Defence minister Angie Motshekga said her department uses security monitoring systems to spot cyber threats to its networks and infrastructure.
She gave the details in a reply to a Parliamentary question from MK MP Irvin Mogale, MyBroadband reported. Motshekga said the monitoring systems can find threats and warn the right people when they are detected.
“Vulnerability assessments are conducted monthly, and penetration tests are conducted biannually to identify misconfigurations and unpatched systems,” Motshekga said.
She said the tests help the department improve its cyber safety and reduce weak spots that attackers could use. The department has also put several policy rules on cybersecurity in place, she said.
Motshekga said the South African National Defence Force (SANDF) has partnered with the State Information Technology Agency because cyber threats keep changing. It also works with the State Security Agency on basic cybersecurity.
Department staff have received cybersecurity training from Stellenbosch University, the minister said.
“These initiatives are aimed at professionalising and capacitating Cyber Command personnel in response to the elevated threat highlighted by the Interpol African Cyberthreat Assessment Report,” she said.
Mogale based his question on Interpol’s June 2026 report. He said the report found that South Africa accounted for 92% of cyberattacks on critical government infrastructure.
According to Interpol, criminals are drawn to South Africa’s strong Internet connections. These are supported by subsea cable landings and many data centres.
Interpol warned that this mix makes South Africa a big target for attackers who want to cause as much disruption as possible.
The report pointed to the January 2025 ransomware attack on the South African Weather Service (SAWS). The attack was carried out by RansomHub, an extortion group linked to Russia.
The group hit the weather service twice in a short time. During the second attack, it took down the agency’s entire IT system.
At the time, SAWS said it kept delivering services to the shipping and aviation sectors through other channels. It also kept up its severe weather services.
“A team of ICT engineers and cyber security experts is working around the clock to recover and restore the compromised systems,” SAWS said.
Interpol said the attack damaged important weather data systems. It also disrupted aviation routing and the systems ships use to find their way at sea.
Early reports said a phishing campaign gave the attackers access to the weather service’s systems.
Months later, SAWS said the attack hurt its results. It met 90.91% of its targets in the third quarter, but only 36.36% in the fourth quarter.
“Needless to say, the January 2025 cyberattack had everything to do with this uncharacteristically poor performance,” SAWS chair Sandika Daya said.
Interpol also warned that attackers are using AI tools to gather information faster before they strike.
“Threat actors are deploying automated reconnaissance tools capable of scanning tens of thousands of systems per second,” Interpol said.
According to the report, these tools use machine learning to find weak points in routers, old software and badly set up cloud services.
Source: this article is based on reporting by MyBroadband. Image: MyBroadband. Written with the help of AI and published by the Tzaneen Voice Technology desk. See our Editorial Standards.
Werner Jacobs covers technology for Tzaneen Voice. Werner reports on mobile networks, data prices, internet access, smartphones, apps, AI, cybersecurity and South African tech companies. Each story explains what a new product, price change or policy means for ordinary users in South Africa.