Sophos published its State of Ransomware in South Africa report this month, and one line in it deserves more attention than it's getting. Of the South African organisations hit by ransomware in the past year, only 40% were back on their feet within a week. That's the lowest recovery rate of any country in the survey. It was 47% the year before.
The average cost of recovering, before any ransom is even discussed, was over R17 million.
It's tempting to read numbers like that as a story about criminals getting better. Some of that is true. But it isn't the whole of it, and the part that gets missed is the part a business can actually do something about.
We wrote about this in our Lab paper on malware and its development in South Africa, and the conclusion holds. South Africa is targeted for reasons that have nothing to do with luck.
Legacy systems are still in production in a lot of places, some of them holding up processes nobody wants to touch. There's a skills shortage that leaves too few people watching too many things. And patch cycles, in our experience, run months behind what the vendors assume. None of that is unusual for a mid-sized business here. It's normal. Which is the problem, because attackers know it's normal.
When Transnet was hit in 2021 and freight stopped moving through the ports, the cost ran past R300 million. That got attention. What gets less attention is the volume underneath it: the Sophos figures put the average South African organisation at over two thousand attempted attacks a week, up by more than a third on the previous year. Most of those aren't sophisticated. They're automated, opportunistic, and looking for whatever's easiest.
Here's the number from the report that we think matters most for how a business spends its security budget.
Set aside the attacks that arrived through phishing. Of the rest, 38% came in through exposed applications and systems. Not zero-days. Not nation-state tooling. Things that were reachable from the internet and shouldn't have been, or were reachable and hadn't been patched.
That category is different from the others, because you can find it before they do.
An exposed system usually looks like one of a handful of things. A web application running a version with a known flaw. A server somebody stood up to test something and never took down. A remote access service left open because it was convenient. A certificate that expired and took a security control with it. None of these is dramatic. Each one is a door, and each one appeared at some point after the last time anyone looked properly.
That timing is the whole issue. Most of these doors don't exist on the day of a penetration test. They open afterwards, between tests, and they stay open until someone notices. Increasingly, the someone who notices first is not on your side.
The Sophos report measures how long it takes to recover, and it's worth thinking about why South African businesses take longer.
Part of it is resourcing, and that's real. But a bigger part, in what we see, is that recovery is slow when you don't have a clear picture of what you had in the first place. If nobody can say with confidence which systems are exposed, which are patched, and which are actually critical, then after an incident every one of those questions has to be answered under pressure, from scratch, while the business is down.
Knowing your environment isn't just how you prevent the incident. It's how you get through one faster if it happens anyway.
This is the practical case for continuous vulnerability management, and it's why we built Magix CVM the way we did.
Every month we scan the external systems, the internal network, and the web applications. Then our specialists go through what comes back. Not a tool emailing you 400 pages. People, reading the findings, working out which ones actually matter to your business, and ranking them so you know what to fix first.
Over a few months, two things happen. The list of exposed systems gets shorter, because you're closing doors as they appear rather than discovering them years later. And you end up with something most businesses never have: a current, honest map of what's reachable and what state it's in. That map is what makes recovery fast if the worst happens, and what makes it far less likely to happen at all.
"The businesses that recover quickly are almost always the ones that weren't surprised," says Kevin Wotshela, Managing Director at Magix. "They knew what they had. They knew what was exposed. When something went wrong, they weren't starting from a blank page. That's not luck. That's just having looked."
The Sophos figures point at the same conclusion our own research did. Most attacks on South African businesses are ordinary. And ordinary attacks are stopped by ordinary defences: patching, segmentation, multi-factor authentication with no exceptions for executives, backups that attackers can't reach, and knowing what you've got exposed.
None of that is exciting. It's also what separates the 40% who recover in a week from the 60% who don't.
