![\"\"](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2025\/06\/Herman-Stoop.jpg\")
<\/figure>\n\n\n\nThe Allianz Risk Barometer for 2025 explained that, a decade ago, only 12% of global respondents cited cyber as a major concern. In 2025, that number surged to 38%.<\/p>\n\n\n\n
\u201cCyber is the top risk across North and South America, Europe, and Africa, dominating industry concerns from aviation to legal services,\u201d Allianz said. <\/p>\n\n\n\n
\u201cMore importantly, it now ranks as the number one risk in South Africa, overtaking long-standing issues like load-shedding and political instability.\u201d<\/p>\n\n\n\n
Allianz explained that this concern is not just theoretical, citing two recent, high-profile cyberattacks on two major South African organisations \u2014 Cell C and the South African Bureau of Standards (SABS).\u00a0<\/p>\n\n\n\n
\u201cBoth incidents have raised serious questions about compliance, cybersecurity readiness, and whether these attacks could have been prevented,\u201d it said.<\/p>\n\n\n\n
The World Wide Industrial & Systems Engineers\u2019 lead ISO specialist, Herman Stroop, said both attacks were entirely preventable.<\/p>\n\n\n\n
He said one key challenge in South Africa is poor enforcement of existing regulations, including the Protection of Personal Information Act (POPIA) and Minimum Information Security Standards.<\/p>\n\n\n\n
These regulations lay out clear expectations for information governance, yet Stroop said many organisations either ignore or delay compliance due to a perceived lack of consequences.<\/p>\n\n\n\n
\u201cThe irony is that prevention is far cheaper than remediation,\u201d he said. Following a cyberattack, organisations often suffer reputational damage, legal liability, and operational downtime.<\/p>\n\n\n\n
Stroop said these consequences far exceed the cost of implementing an ISO-compliant Information Security Management System.<\/p>\n\n\n\n
In addition, Stroop called for greater transparency from companies after they suffer a data breach.<\/p>\n\n\n\n
\u201cDetails about the nature of the attacks and how they were handled remain vague,\u201d he said. <\/p>\n\n\n\n
\u201cWhen an organisation isn\u2019t ISO-certified, it usually doesn\u2019t have the documentation, procedures or incident response plans to respond properly \u2013 let alone communicate clearly \u2013 during a breach.\u201d<\/p>\n\n\n\n
The Information Regulator previously reported that South Africa sees between 150 and 300 cyberattacks each month \u2014 and that\u2019s just the reported incidents.\u00a0<\/p>\n\n\n\n
Many incidents go unreported due to reputational fears or because organisations are not compliant with POPIA and fear investigation.<\/p>\n\n\n\n
\n\n\n\n