South African organisations faced 2,086 cyber attacks a week in August

South African organisations saw an average of 2,086 cyber attacks per organisation per week in August 2026, according to Check Point Research.

That number was down 3% year on year and slightly below the global average, but it still places routine cyber pressure at a level where attack volume alone can overwhelm weak operational controls.

The wider African picture was more severe. Angola recorded 5,416 weekly attacks per organisation, Nigeria 4,906 and Kenya 3,658. Those comparisons are interesting. They are not comfort.

Volume is only one part of the problem

Counting attempted attacks does not mean every event is a successful breach. The metric is useful because it shows how often security controls are being tested, not how many times attackers got through.

For South African organisations, the more relevant question is what happens when one of those attempts reaches a weak credential, exposed service or employee workflow. Check Point highlighted ransomware, phishing and generative-AI-related data exposure as continuing risks.

That combination reflects how enterprise risk is changing. Traditional perimeter attacks still matter, but staff are also moving sensitive information through browser-based AI tools, SaaS platforms and third-party systems.

Government departments, municipalities, hospitals and listed companies have all featured in local incident reporting over recent years. The Check Point weekly count is a background radiation reading. The public incident is what happens when one particle hits a weak isotope — usually an account, an open port, or a help desk that resets a password too easily.

Sophos's separate South African ransomware work puts compromised credentials at the centre of actual incidents. Read the two together: volume from Check Point, entry method from Sophos. Patching still matters. Identity is the door that is opening more often.

GenAI is becoming an ordinary data-loss channel

Check Point found that one in every 43 generative-AI prompts from enterprise networks posed a data-exposure risk. The average user generated 106 prompts during August, up from 95 in July and 78 in June.

Those figures do not prove deliberate data leakage. They show that AI usage is becoming frequent enough for accidental disclosure to become a normal governance problem. A staff member pasting customer information, source code, credentials or internal documents into an external model can create exposure without any malware being involved.

South African professional services, call centres and software shops are exactly the environments where this happens: a deadline, a messy Excel sheet, a public chatbot. POPIA does not grant an exemption because the model was "just helping with a summary". Information Regulator guidance on operators and cross-border processing is slower than staff curiosity.

Blocking every AI site is a blunt policy that people will route around on their phones. Logging, DLP, approved tools and training are slower and more realistic. The Check Point ratio — 1 in 43 — is a reason to start that work, not a reason to panic-buy another dashboard.

The African comparison matters

South Africa's 2,086 weekly attacks may look comparatively lower beside Angola or Nigeria, but that is the wrong comfort metric. South African companies are heavily connected to financial services, telecoms, cloud platforms, logistics networks and public-sector infrastructure. That connectivity makes a successful intrusion potentially more valuable.

The country has also recorded a steady stream of ransomware and data-breach incidents across government and private-sector organisations. Attackers do not need South Africa to lead Africa in raw weekly volume. They need one bank, one medical aid, one municipal billing system.

SADC neighbours and undersea-cable dependencies add another layer: an incident in a regional partner can become your incident through shared vendors.

What security teams should read from the numbers

The Check Point data points toward three practical priorities.

Identity remains central because compromised accounts can turn high attack volume into actual access. Email and endpoint protection still matter because phishing and malicious payloads remain common. Data governance around AI tools now belongs in mainstream security policy rather than being treated as an experimental issue.

Budgets should follow those three, not a generic "cyber awareness month" poster. Board reporting that stops at "attacks were down 3%" has missed the point. The base is still more than two thousand attempts a week per organisation.

The unresolved question is whether security budgets are moving as quickly as the attack surface. South African organisations are not facing a future cyber-risk problem. They are absorbing thousands of attempts every week already — and the expensive ones still start with a password, a phish, or a prompt that should never have left the building.

Report the door, not only the weather

2,086 weekly attacks per organisation is weather. Compromised credentials, phishing and AI prompts are the doors. Boards that celebrate a 3% year-on-year dip without asking about MFA coverage, backup isolation and chatbot DLP are reading the wrong chart.

Check Point's African comparatives will tempt comfort. South Africa's interconnected banks, telcos and public systems should not take it. Volume can sit below Nigeria and still ruin a municipal weekend. Security spend that cannot name identity, email and AI-data controls is theatre. The weekly count will bounce. The expensive week is the one where a phish or a prompt becomes a ticket in the incident channel. Budget for that week in advance. Keep the Check Point series on the wall if you must. Put the last phishing click and the last unapproved GPT paste next to it. That pairing is the South African version of the report.