlighted that regular simulations can expose weaknesses before a real incident forces organisations to discover them at considerable cost.
Beyond the risks facing individual businesses, the summit also highlighted the vulnerability created by South Africa’s increasingly interconnected economy. In his opening keynote, Lincoln Mali, CEO of Lesaka Technologies, used the example of a spaza shop owner whose livelihood depends on an intricate network of payment systems and technology providers. For smaller businesses with limited financial resources, a major disruption can threaten their very survival.
This wider responsibility was reinforced by Emily Manganyi, Chief Information Security Officer at the JSE, who stressed that protecting individual organisations is insufficient when their systems and services are closely connected to others. “Building resilience requires greater collaboration across industries,” she argued, “including support for smaller and less-resourced organisations that form part of the same ecosystem.”
Closing the summit, Mbokodo reinforced the importance of strengthening trust across organisations and sectors, and urged attendees to translate the day’s insights into practical action by identifying at least one change they would make to improve cyber resilience within their own organisations.
The one particular message that was clear throughout the summit was that as technology becomes more deeply embedded in business and society, cybersecurity cannot be addressed through technology investment alone. The organisations best placed to manage the risks of convergence will be those that combine accountable leadership with a culture of preparedness, shared responsibility and trust.
