The cyber day after

A cyberattack does not end when the malicious activity has been contained. For the impacted business, that is usually the time when the most expensive part begins.

When an attacker breaches a system, the problem quickly moves beyond IT. Systems may be offline, staff are trying to keep the business running, customers want answers, and there may be regulatory steps to deal with. All of that costs money, often at a time when revenue is under pressure.

INTERPOL’s 2025 Africa Cyberthreat Assessment recorded 17,849 ransomware detections in South Africa during 2024, the highest number among the African countries in its assessment. IBM put the average cost of a South African data breach at R44.1 million in 2025.

Prepared for the attack, less prepared for the aftermath

South African businesses have spent years improving prevention. Endpoint protection, stronger access controls, employee awareness, backups, and security monitoring are familiar parts of the conversation. They remain essential, but no credible security programme can guarantee that every attack will be stopped.

The bigger test is whether the business can keep functioning while recovery is underway. Cohesity’s September 2026 Global Cyber Resilience Report found that 78% of surveyed organisations prioritised restoring systems over maintaining business operations. Only 22% had tested how critical operations would continue during recovery.

Bitdefender telemetry in July 2026 shows how concentrated that threat pressure is locally. Of more than 9.09-million Africa-targeted email threats captured over the preceding 30 days, 98.95% landed in South Africa.

Detection volume is not the same as a successful breach, but it shows the pressure businesses are operating under. Financial preparedness is a separate question from whether the controls designed to stop an attack are in place.

Making sense of the insurance gap

Santam’s 2025 Insurance Barometer found that eight in 10 commercial respondents had introduced additional cyber risk protections, yet only 17% had bought cyber insurance. Many businesses are spending to reduce the chance and severity of an incident while retaining much of the financial exposure themselves.

The contrast is significant. Many businesses are reducing the likelihood and severity of an incident while remaining financially exposed to the consequences. If recovery stretches into days, costs that are not insured have to be carried by the business itself.

Cyber insurance needs to form part of the planning around security and business continuity. Depending on the policy, cover can help with incident response, recovery expenses, downtime, and financial losses following events such as ransomware, data breaches, or digital fraud.

Know what the business can carry

Boards need a clear answer to one question. If a successful attack happened tomorrow, what would the business have to fund itself?

That means understanding how long critical operations could continue, what several days of disruption would do to cash flow, where insurance responds, and where the company remains exposed.

At DSG, we increasingly treat cyber defence and risk transfer as one resilience conversation. Digital Resilience provides round-the-clock security operations, threat detection, testing, and governance capabilities. EInsurer provides cyber insurance and risk management technology covering areas such as cyber threats, digital fraud, and business continuity, subject to the terms of the relevant policy.

The goal is to make a successful breach less likely while preparing the business for the financial and operational shock if one gets through.