Experts question SANDF’s readiness to withstand cyberattacks

South Africa accounts for 92% of all recorded ransomware detections on the African continent, sparking questions about the South African National Defence Force's (SANDF) readiness to protect its critical military infrastructure against cyberattacks. Defence and Military Veterans Minister Angie Motshekga asserts that the SANDF possesses systems for monitoring threats, identifying vulnerabilities, and training personnel, yet cybersecurity experts remain skeptical about the effectiveness of these measures.

This skepticism emerged after the release of Interpol's African Cyberthreat Assessment Report in June 2026, which underscored South Africa's vulnerability to cyber threats targeting critical infrastructure.

MP Irvin Mogale of the MK Party inquired about the countermeasures, regulatory policies, future programmes, and personnel training initiatives implemented by the SANDF to combat cyber threats. Motshekga explained that the Department of Defence (DOD) has information and communications systems security monitoring capabilities to alert officials of network and infrastructure threats.

The department conducts monthly vulnerability assessments and performs penetration tests twice a year to identify misconfigurations and unpatched systems. Furthermore, the SANDF collaborates with various agencies, including the State Information Technology Agency, the State Security Agency, and institutions like Stellenbosch University, to train defence personnel in cyber defence.

However, Mike Bolhuis, a specialist investigator into various crimes, argues that merely monitoring systems and conducting vulnerability assessments are insufficient for a robust defense strategy. Bolhuis emphasizes the importance of promptly addressing identified weaknesses, containing security incidents before they escalate, and ensuring that critical systems remain operational during and after an attack.

He stresses that cybersecurity strategies need measurable outcomes, such as independent security assessments, defined incident-response procedures, regular simulations, reliable backups and recovery plans, and transparent progress reporting. Bolhuis contends that while regulatory frameworks lay a foundation for cybersecurity, their effectiveness hinges on implementation, accountability, adequate funding, qualified personnel, and continuous evaluation against evolving threats.

Professor Manoj Maharaj, head of the computer science discipline at the University of KwaZulu-Natal, notes that while the minister's response outlines essential aspects of cyber defense, it falls short in demonstrating their effectiveness. Maharaj points out the lack of specifics regarding response times, 24/7 monitoring, attack containment, and operational restoration, leaving the true impact of these measures ambiguous.

He advises that the SANDF must translate these frameworks into clear responsibilities and tested arrangements for cooperation with civilian agencies and infrastructure operators, while parliament should receive regular updates on progress, ensuring sensitive operational details are addressed through appropriate confidential oversight.

Maharaj recommends that basic cybersecurity awareness be imparted to all personnel, while specialized training should include threat detection, digital forensics, incident response, threat intelligence, secure systems administration, and cyber-risk management.