The AI cyber divide is widening. Leaders need to close it.
The AI cyber divide is widening. Leaders need to close it.
By Brett Marais, Cybersecurity Technology Solutions and Services Lead at BDO South Africa
Artificial intelligence is accelerating business and cyber threats at the same time. Across South Africa, organisations are exploring AI to improve competitiveness, increase efficiency and support digital transformation initiatives. While businesses are using AI to improve productivity, automate decisions and develop new services, attackers are using the same technology to scale reconnaissance and social engineering, reducing the effort required to target organisations.
What I am seeing increasingly is an AI cyber divide. In the South African market, the gap is becoming more visible between organisations that are adopting AI with clear governance and oversight, and those that are embracing it faster than they can understand where it operates, what it can access and who is accountable when something goes wrong.
The divide is not really about access to technology. Most organisations can access the same tools. The real difference lies in their ability to govern them. AI has a way of amplifying existing weaknesses in data protection, identity management and incident response. A model connected to sensitive information, an AI agent with excessive permissions or an unreviewed vendor feature can increase exposure long before traditional review processes identify the risk.
Security therefore needs to be embedded in AI adoption from the outset. Organisations should be asking fundamental questions: What data can an AI system access? Which decisions can it influence? How are its outputs validated? Who can intervene if it behaves unexpectedly? These are business questions as much as technology questions. They should be discussed in boardrooms and executive committees, not only during technical reviews before deployment.
Organisations also need to move beyond periodic assessments and focus on their current level of exposure. A quarterly report may confirm that a vulnerability exists, but executives need to understand whether it can be exploited today, which critical services it affects and how quickly teams can respond. The same approach should extend to machine identities, sensitive data, AI systems and third-party suppliers.
AI can also help defenders meet these challenges. In South Africa especially, where many security teams are expected to protect increasingly complex environments with limited resources and ongoing skills shortages, AI can help enrich alerts, accelerate investigations and prioritise risks. Automation has an important role to play, particularly for repeatable response activities with well-defined controls. However, decisions with significant consequences for customers, employees or business operations still require accountable human judgement.
Resilience planning also needs to evolve. Organisations should be testing scenarios that reflect how AI is actually being used. What happens if an AI agent is manipulated? What if a model generates harmful outputs, trusted data is corrupted or a critical supplier experiences a service failure? The objective is not simply to test technology, but to understand who makes decisions, how issues are contained and how stakeholders are informed when things go wrong.
Boards and executives do not need another lengthy inventory of cyber activity. They need clear evidence of where AI is creating value and where it is introducing risk. They need to know who owns material AI use cases, whether controls are effective and how the organisation would respond under pressure.
A practical place to start is a focused 90-day plan. Identify the AI use cases and machine identities that matter most. Assign clear business, technology, data and risk ownership. Review access to sensitive information. Test a realistic failure scenario. Then agree on a small number of measures that demonstrate whether risk exposure is reducing and response capability is improving.
AI adoption will continue to move quickly. In my view, the organisations that will benefit most are not necessarily those moving the fastest, but those combining innovation with clear accountability, continuous testing and measurable assurance. Those are the organisations that will be able to innovate with confidence while maintaining the trust of their customers, employees and stakeholders.