By Gareth Redelinghuys, Country Managing Director, TrendAI

In April 2025, attackers took remote control of a dam in Western Norway and opened a valve for four hours. Nobody died. But the message landed: the gap between a cyberattack on operational technology and physical, economic consequences isn't theoretical anymore. It's operational.

South Africa should be paying closer attention than it is.

This isn't an abstract risk for the security team to worry about while the rest of the business gets on with things. It's a balance sheet risk. When Transnet was hit by ransomware in July 2021, container terminals in Durban and Cape Town ground to paper-based processing for days. Durban alone handles 60% of the country's container traffic. Every exporter, importer and logistics operator downstream absorbed that shock, whether or not they'd ever run a cybersecurity audit of their own.

Four years on, the exposure hasn't shrunk. It's grown, and it's become geopolitical. Law firm Webber Wentzel warned this year that Eskom and Transnet sit exposed to spillover from conflicts thousands of kilometres away — the same interconnected cyber activity seen around the Russia-Ukraine war and, more recently, the Iran-Israel-US confrontation. A missile strike in the Red Sea moves freight rates in Durban. That's how tightly coupled this has become.

The numbers should worry your risk committee

Eskom's own chief information security officer has said the utility now fields close to a billion attempted cyberattacks a month. Most get stopped. Some don't need to succeed spectacularly — a single well-timed disruption to a system with no redundancy is enough. South African organisations face an average of over 2,000 cyberattacks a week, and cybercrime is estimated to cost the country in the region of R2.2 billion annually. At a security summit in Johannesburg last month, one speaker put the core problem bluntly: South Africa hasn't fully come to terms with the fact that critical infrastructure - not just corporate networks - is the target.

He's right, and here's why it matters to a boardroom rather than just an SOC. Operational technology - the systems controlling power grids, water treatment, port logistics - was built for a world of physical isolation, not internet connectivity. That world is gone. What research consistently shows is that vulnerabilities in these environments are found faster than the organisations running them can act on them, partly because patching industrial systems is genuinely harder than patching a laptop fleet, partly because many have no patch cycle at all.

No legislation is coming to save you

South Africa has no dedicated critical infrastructure cybersecurity law. The Cybercrimes Act covers criminal conduct. POPIA covers personal data. Neither was built to govern the security posture of the entity keeping the lights on for a province. The National Cybersecurity Policy Framework will exist on paper; enforcement doesn't much exist anywhere else.

That gap doesn't excuse private-sector boards from the same exposure. If your business depends on ports, power or telecoms - and in South Africa, whose doesn't - you are underwriting a risk you don't control and largely can't see. Waiting for regulation to catch up is not a strategy. It's a bet, and it's currently losing.

What separates the boards managing this from the ones gambling on it

Three things, consistently. Visibility: most OT environments still have no real asset inventory, which means you can't protect what you don't know exists. Intelligence: knowing a vulnerability exists in your sector is worthless without knowing whether it's being actively exploited right now, which is what should drive where you spend. And structural separation: OT risk cannot sit inside the same framework as IT risk. The failure modes, timelines and consequences are different, and treating them as one function is how organisations quietly underinvest in the one that can put people in the dark or the water undrinkable.

The dam in Norway was a warning shot fired somewhere else. South Africa has already had its own, in its ports, its pension fund, its weather service. The next one won't announce itself as a dress rehearsal either. The only question worth asking in a boardroom right now is whether you'd know it was happening before your customers did.