13 Mar Security experts reveal 2026 threats and biggest focus

South Africa is facing one of the most challenging cyber threat landscapes in the world, according to new industry research.

Security experts warn that cybercriminal networks are becoming increasingly sophisticated, operating with greater coordination and automation while using artificial intelligence to scale attacks and target businesses more efficiently.

The financial cost is already substantial. Estimates from the South African Banking Risk Information Centre suggest cybercrime costs the country about R2.2 billion each year, while phishing scams accounted for 78 per cent of all digital banking fraud in 2025.

Separate research by Accenture found that 54 per cent of data breaches in South Africa involved compromised user identities.

Analysts say these figures demonstrate that traditional perimeter-based security models are increasingly ineffective in a digital environment where employees work remotely, devices operate outside controlled networks, and organisations rely heavily on cloud platforms.

Looking ahead to 2026, new research from HP Inc. suggests companies will need to rethink cybersecurity strategies across people, devices, identities and data if they are to remain resilient against the next generation of threats.

One new concern is the shift from password theft to cookie and session token hijacking. As multi-factor authentication becomes more common, cybercriminals are finding ways to bypass it by stealing browser session data, allowing them to access systems without needing login credentials.

Security specialists warn that sectors including finance, telecommunications, retail, healthcare and government could be particularly vulnerable. Experts say organisations should strengthen browser security through measures such as isolation technology, tighter privilege controls and more frequent token rotation.

Artificial intelligence is also changing how attackers operate. Cybercrime groups are increasingly deploying automated AI agents to scan networks, gather intelligence and customise attacks against specific organisations.

According to INTERPOL’s latest PDF report, AI-assisted cybercrime across Africa rose by 17 per cent in 2025, with South Africa among the countries most affected by the trend.

Specialists say this development means organisations must assume some attacks will evade detection and instead focus on containment and recovery strategies. These include isolating compromised devices, automatically restoring systems and enabling rapid recovery across entire device fleets.

Physical hardware attacks are also expected to increase. In sectors such as mining, healthcare, retail and municipal services, many devices operate in remote or public locations, leaving them vulnerable to tampering.

Cybersecurity professionals warn that attackers can exploit these conditions by extracting firmware, manipulating BIOS systems or physically removing sensitive data. As a result, companies are being urged to adopt hardware-level protections, including tamper-resistant designs and self-healing firmware technology.

Another growing concern involves peripheral devices such as printers, ATMs, point-of-sale systems and Internet of Things sensors, which are often overlooked in traditional cybersecurity planning.

Data from the South African Banking Risk Information Centre indicates that 38 per cent of breaches recorded in 2025 involved compromised peripheral or edge devices. Outdated firmware and limited monitoring of these systems are frequently cited as the main vulnerabilities.

Experts say organisations must improve device lifecycle management, introduce automated patching systems and ensure that devices are linked to secure identity frameworks.

The emergence of quantum computing is also influencing long-term security planning. With new standards for quantum-safe cryptography now being developed globally, organisations in government and critical infrastructure sectors are being urged to consider future encryption risks when purchasing new hardware.

Although large-scale quantum attacks are not yet a reality, security researchers warn that attackers are already collecting encrypted data in so-called ‘harvest now, decrypt later’ strategies, with the intention of unlocking it once quantum technology becomes more powerful.

At the same time, stronger regulation is increasing pressure on companies to improve data governance. The enforcement of the Protection of Personal Information Act and the expansion of the Cybercrimes Act are placing greater scrutiny on how organisations manage identity access and protect sensitive information.

As regulators focus more closely on identity management and data protection, cybersecurity strategies are shifting toward centralised identity systems, continuous monitoring of data usage and more unified access controls.

Industry leaders say the changing threat environment means cybersecurity can no longer be treated as purely an IT issue. Instead, it is increasingly viewed as a core business continuity challenge, affecting everything from financial stability to public trust.