Thobeka Ngema|Published
With South Africa accounting for 92% of ransomware detections in Africa, questions are mounting over the Defence Department’s readiness to withstand cyberattacks and protect critical military infrastructure, despite assurances that safeguards are in place.
MK Party MP Irvin Mogale raised the issue, asking Defence and Military Veterans Minister Angie Motshekga what countermeasures, regulatory policy frameworks, and future programmes or training the SANDF has put in place to thwart cyber threats.
Questions arose following the release of the Interpol African Cyberthreat Assessment Report of June 2026, which found that the country accounted for 92% of cyberattacks targeting critical government infrastructure, including the SANDF.
Interpol’s African Cyberthreat Assessment Report revealed that South Africa accounted for 92% of all ransomware detections in Africa by TrendAI, with incidents affecting critical infrastructure such as the South African Weather Service and South African Airways.
Motshekga said the department had information and communications systems security monitoring capabilities to detect and alert to threats affecting its networks and infrastructure.
Moreover, the department conducts monthly vulnerability assessments and penetration tests twice a year to identify misconfigurations and unpatched systems.
Motshekga said that to address evolving cyber threats, the SANDF partners with the State Information Technology Agency, the State Security Agency, and institutions like Stellenbosch University through the Military Academy to train defence personnel.
“This current programme that the SANDF has instituted is aimed at continuously training and empowering SANDF members to mitigate cyber threats and the continuous development of SANDF members to deal also with future cyber threats. These initiatives are aimed at professionalising and capacitating Cyber Command personnel in response to the elevated threat highlighted by the Interpol African Cyberthreat Assessment Report,” Motshekga said.
However, Mike Bolhuis, a specialist investigator into serious violent, economic, and cyber crimes, said monitoring and identifying vulnerabilities were only part of an effective defence strategy.
“The real test is whether identified weaknesses are promptly addressed, whether security incidents can be contained before they escalate, and whether critical systems can continue operating during and after an attack,” Bolhuis said.
He said cybersecurity strategies require measurable outcomes, including independent security assessments, defined incident-response procedures, regular simulations, reliable backups and recovery, and transparent progress reporting.
Bolhuis explained that the regulatory frameworks provide an important foundation. Nevertheless, a policy framework or strategy does not, in itself, guarantee effective protection. Its value depends on implementation, accountability, adequate funding, suitably qualified personnel, and regular evaluation against the changing threat landscape.
He said training should extend beyond basic awareness to include threat detection, digital forensics, incident response, threat intelligence, secure systems administration and cyber-risk management.
“Cybercriminals and other malicious actors adapt their methods, increasingly using automation and artificial intelligence,” Bolhuis said.
“The critical question is whether they (SANDF) are fully resourced, operationally mature and producing measurable improvements in the country’s ability to withstand cyberattacks,” Bolhuis said.
University of KwaZulu-Natal computer science discipline head Professor Manoj Maharaj said the minister’s response identified important elements of cyber defence, but did not show whether they were effective.
He said the parliamentary response lacks details on response times, 24/7 monitoring, and attack containment and operational restoration; the actual effectiveness of these measures remains uncertain.
“The SANDF should translate these frameworks into clear responsibilities and tested arrangements for co-operation with civilian agencies and infrastructure operators. Parliament should receive meaningful information about progress, with sensitive operational details addressed through appropriate confidential oversight,” Maharaj advised.
He said basic awareness should reach all personnel, while specialists require advanced training. Programmes should also address phishing and impersonation using AI-generated voices or video.
“The reply describes ongoing training, but does not provide a sufficiently concrete future programme: how many personnel will be trained, to what competency levels, by when, and with what resources. Recruitment and retention also matter, because training delivers lasting value only when skilled personnel can be retained and deployed effectively,” Maharaj said.
thobeka.ngema@nationalmg.co.za