If you run a small or medium business in Johannesburg, the question is no longer whether someone will try to break into your systems — it is whether they will succeed. This guide cuts through the jargon: what the real threats are in 2026, what an attack actually costs, what POPIA expects of you, and what sensible protection costs per month.
The Real Threat Landscape in 2026
South Africa consistently ranks among the most-targeted countries in Africa for ransomware, mobile banking malware and business email compromise. High-profile incidents at Transnet, the Department of Justice, Experian SA and several medical labs made headlines — but for every attack that reaches the news, hundreds of small businesses quietly pay a ransom, lose a client payment or rebuild their systems from scratch.
- Phishing is still the starting point for the vast majority of attacks. AI-written phishing emails no longer have spelling mistakes — they look exactly like a real invoice from your supplier.
- Ransomware-as-a-service means criminals with no technical skill can rent ransomware kits and target SMEs in bulk.
- The average total cost of a data breach in South Africa runs into the tens of millions of rand for larger organisations (IBM's annual Cost of a Data Breach study puts it above R40 million). For an SME, even R200,000 of downtime, recovery and lost business can be fatal.
- Widely cited industry research suggests around 60% of small businesses that suffer a serious cyberattack close within six months.
The Most Common Attacks on South African Businesses
1. Business email compromise (invoice fraud)
A criminal gains access to your mailbox — or a supplier's — and quietly watches conversations. When an invoice is due, they send a "we've changed banks" email. Your client pays the criminal. This is the single most financially damaging attack we see in Johannesburg, and banks rarely recover the funds.
2. Ransomware
Malware encrypts your file server, laptops and often your backups, then demands payment in cryptocurrency. Without tested offline backups, you are left choosing between paying criminals or losing years of data.
3. Credential stuffing and password attacks
Passwords leaked from other websites are tried against your Microsoft 365, banking and accounting logins. Without MFA, a reused password is all it takes.
4. Unpatched systems and exposed remote access
Old firewalls, unpatched servers and Remote Desktop exposed to the internet are scanned constantly. Many breaches start with a vulnerability that had a free patch available months earlier.
5. Insider and lost-device risk
A stolen laptop with no disk encryption, or an ex-employee whose account was never disabled, is both a security incident and a POPIA breach.
POPIA Compliance Basics for Cybersecurity
The Protection of Personal Information Act applies to virtually every South African business — if you store client names, ID numbers, phone numbers or emails, you are a "responsible party". Two sections matter most for security:
- Section 19 — you must secure personal information with appropriate, reasonable technical and organisational measures.
- Section 22 — if personal information is compromised, you must notify the Information Regulator and affected individuals as soon as reasonably possible.
Penalties include administrative fines of up to R10 million, and serious offences can carry up to 10 years' imprisonment. For a step-by-step view, read our POPIA compliance checklist for small businesses.
What Managed Cybersecurity Actually Includes
Managed cybersecurity means a specialist provider deploys, monitors and maintains your security layers for a fixed monthly fee. A good service should include:
| Layer | What it does | Why it matters |
|---|---|---|
| Firewall management | Filters traffic, blocks known-bad locations, secures VPN | Stops attacks at the perimeter |
| EDR (endpoint detection & response) | Monitors device behaviour, isolates infected machines | Stops ransomware spreading |
| Email security + DMARC | Filters phishing, prevents domain spoofing | Blocks the #1 attack vector |
| MFA & conditional access | Second factor for every login | Makes stolen passwords useless |
| SIEM monitoring | Centralised logs and alerts, 24/7 | Catches breaches early |
| Encrypted, tested backups | Immutable offsite copies, restore tests | Recovery without paying ransom |
| Phishing training | Simulated campaigns and short lessons | Turns staff into a defence layer |
Cybersecurity Cost Breakdown for Johannesburg SMEs
| Item | Typical cost (excl. VAT) |
|---|---|
| Once-off security audit | R8,500 – R25,000 |
| Business firewall (hardware) | R6,000 – R30,000 once-off |
| EDR licence | R80 – R180 per device / month |
| Email security | R40 – R90 per user / month |
| Backup (cloud, SA data centre) | R500 – R3,000 / month |
| MBICT managed security (up to 15 users) | From R6,500 / month all-in management |
Compare that with the cost of one successful invoice-fraud attack — often R100,000 to R1 million paid to a criminal account — and managed security is one of the best-value insurance policies a business can buy. Many cyber insurers now also require MFA, EDR and tested backups before they will pay a claim.
How to Choose a Cybersecurity Partner
- Ask for a written audit first. A serious provider assesses before selling.
- Check response times. You need a 1-hour response for critical incidents, 24/7.
- Ask where your backups live. South African data centres simplify POPIA compliance.
- Demand documentation. You need proof of "reasonable measures" for the Information Regulator and your insurer.
- Look for transparent pricing. Avoid per-incident billing that makes a breach even more expensive.
- Prefer local. When ransomware hits, you want an engineer who can be on-site in Sandton or Midrand today.
Protect Your Business with MBICT
MBICT provides managed cybersecurity for Johannesburg businesses from R6,500/month — firewall, EDR, email security, backups, monitoring and staff training, managed by a local team. Start with a security audit and get a clear risk report within 5 business days.