South African Organisations Exposed to AI-Driven Attacks

Research shows a 29-point gap between expected AI-driven attacks and organisations’ preparedness to address them. This gap is where incidents are most likely to land in the next two years. The attack surface has multiplied in scale and speed due to AI agents acting on behalf of people with the same credentials and access rights but without their judgement, training, or accountability.

Employees often create new risks by sharing sensitive information with personal AI tools or granting AI coding tools broad access to internal systems without understanding the consequences. 98% of organisations have unsanctioned AI tools active in the environment, and 47% use personal GenAI accounts for work data.

Security leaders must rely on behavioural context to tell legitimate AI activity apart from malicious activity, including baselines that capture what ’normal’ looks like for a given user, including their known AI usage patterns over time. Automated controls can stop the action before human review is possible, with alerts serving as records of what was caught rather than requests for human intervention.