Experts question SANDF’s readiness to withstand cyberattacks

South Africa accounts for 92% of ransomware detections in Africa, raising questions about the South African National Defence Force’s (SANDF) ability to withstand cyberattacks and protect critical military infrastructure.

Defence and Military Veterans Minister Angie Motshekga says the department has systems in place to monitor threats, assess vulnerabilities and train personnel. However, cybersecurity experts have questioned whether these measures are producing measurable improvements in the military’s ability to respond to and recover from attacks.

The concerns follow the release of Interpol’s African Cyberthreat Assessment Report in June 2026, which highlighted South Africa’s exposure to cyber threats targeting critical infrastructure.

Defence department outlines cyber safeguards

The issue was raised by MK Party MP Irvin Mogale, who asked Motshekga what countermeasures, regulatory policy frameworks, future programmes and training the SANDF had put in place to thwart cyber threats.

Interpol’s report found that South Africa accounted for 92% of all ransomware detections in Africa recorded by TrendAI, with incidents affecting critical infrastructure such as the South African Weather Service and South African Airways.

Motshekga said the Department of Defence (DOD) had information and communications systems security monitoring capabilities to detect and alert officials to threats affecting its networks and infrastructure.

Monthly vulnerability assessments are conducted, while penetration tests take place twice a year to identify misconfigurations and unpatched systems.

Motshekga said the SANDF also partners with the State Information Technology Agency, the State Security Agency and institutions such as Stellenbosch University, through the Military Academy, to train defence personnel.

“This current programme that the SANDF has instituted is aimed at continuously training and empowering SANDF members to mitigate cyber threats and the continuous development of SANDF members to deal also with future cyber threats. These initiatives are aimed at professionalising and capacitating Cyber Command personnel in response to the elevated threat highlighted by the Interpol African Cyberthreat Assessment Report,” Motshekga said.

Experts question effectiveness of safeguards

Mike Bolhuis, a specialist investigator into serious violent, economic and cyber crimes, said monitoring systems and vulnerability assessments were only part of an effective defence strategy.

“The real test is whether identified weaknesses are promptly addressed, whether security incidents can be contained before they escalate, and whether critical systems can continue operating during and after an attack,” Bolhuis said.

He said cybersecurity strategies required measurable outcomes, including independent security assessments, defined incident-response procedures, regular simulations, reliable backups and recovery, and transparent progress reporting.

Bolhuis said regulatory frameworks provided an important foundation, but having a policy or strategy did not guarantee effective protection.

Its value depended on implementation, accountability, adequate funding, suitably qualified personnel and regular evaluation against the changing threat landscape.

He said training should extend beyond basic awareness to include threat detection, digital forensics, incident response, threat intelligence, secure systems administration and cyber-risk management.

“Cybercriminals and other malicious actors adapt their methods, increasingly using automation and artificial intelligence,” Bolhuis said.

“The critical question is whether they (SANDF) are fully resourced, operationally mature and producing measurable improvements in the country’s ability to withstand cyberattacks,” he said.

Cyber-defence needs measurable results

University of KwaZulu-Natal computer science discipline head Professor Manoj Maharaj said the minister’s response identified important elements of cyber defence but did not demonstrate whether they were effective.

He said the parliamentary response lacked details on response times, 24/7 monitoring, attack containment and operational restoration, leaving the actual effectiveness of the measures uncertain.

“The SANDF should translate these frameworks into clear responsibilities and tested arrangements for co-operation with civilian agencies and infrastructure operators. Parliament should receive meaningful information about progress, with sensitive operational details addressed through appropriate confidential oversight,” Maharaj advised.

He said basic cybersecurity awareness should reach all personnel, while specialists required advanced training. Programmes should also address phishing and impersonation using AI-generated voices or video.

“The reply describes ongoing training, but does not provide a sufficiently concrete future programme: how many personnel will be trained, to what competency levels, by when, and with what resources. Recruitment and retention also matter, because training delivers lasting value only when skilled personnel can be retained and deployed effectively,” Maharaj said.