Why Cyber Security

Dear reader

In the 2024/25 financial year, SA’s Information Regulator received 1,727 cyber security data breach reports. It’s expecting nearly 2,500 in the current financial year – a 45% increase.

It’s not because businesses have stopped spending on cyber security. A recent global survey of SMEs found South African companies are the most likely in the world to increase their security budgets this year. So, the money is moving, but the breaches keep climbing – why?

The real problem is not a lack of investment, but a gap between buying protection and building resilience.

National research into local cyber security found that:

• Only 50% of organisations run regular staff security training
• Only 36% have ever tested their incident response plan.

That means tools get bought. They don’t always get embedded.

Part of the gap comes down to a costly assumption: many business owners believe they’re simply too small or too obscure to be worth a criminal’s time. Cyber security practitioners consistently flag this as one of the most expensive mistakes a business can make – automated attacks don’t discriminate by company size, and smaller businesses are often easier targets.

The rest comes down to money. South African businesses have spent the past decade absorbing load shedding pressure and slower growth in an environment of weak GDP growth where tight credit policies squeeze cash flow. When budgets are already stretched, security competes for funding with keeping the business running at all – and it doesn’t always win.

Two things have happened which should help with closing that gap – fast.

Firstly, POPIA has teeth now — Sections 21 and 22 make the business, not just the IT department or the supplier, legally responsible for a breach and for reporting it, and the Information Regulator is actively enforcing that.

At the same time, larger clients are starting to ask smaller suppliers to prove their security posture before renewing a contract. Cyber security is quietly becoming a procurement requirement, not just a defensive measure. In 2025, 17% of data breaches in South Africa were traced back to third-party or supplier access – exactly the exposure large clients are now trying to close.

Closing this gap isn’t about buying more tools. It’s about governance — knowing what you’re protecting, who’s accountable for it, and whether your plan actually works when it’s tested. That’s a leadership decision, not a technical one.

If you’d like a clear-eyed view of where your business sits — spend versus resilience — we’d be glad to have that conversation.

Access Control

As businesses adopt AI initiatives, digital transformation and cloud technologies, one critical question becomes increasingly important: Who has access to your most critical systems — and should they?

Cybercriminals are increasingly targeting privileged accounts to access business infrastructure, so firms need to strengthen visibility and control over who can access which critical systems, data and applications.

For many businesses, the challenge isn’t a lack of security controls, it’s a lack of visibility and governance over who has access to what.

Common risks include:

• Weak passwords or passwords that are reused across business applications
• Employees having access to systems they no longer need
• Inconsistent use of Multi-Factor Authentication (MFA)
• Shared passwords with little accountability
• Third-party suppliers or contractors retaining access after projects end
• Limited reporting on who has access to critical business systems

When privileged access is compromised, the consequences can be significant: ransomware attacks and data breaches, operational disruption, regulatory penalties and reputational damage.

Reducing this risk requires a modern approach to Privileged Access Management (PAM) that delivers visibility, control and governance across your environment.

Through our partnership with Keeper Security, Du Pont helps organisations strengthen their security posture by enabling:

✓ Secure access management across users, service accounts and machine identities
✓ Just-in-Time (JIT) access to eliminate unnecessary standing privileges
✓ Passwordless access to critical systems and applications
✓ Automated credential management and password rotation
✓ Continuous monitoring and auditing of privileged sessions
✓ Enhanced compliance through detailed reporting and audit trails

Unlike traditional solutions that often require complex infrastructure and lengthy deployments, KeeperPAM provides:

• Cloud-native, agentless deployment
• Zero-knowledge security architecture
• Outbound-only connections with no inbound firewall changes
• Fast deployment across hybrid and multi-cloud environments
• Unified PAM, Secrets Management, Password Management and Zero-Trust Network Access

As businesses adopt AI, automation and cloud technologies, privileged identities remain one of the most attractive targets for attackers. Strengthening control over these identities is becoming a critical component of cyber resilience.

According to industry research, more than 80% of data breaches involve compromised credentials or identity-based attack techniques.

If you’re evaluating how to strengthen your organisation’s security posture, contact us to discuss how a modern PAM solution could support your goals.

Anthropic AI Model?

On the shifting cyber threat landscape, what it means for your business, and why an insurance-backed approach is now the only one that makes sense.

I’ll get straight to it.

Anthropic, the AI safety company behind Claude, recently announced a new model called Mythos. They described it as the most capable model they’ve ever built. Then they decided not to release it to the public. Why was this Anthropic AI model not released?

The reason matters for every business owner reading this. Anthropic AI Model

During testing, Mythos demonstrated an ability to find and exploit previously unknown security vulnerabilities across every major operating system and web browser. An independent evaluation found it was the first AI model able to simulate a full network takeover. Anthropic’s response was to restrict access to a small group of critical industry partners under a defensive initiative called Project Glasswing rather than release it into the world.

I’m not sharing this to alarm anyone. I’m sharing it because it changes the conversation around cyber security in a meaningful way and because it’s directly relevant to something we’ve been building at Du Pont Solutions.

The Question Every Business Owner Needs to Answer

How would you protect your business from online threats if those threats became dramatically more sophisticated, more automated, and more targeted, essentially overnight?

Most businesses we work with have some cyber security in place. Antivirus, a firewall, perhaps email filtering. It’s a reasonable starting point. But here’s the uncomfortable truth: fragmented tools, installed at different times and managed independently of each other, leave gaps. And in a world where AI can autonomously identify and exploit those gaps, the margin for error has narrowed significantly.

Without integration, your IT environment isn’t secure in an AI world.

The businesses most at risk aren’t those with no security. They’re the ones with a false sense of security tools in place, but no designed system behind them.

Cyber security is not a product. It’s a system. And in a post-Mythos world, a system with gaps is no longer acceptable.

Cyber Risk Is a Financial Issue, Not Just a Technical One

One of the most common questions we hear is: how do I actually assess the cyber risk for my business in South Africa? It’s exactly the right question. And the honest answer is that most businesses underestimate their exposure significantly.

Here’s the simplest way to think about it: if your business suffered a cyber incident tomorrow who carries the financial impact?

For most businesses the answer is: you. Entirely.

Downtime costs money every hour offline is revenue you won’t recover. A data breach triggers POPIA notification obligations and the reputational cost of telling clients their information was compromised. Recovery forensic investigation, system restoration, legal support routinely costs far more than businesses anticipate.

This is the point at which the question of cyber insurance becomes relevant. What is cyber insurance, and do you need it?

Cyber insurance covers the costs associated with a cyber incident system recovery, legal fees, regulatory fines, reputational damage management. If your business holds client data, processes payments, or depends on its systems to operate, you need it. Full stop.

But and this is critical , insurance without genuine security controls doesn’t reduce your risk. It simply transfers some of the financial consequence after something has already gone wrong. The gap between the controls in place and the financial exposure that remains is the problem most South African businesses don’t know they have.

How to Choose a Cyber Security Partner That Actually Stands Behind Their Work

When businesses ask us how to choose a reliable cyber security service provider, we give the same answer every time: find one that builds security as a designed system, not a collection of tools, and that is prepared to be held accountable for what they implement.

That’s what we’ve built at Du Pont Solutions.

Our fully managed cyber security environment integrates EDR, MDR, identity and access controls, and centralised monitoring into a single, coherent system, built and managed by us, not installed and left to run.

• EDR: active, real-time monitoring and response at device level
• MDR: 24/7 threat detection with human expertise behind every alert
• Identity controls: MFA, conditional access, and phishing-resistant passkey hardening
• Centralised monitoring: unified visibility across your entire environment via the Kaseya platform
• Cloud security: particularly Microsoft 365 configuration, where misconfiguration is a leading breach cause

This is not the best cyber security software for small businesses in South Africa assembled into a list. It is a designed environment built to reduce risk actively, managed continuously, and accountable by design.

The Part That Makes This Different

Businesses comparing the best cyber insurance options in South Africa will typically find themselves looking at standalone policies , assessed independently of what security controls are actually in place. Most insurers ask what software you’re running, not whether it’s properly configured, actively monitored, and managed as a system.

Our model is different. And I want to be direct about why.

Because of our confidence in the managed security environment we’ve built, our solution comes with a specialist insurance warranty , built directly into the solution. Not as a separate product. Not as an optional add-on. As part of the stack itself.

This warranty is not a marketing claim. It is our proof of conviction. An insurer has assessed our managed security stack and agreed to stand behind it financially. That is a risk calculation made by specialists whose business depends on getting it right. We offer this because we are confident enough in what we’ve built to put accountability behind it.

One important note: this model is dependent on the full implementation and ongoing management of the defined security environment. The warranty is not available as a standalone product. The insurer’s confidence and ours rests on the completeness of the controls.

Insurance without control doesn’t reduce risk. Control without accountability doesn’t build confidence. This model delivers both by design.

What This Delivers in Practice

For business owners and financial directors, this integrated approach delivers something the traditional model cannot: structured confidence.

• Complete visibility: you know what’s in your environment and how it’s performing
• Reduced breach likelihood: because the environment is actively managed, not passively installed
• Faster incident response: threats identified and contained before they escalate
• POPIA compliance support: governance built in from the outset
• Financial accountability: aligned with your actual controls, not assessed independently of them

This is the model that makes sense in a world where tools like Mythos are raising the offensive capability of attackers faster than most businesses can track.

Is Your Business as Protected as You Think?

If you’re wondering how to assess your cyber risk, which providers offer genuine cyber risk assessment services, or whether your current environment would hold up under real pressure we’d be glad to have that conversation.

No jargon. No obligation. Just a clear-eyed look at where your business stands and whether there’s a gap worth closing.

AI isn’t just for big business, South African SMEs are already using it to cut costs, grow capacity, and improve profitability — without large budgets or IT teams.

Affordable AI tools suitable for small businesses in South Africa are delivering measurable value: streamlining operations, reducing costs, and improving profitability in day-to-day ways that don’t require a development team, a research budget, or a dramatic technology overhaul.

Real South African Businesses. Real Results.

Here are four examples from industries you’ll recognise. They aren’t about replacing people. It’s about removing friction from the routine processes that quietly drain time, money, and energy from your business every single day.

1. Professional Services: Doing More Without Hiring More

A small accounting practice in Durban implemented AI tools to automate document processing and manage routine client queries. Within three months, roughly 40% of repetitive administrative work was handled automatically. The result: the firm increased its client capacity by more than half — without a single additional hire. That’s not just efficiency. That’s margin improvement.

2. Manufacturing: Turning Downtime Into Savings

A South African foundry identified production downtime as a key cost driver. By deploying a machine learning tool to monitor casting processes more accurately, they reduced defects by 20% and downtime by 15%. The financial impact: approximately R500,000 in annual savings. The tool didn’t replace their team — it gave their team better information to act on.

3. Agriculture: Better Data, Better Decisions

In the Western Cape, fruit producers are using drone technology with AI-powered crop monitoring to analyse orchard yields and sharpen sourcing decisions. Better data enables better forecasting, tighter cost management, and stronger profitability — in an industry where margins are perpetually under pressure.

4. Legal: Freeing Up the People for the Work That Matters

Local startup Lawyered Up uses AI to automate legal documentation and compliance processes. The result is less time on administrative burden and more capacity for strategic advice and client engagement — the work that actually builds a practice’s reputation and revenue.

The Pattern Is Clear

Across industries, South African SMEs are using AI to remove bottlenecks, improve accuracy, and reduce operational waste — not through dramatic transformation, but through steady, intentional optimisation.

And the efficiency gains don’t stop at the back office. Forward-thinking businesses are extending the same logic to their client-facing communications. AI-enabled phone systems can answer and route calls, book appointments, and handle after-hours voicemails — transcribing them into readable, prioritised messages so response times improve.

One area that often gets overlooked is quality assurance. AI agents can listen to and transcribe calls across an entire service desk, applying sentiment analysis to identify unhappy customers — before they complain or cancel. That means your team can respond proactively, not reactively. At Du Pont Solutions, we’ve implemented this for clients to reduce quality control costs and surface opportunities for revenue improvement that would otherwise go unnoticed.

You Probably Already Have More Than You Think

Here’s something worth knowing: many affordable AI tools for small businesses are already embedded inside platforms you may already own — Microsoft 365, your CRM, accounting software, email marketing platforms, inventory tools. The capability is often there. It’s just not being used.

The businesses seeing measurable results are the ones asking the right questions:

• Where are we repeating manual tasks that software could handle?
• Where do delays frustrate customers — and cost us their loyalty?
• Where are decisions being made without reliable data?
• Where are we hiring people to solve problems that a well-configured system could streamline?

Small improvements create disproportionate gains. Automating quote generation, improving response times, reducing stock holding costs, flagging anomalies before they become losses — each one is modest on its own. Together, they compound.

One Word of Caution

Adding AI tools without clear objectives can add complexity rather than reduce it. AI platforms tailored for small to medium enterprises work best when adoption is aligned with specific business goals: efficiency, risk mitigation, customer experience, or growth.

Sometimes the answer isn’t a new tool. It might mean configuring existing systems better, improving data quality first, or strengthening governance before automation begins. Telephony is a classic example — an often-overlooked area where smart AI configuration of an existing system (rather than a new purchase) can make a meaningful difference.

AI is a lever, not a magic switch. And levers work best when you know what you’re trying to move.

The Businesses Gaining Ground Right Now Aren’t Necessarily the Biggest

They’re the most intentional. They’re using affordable AI tools for small businesses to remove friction, improve accuracy, and grow profitability — incrementally, practically, and without waiting for the perfect moment or the perfect budget.

If you’re curious about where AI could genuinely strengthen efficiency in your organisation, we’d be happy to start that conversation — no obligation, no jargon.

A doctor tells a patient to come back in six months. A dentist does the same. The accountant mentioned a mid-year review. The physio said “book in before you leave.”

Did any of those follow-up appointments actually get booked?

If your practice relies on a memory, goodwill, or a busy receptionist to make that happen, the honest answer is: probably not all of them. And that gap — invisible, unmeasured — may cost your business more than you realise. The good news is that affordable AI tools for small businesses are making this problem genuinely solvable, now.

Revenue Doesn’t Just Walk Out the Door — Sometimes It Never Walks In

Appointment-based businesses — medical and dental practices, physiotherapists, veterinarians, accountants, attorneys — lose revenue in two distinct ways, and most only measure one of them.

No-shows and late cancellations are the visible problem. A slot existed on the calendar, but nobody arrived. Frustrating, but at least it’s measurable.

Follow-up leakage is the silent one. A follow-up was recommended — but it was never actually booked. There’s no empty slot on the calendar. No cancellation alert. Just an appointment that never materialised, and nobody to flag it.

That second category is consistently the larger problem — and it’s almost entirely preventable.

What Does This Actually Cost?

Let’s put some rough numbers to it. A modest practice with several practitioners running 30 appointments a day across 20 working days generates around 600 booking slots per month. Industry data puts no-show and late cancellation rates at 8–15% — that’s between 48 and 90 empty slots every month.

At an average net revenue of R800 to R2,000 per appointment, you’re looking at R38,000 to R180,000 in lost top-line revenue every month — before accounting for idle staff time or the downstream impact on patient or client care.

Follow-up leakage can go deeper still. A practice with 2,000 active clients, each due for a six-month review, is implicitly expecting around 4,000 review appointments per year. If just 20% of those clients don’t rebook without a prompt, that’s 800 appointments a year that quietly disappear. Recovering even half represents 400 incremental appointments annually — a material revenue line by any measure.

Most practices don’t track this number at all. Which is precisely why it keeps happening.

Where AI Fits In – Practically and Affordably

This is exactly the kind of problem that affordable AI tools suitable for small businesses in South Africa are built to address. The follow-up process is largely administrative, needs to happen consistently, and doesn’t require human judgment for the majority of interactions. That makes it well-suited to automation.

Consider a few practical scenarios: (AI receptionist)

• A client calls to book at 18:45. In most practices, that goes to voicemail. By the following morning, the client has moved on. An AI receptionist answers the call, understands the caller’s intent in natural language, checks availability in real time, and books the appointment immediately — without anyone needing to be on duty.
• Overdue clients who haven’t rebooked. Rather than relying on a receptionist to work through a call list between other duties, an AI layer proactively contacts overdue clients via WhatsApp, SMS, or email, offers available slots, and confirms the booking automatically — persistently and consistently, at scale.
• Voicemail and call transcription. Instead of a backlog of recorded messages requiring manual review, voicemails are automatically converted to text, and calls are summarised – giving your team clear, searchable records of what was discussed and agreed, without the note-taking overhead.
• When a human is needed. A sensitive clinical matter, a complex query, or an unhappy client – the system transfers the call seamlessly, with full context passed across so the conversation doesn’t have to start again from scratch.

Research consistently shows that even a single additional reminder produces a measurable reduction in missed appointments. The gains are real, they compound, and the tools to achieve them are more accessible than most practices assume.

What a Practical Solution Looks Like for an SME

AI platforms tailored for small to medium enterprises don’t require enterprise budgets or IT departments. A modern hosted PBX includes many of these AI capabilities natively, making it a practical and cost-effective starting point for professional services firms of almost any size.

A well-structured solution typically brings together an AI receptionist, voicemail transcription, appointment scheduling integration, and messaging across WhatsApp Business, email, and SMS for outbound recall and reminders — all managed with appropriate opt-in controls and compliant data handling.

For healthcare and regulated practices in South Africa, POPI Act compliance is non-negotiable. That means explicit opt-in for communications, minimal sensitive data in message previews, clear identification of automated systems, and a straightforward route to a human when needed. A properly configured hosted PBX handles all of this within a governed, auditable framework — so compliance is built in, not bolted on.

Is This Worth Exploring for Your Practice?

If you’re running an appointment-based business and you’re not sure how much revenue is quietly slipping through the gaps, that’s usually the first sign that a structured process would help.

At Du Pont Solutions, we help professional services businesses think through how technology can support their operations practically and cost-effectively — from AI-assisted scheduling to telephony integration and workflow automation. We’re based in South Africa and work with businesses that want solutions that fit their context, their budget, and their regulatory environment.

If this has raised questions worth exploring, we’d be glad to start with a no-obligation conversation.