How to Choose a Cybersecurity Partner in South Africa

Why choosing wrong is worse than doing nothing

A weak cybersecurity partner is more dangerous than no partner. They create a false sense of safety, they hold privileged access into every system you own, and when the incident happens they are usually the first thing that breaks. South Africa's regulatory environment (POPIA, Companies Act, sector-specific rules) means a breach isn't just embarrassing — it's now a reportable event with real financial teeth.

The 12 questions to ask before you sign

1. Who is actually watching the alerts, and when? Names, shifts, response-time SLA in minutes — not "our team".
2. Show me a real incident report you produced last quarter. Redacted is fine. If they can't, they haven't handled one.
3. What is your MTTR (mean time to respond) for a P1 alert? Anything above 30 minutes for a P1 is a reseller, not an operator.
4. How do you protect your own environment? MFA everywhere, PAM, ISO 27001. Their weakest link becomes yours.
5. Which frameworks do you align our controls to? NIST CSF 2.0, CIS Controls v8, ISO 27001. "We use best practice" isn't an answer.
6. What happens in the first hour of a ransomware event? They should describe a runbook, not improvise.
7. Do you test backups by actually restoring them? Monthly at minimum, evidence in the report.
8. How do you handle offboarding — ours and theirs? The exit process reveals more than the sales pitch.
9. What's your policy on paying ransoms? Correct answer: we don't, and we help you rebuild.
10. Which of these tools do you deploy, and why? EDR, email security, identity protection, DNS filtering, MFA, backup, awareness training. Missing categories = missing coverage.
11. Are you cyber-insured, and to what limit? Ask for the certificate. R25m+ is the working minimum.
12. Can we speak to a client of similar size and sector? Any real partner has three references ready.

Red flags — walk if you see two or more

• "We use AI to detect everything" with no human on the other end.
• Free assessment that just runs a vulnerability scanner and prints a PDF.
• Refuses to name individual analysts, or the analyst is offshore in a timezone that doesn't overlap SA business hours.
• No ISO 27001 or SOC 2 of their own. They can't secure themselves.
• Everything is billed as a "project" — no ongoing monitoring included.
• Pushes you into a 36-month contract with no exit terms.
• Cannot articulate the difference between antivirus, EDR and MDR.

How the contract should be structured

• Base monthly fee per user or per endpoint covering monitoring, response, tuning, reporting.
• Tooling either pass-through at cost or bundled — but always itemised so you know what you own.
• Response SLA in minutes for P1, hours for P2, days for P3 — with credits if they miss.
• Monthly report covering alerts, incidents, patch compliance, backup restores, user risk score, top 3 recommended actions.
• Quarterly business review with a security-cleared human, not the account manager.
• Exit clause: 30–60 days notice after year one, full data export, revoked access documented.

Frequently asked questions