SA firms urged to prep for more autonomous AI-driven orchestrated attacks

South African companies are being urged by cyber security and technology professionals to prepare for more autonomous AI-driven attacks, including ransomware, fraud, and phishing. Andre den Hond, a solutions architect at Arctic Wolf, explains that AI is accelerating cyber risk and transforming the threat landscape. AI is advancing from manual attacks, scripted automation, to ransomware as a service, with agentic operations marking the next phase of this evolution.

Autonomous AI-driven orchestration, which can operate at machine speed, is possible in real-world attacks but is not yet the dominant model for ransomware operations. Traditional ransomware attacks follow sequential, human-led operations, while agentic attacks can function independently, reducing the skill and effort required to carry out various campaigns.

Den Hond warns that ransomware attacks no longer require skilled operators, time, coordination, or supervision due to the reduced costs involved. He emphasizes that South African organizations may underestimate the severity of this threat, as cyber crime does not discriminate based on location, industry, or organization size.

Richard Ford, group CTO at Integrity360, notes that while business leaders are still questioning whether their organizations are sufficiently secure, the more pertinent question is whether the business can still operate when security measures fail. In this new threat environment, prevention has a limit, and recovery time has become a strategic and competitive factor.

Ford stresses that boards are increasingly prioritizing recovery speed over firewall strength as they build cyber resilience. He urges organizations to distinguish between having backups and the capability to recover, highlighting that while backups are essential, they do not guarantee recovery. Boards must assess whether backups are protected, if identity systems can be restored, if clean environments are available, and if the organization has tested the recovery process under pressure.

Even though a "chief resilience officer" may not exist in every organization, Ford emphasizes that an executive-level resilience mandate is crucial, regardless of who holds the responsibility. This ownership is vital to ensure a comprehensive approach to cyber resilience, encompassing detection, response, containment, recovery, communication, and learning.