Discovery has moved cybercrime to the top of its risk register, warning that advanced AI models are speeding up attacks to the point where they could outpace its defences.
In its integrated annual report for the year to 30 June 2026, the financial services group ranks “cybercrime and cybersecurity” first among its top 10 risks, up from third a year earlier. Geopolitical and macroeconomic uncertainty, last year’s top risk, drops to second.
“The increased use of AI, including rapidly advancing frontier models, materially increases the speed and scale at which cyber criminals can automate attacks, craft adaptive malware, deploy deepfake-driven fraud and rapidly exploit software vulnerabilities,” the report says.
For financial services groups like Discovery, it adds, attacks “could outpace existing detection, patching and response controls, leading to business disruption, data compromise and financial loss”.
Discovery says “significant investment” in its cybersecurity capabilities has strengthened its controls. “However, as AI adoption accelerates, the threat environment becomes less predictable, reinforcing the need for continued strengthening of controls and faster vulnerability remediation.” The report does not say how much the group spends on cybersecurity.
Discovery’s South African businesses serve more than six million lives, and Discovery Bank had more than 1.56 million clients at the end of June.
Preparing for quantum
Among its responses, Discovery says it is reviewing its “cryptographic assets” with a view to adopting quantum-safe practices. That means moving to encryption designed to withstand future quantum computers, which could eventually break some of the encryption methods in wide use today. It also lists regular penetration testing and checks on the security of key third-party vendors and partners.
AI features elsewhere in the register. “AI adoption and competitive advantage” rises to third from fifth, and here the worry is falling behind. “If AI adoption does not keep pace with technological developments, changing client expectations or competitor innovation, this could affect speed-to-market, personalisation, operating efficiency and the differentiation of the group’s propositions,” the report says.
Discovery is also dealing with AI’s effect on its workforce. Its people strategy includes “enabling the reskilling and redeployment of employees impacted by AI-related role changes”, though the report gives no numbers. The group employed more than 15 200 people at the end of June, up from more than 15 000 a year earlier.
Discovery’s ranking follows Shoprite’s. The retailer puts information security, including cyber risk, first among its six core risks and rates its own controls against cyberattacks and data breaches as only “partially effective”, the weakest rating it gives any of those risks, TechCentral reported earlier this month.
Shoprite recorded four data breaches in its 2026 financial year, up from three the year before and one the year before that, against a stated “zero tolerance for security breaches and unmitigated critical vulnerabilities”. Its report also says the rise of AI tools and the growing sophistication of cybercrime make more frequent and severe incidents more likely.
South African banks have been on high alert since April over Anthropic’s Mythos model, which the UK’s AI Security Institute assessed as “substantially more capable at cyber offence than any model we have previously assessed”. – (c) 2026 NewsCentral Media
