Black Friday falls on 27 November. For the fortnight either side of it, most South African businesses will run harder than at any other point in the year — more traffic, more transactions, more temporary staff with access to more systems than usual.
And right about then, the people who actually understand those systems start taking leave.
It is worth spending an hour now on what that leaves exposed. Here is what to look at, and why it matters.
## First, what actually goes wrong
The picture is less dramatic than most security marketing suggests.
INTERPOL's African Cyberthreat Assessment, published in June, counted more than 6,000 exploitable vulnerabilities across the continent last year — 43.6 per cent of them in South Africa, nearly four times Kenya, the next country on the list. What was being exploited: outdated routers, old VPN software, misconfigured document portals. The report is blunt about it. These vulnerabilities
> "were not exotic or novel; they were well-documented, publicly known, and easily exploitable."
Verizon's 2026 Data Breach Investigations Report says the same thing from the other side. Exploiting a known vulnerability is now the single most common way attackers get in, at 31 per cent of breaches — ahead of stolen credentials at 13. And of the critical vulnerabilities already confirmed to be under active attack, only 26 per cent were fully fixed during 2025. The ones that were took a median of 43 days.
So the question going into Black Friday is not whether someone might find something clever. It is whether anything obvious is sitting open, and whether anyone is watching.
## Five things to check in the next fortnight
1. When did your last penetration test actually finish?
Not when you commissioned it — when the testing window closed. If that was in the first half of the year, treat the picture as stale. Vendors have shipped patches since, and appliances that were current then are versions behind now.
2. What has changed since that test?
New subdomains stood up for campaigns. New supplier integrations. New staff and contractor accounts. Firmware releases nobody actioned. Each one is something the test never saw. Write the list down — it is usually longer than people expect.
3. Who is on call, and can they actually get in?
Reduced-staffing windows are exactly when a known-but-unpatched weakness turns into a bad week. Confirm the names, and confirm their access still works before the office empties, not after.
4. Are your internet-facing systems the ones you think they are?
A forgotten staging site, a test portal, an old VPN concentrator still answering. Anything reachable from the internet is in scope whether or not it is on your asset register.
5. What happens if something goes wrong on the 28th?
Who has the authority to take a system offline during peak trading? Who tells customers? Settle that now, while it is a conversation rather than a crisis.
## The gap worth closing
Most businesses that take security seriously run a penetration test once a year. It is worth doing — but it is a photograph. It tells you how secure you were on the day it ran, and nothing about the eleven months that follow.
That is the argument for continuous vulnerability management. Magix CVM checks your environment every month and tells you what to fix, worst first, at a fixed monthly price. A specialist reads the findings before they reach you, so what lands on your desk is the handful of things worth acting on — not four hundred pages of scanner output.
The difference is not sophistication. It is frequency: a month between checks instead of a year.
## Before the 27th
None of the five checks above cost anything. They will tell you whether you are heading into your busiest fortnight with a current picture or a stale one.
If it turns out to be stale, now is a much better time to find out than the 28th.
[See how Magix CVM works](https://www.magix.co.za/services/managed-cyber-security-services/cvm?utm_source=magix&utm_medium=blog&utm_campaign=black-friday-2026&utm_content=mgx-021)
---
Sources
INTERPOL, African Cyberthreat Assessment Report 2026 (June 2026) — vulnerability detections by country, data from the Shadowserver Foundation.
Verizon 2026 Data Breach Investigations Report — initial access vectors (n=19,905) and remediation of CISA Known Exploited Vulnerabilities, dataset October 2024 to November 2025.
