Skip to main content
010 447 2445Contact
Arke Technologies home
Request a hardware quoteTalk to us
Arke Technologies home
Hands on a laptop keyboard beside a phone, ready for a sign-in prompt.

What is cyber security? A guide for South African organisations

Last reviewed: September 2026

Cyber security is the practice of protecting computers, networks, cloud services and data, and the people who use them, from attack, unauthorised access and damage. This guide explains what cyber security means for South African organisations, public bodies and schools, and how Arke Technologies in Johannesburg designs, runs and tests it.

Request a security assessmentSee our cybersecurity services
Insights

What is cyber security? A guide for South African organisations

Last reviewed: September 2026, 14 min read

Cyber security is the practice of protecting computers, networks, cloud services and data, and the people who use them, from attack, unauthorised access and damage. This guide explains what cyber security means for South African organisations, public bodies and schools, and how Arke Technologies in Johannesburg designs, runs and tests it.

Last reviewed: September 2026, 14 min read

On this page

What is cyber security? Meaning and definitions

Cyber security, also written cybersecurity, means keeping information and the systems that hold it confidential, accurate and available. Confidentiality means only the right people can see the information; integrity means nobody can change it without authority; availability means it is there when the organisation needs it. Security professionals call these three aims the CIA triad, and every control in this guide serves at least one of them.

Formal cyber security definitions say the same in more words. The US National Institute of Standards and Technology (NIST), whose Cybersecurity Framework is used worldwide, defines it as preventing damage to, protecting and restoring computers, communications systems and the information they hold, so that their availability, integrity, authentication, confidentiality and non-repudiation are assured. Information security is the wider idea: it protects information in every form, including paper files and conversations, while cyber security concentrates on digital systems and the networks that connect them.

For a board, a council or a school governing body, the cyber security meaning that matters is practical: when something goes wrong, can the organisation keep operating, meet its legal duties and protect the people whose information it holds? That makes cyber security a governance question as much as a technical one.

An engineer in headphones works at a standing desk with two monitors by a high window.

Why cyber security matters in South Africa

South African law now expects it. The Protection of Personal Information Act (POPIA) requires every organisation that processes personal information to secure it with appropriate, reasonable technical and organisational measures (section 19), and to notify the Information Regulator and the people affected after a security compromise (section 22). The Cybercrimes Act 19 of 2020 makes unlawful access, unlawful interception of data and cyber fraud criminal offences.

Boards are expected to own it. King V, the governance code that replaced King IV for financial years starting on or after 1 January 2026, places the governance of data, information and technology with the governing body (Principle 10, successor to King IV's Principle 12). Public bodies also answer for risk management under the PFMA or the MFMA. Our guides to technology governance under the King Code and the POPIA compliance checklist set out those duties.

Organisations are responding by buying expertise: managed security is the fastest-growing segment of South African IT services, forecast to grow 14.2% a year (Mordor Intelligence). The everyday risks explain why. A compromised mailbox is used to request payment to "new" banking details, ransomware reaches an unpatched server, or a former employee's account is still active months after they left.

Types of security: the main areas of cyber security

Cyber security is not one product but a set of disciplines, each covering a different type of security risk. Most organisations need all of them, in proportion to what they hold.

Type of securityWhat it protectsTypical controls
Identity and accessAccounts, passwords and permissionsMulti-factor authentication, least-privilege access, a joiner, mover and leaver process
Network securityConnections between offices, clouds and devicesFirewalls, segmentation, VPNs, secure Wi-Fi, traffic monitoring
Endpoint securityLaptops, desktops, servers and phonesPatching, encryption, endpoint detection and response, device management
Email securityMailboxes and the messages staff act on, one of the main routes in for attackersFiltering, SPF, DKIM and DMARC, impersonation protection
Application and web securityWebsites, portals, APIs and in-house softwareSecure development, testing to OWASP guidance, web application firewalls
Cloud securityMicrosoft 365, Google Workspace, Azure, AWS and Google CloudSecure configuration, conditional access, logging
Data securityPersonal and confidential informationClassification, encryption, data-loss prevention, backups
PeopleThe decisions staff make every daySecurity awareness training, phishing simulations
Detection, response and recoveryThe organisation's ability to cope with an incidentMonitoring, incident response plans, tested backups, disaster recovery

Our cybersecurity services cover each area; our guides to firewalls and email security gateways go deeper on two of them.

Common cyber attacks and security threats

Most incidents start with a handful of well-understood techniques, and knowing them shows where to spend first.

  • Phishing

    A phishing cyber attack uses a convincing email, text message or call to trick someone into revealing a password, opening malware or making a payment. It targets people, which is why technical controls cannot stop it on their own.

  • Business email compromise

    An attacker takes over or imitates a mailbox, then asks for banking details to be "updated" or for an urgent payment. Finance teams, bursars and anyone who approves payments are the targets.

  • Ransomware

    Malicious software encrypts files and servers, and the attackers demand a ransom to restore them. Many groups now copy data first and threaten to publish it, so an outage becomes a data breach as well, with POPIA duties to notify.

  • Password attacks

    Credential stuffing reuses passwords leaked from other websites; password spraying tries common passwords across many accounts. Multi-factor authentication defeats most of them.

  • Web security threats

    Injection flaws, cross-site scripting, broken access control and outdated plugins in websites and portals. The OWASP Top 10 lists the most critical web application risks.

  • Internal cyber security threats

    Mistakes by staff, accounts that outlive the people who used them, excessive access rights and, occasionally, a malicious insider.

  • Supply-chain attacks

    Attackers compromise a supplier, a software update or an IT provider to reach its customers, so ask every provider how it secures its access to your systems.

  • Network attacks

    Common network attacks include denial of service, scanning for exposed remote-access services and intercepting traffic on the network itself. Internet and network attacks like these are why exposed services should be few, patched and monitored.

What is a man-in-the-middle attack?

A man-in-the-middle attack is one in which an attacker secretly places themselves between two parties, such as a user and a website, and reads or alters the traffic while each side believes it is talking directly to the other. Classic examples are a fake Wi-Fi hotspot in an airport or coffee shop, a compromised router and forged network addresses on an office network.

The modern version is harder to spot. In adversary-in-the-middle phishing, a link leads to a proxy that looks exactly like the real Microsoft 365 or Google sign-in page. The proxy passes the password and the multi-factor code to the real service and captures the signed-in session, so the attacker needs neither again. A one-time code, whether sent by text message or shown in an app, is therefore not enough on its own for administrators and finance staff.

The defences are well established: encrypted connections everywhere (HTTPS and TLS), a VPN or trusted connection on public networks, phishing-resistant multi-factor authentication such as passkeys or security keys, conditional access that checks the device as well as the password, and alerts on unusual sign-ins. Our Microsoft 365 security work applies them to the platform most organisations depend on.

What is a data breach, and what does "data breached" mean?

A data breach is an incident in which information is accessed, disclosed, copied, altered or destroyed without authority. When a notice says your data was breached, personal information about you, such as your ID number, contact details or banking details, has reached someone who should not have it, whether through an attack, a lost laptop or an email sent to the wrong person.

POPIA calls this a security compromise. Section 22 requires the responsible party to notify the Information Regulator and the people affected as soon as reasonably possible once there are reasonable grounds to believe their personal information was accessed or acquired by an unauthorised person. Since 1 April 2025 the Regulator has required these reports through its eServices portal, not by email. The notice to people must tell them enough to protect themselves, and it may be delayed only if a law-enforcement body or the Regulator decides it would impede a criminal investigation.

The first hours decide how much damage a breach does: contain it, preserve the logs, establish what was taken and whose it was, then notify. Our incident response service runs that process and prepares the facts your Information Officer needs.

The building blocks of a cyber security programme

The NIST Cybersecurity Framework 2.0 organises cyber security into six functions: govern, identify, protect, detect, respond and recover. The steps below follow that order, and they map to the controls set out in ISO/IEC 27001 and the CIS Controls.

  1. Govern

    Give cyber security an owner at board or council level, agree how much risk is acceptable and report on it; King V Principle 10 places this with the governing body.

  2. Identify

    Keep an inventory of devices, systems, data and suppliers, and assess the risks to each.

  3. Protect

    Multi-factor authentication on every account, least-privilege access, patching, encryption, email filtering, device management and security awareness training.

  4. Detect

    Collect and review the logs from identity, email, endpoints and firewalls, so an attack is noticed while it can still be stopped.

  5. Respond

    Keep a written incident response plan: who decides, who contacts the Information Regulator, insurers and the police, and how evidence is kept.

  6. Recover

    Keep backups that attackers cannot reach or delete, test restores and rehearse the disaster recovery plan.

Testing checks that the whole programme works. A vulnerability assessment finds known weaknesses; cyber security penetration testing proves which of them an attacker could exploit. Our guide to penetration testing cost explains how tests are scoped and priced, and our guide to ISO 27001 certification covers the standard that formalises the whole programme.

What cybersecurity services include, and how we deliver them

Cybersecurity services are the outside expertise and tooling an organisation buys to run this programme: assessments, managed protection, monitoring and response, testing, compliance support and training. Few organisations can staff every discipline internally, so many combine an in-house IT team with a provider, an arrangement known as co-managed IT. We deliver cyber security under one managed agreement or as defined projects: one contract, one accountable team.

  • Assessment first. A cybersecurity assessment shows where you stand across people, process and technology, with the risks ranked.
  • Managed protection. Microsoft 365 hardening, Entra ID governance, Microsoft Sentinel SIEM deployment and Linux server administration, as our team delivers in managed security operations in South Africa.
  • Monitoring and response. Monitoring checks each managed computer every 15 minutes and logs faults as tickets automatically. Incidents are prioritised from P1 (critical outage) to P4 (low-impact request), and people respond to the targets agreed in your SLA. See managed detection and response.
  • Testing. We scope, perform and retest penetration tests, and help your team fix what they find.
  • Controlled access. Every remote session is approved and logged, and everyone with access to your systems is bound by confidentiality and our security controls.
  • Governance. A monthly service review and report gives your IT steering committee, audit committee or governing body a record of risks, incidents and actions, against controls aligned with ISO/IEC 27001, the NIST Cybersecurity Framework and the CIS Controls.

What cyber security costs

Last reviewed: September 2026.

Cyber security spending has three parts: tools and licences, the people who run them, and periodic work such as assessments and penetration tests. The total depends on your users and devices, the sensitivity of the information you hold, the regulations you answer to and the risk your board will accept.

Microsoft 365 and Google Workspace plans include security features that are often never switched on, so we check what you already pay for before recommending anything new. Managed protection is usually priced per user per month, and assessments and penetration tests per project. For comparison, published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026), with some providers listing R450 (MiBOT, September 2026); these are rates for managed IT, not a price for security on its own. We set our price per seat after an assessment. See our guide to managed IT services cost.

How to choose a cyber security provider

  • Start with an assessment, not a product. A provider that recommends tools before it understands your risks is selling, not advising.
  • Ask what monitoring means. Automated monitoring, human review and out-of-hours response are different services; ask which you are buying and how priorities are set in the SLA.
  • Check governance and reporting. Monthly reporting your board or council can read, a clear escalation path and change control.
  • Confirm compliance fit. POPIA operator duties, controls aligned with ISO/IEC 27001 and, for public bodies, documentation that supports PFMA or MFMA audit.
  • Check procurement documents. Arke Technologies is a Level 1 B-BBEE contributor (sworn affidavit available on request); company documents, our CSD number and tax compliance status are available on request.
  • Plan the exit on day one. Your data, credentials and documentation should stay yours, with a clean handover if you change provider.

More of our insights and guides, including how to choose an IT company, cover the wider decision.

Related services

Related guides

Related work

Get our guides by email

Plain, sourced guides for the people who decide on and buy technology, sent to your inbox.

Topics (optional)

Leave these clear to receive everything.

By signing up, you agree that Arke Technologies (Pty) Ltd may email you guides and updates. Every email includes an unsubscribe link. Read our privacy notice.

Frequently asked questions

What is cyber security in simple words? Show answer

Cyber security is protecting computers, networks and data from people who want to steal, change or disrupt them. In practice it means strong sign-in, up-to-date systems, backups, monitoring and trained staff, so that information stays confidential, accurate and available, from a single laptop to an organisation's cloud services and websites.

What are the main types of cyber security? Show answer

The main types of cyber security are identity and access, network, endpoint, email, application and web, cloud and data security, supported by staff awareness and by detection, response and recovery. Each covers a different route an attacker could use, so organisations need all of them in proportion to their risks.

What is a data breach? Show answer

A data breach is an incident in which information is accessed, disclosed, altered or destroyed without authority, whether through an attack, a lost device or an email sent to the wrong person. Under POPIA, a compromise of personal information must be reported to the Information Regulator and the people affected as soon as reasonably possible.

What is a man-in-the-middle attack? Show answer

A man-in-the-middle attack is one in which an attacker secretly intercepts the traffic between two parties, such as a user and a website, to read or alter it. Fake Wi-Fi hotspots and phishing proxies that capture signed-in sessions are common examples. Encrypted connections and phishing-resistant multi-factor authentication are the main defences.

What is the difference between cyber security and information security? Show answer

Information security protects information in every form, including paper records and conversations, while cyber security focuses on digital systems, networks and data, so cyber security is part of information security. ISO/IEC 27001 manages both through one management system, which is why many organisations use it to frame their whole security programme.

Who is responsible for cyber security in an organisation? Show answer

The governing body is ultimately responsible for cyber security: King V Principle 10, which succeeded King IV's Principle 12, places the governance of data, information and technology with it. Day to day, the IT team or a provider runs the controls, the Information Officer oversees personal information under POPIA, and every member of staff looks after their own accounts and devices.

How much does cyber security cost? Show answer

Cyber security costs depend on your users, devices, data and regulatory duties, so there is no single price. Managed protection is usually priced per user per month, and assessments and penetration tests per project. For comparison, published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026); we quote after an assessment.

Know where your organisation stands

Start with a cybersecurity assessment: a written report, risks ranked by impact and a plan your board can approve. Call 010 447 2445 or talk to us.

Request a security assessment