Modern endpoint detection, SIEM, email security, phishing training, verified backups, and an incident response plan. Built for South African SMBs between 10 and 200 staff who hold customer data they can't afford to lose.
The era of "we're too small for anyone to care about us" is over. South African SMBs are now the most attacked segment because the economics work for attackers: small businesses hold meaningful amounts of personal and financial data, usually have minimal security investment, and are more likely to pay ransoms quickly because they can't operate for a week without their systems.
The Dis-Chem breach exposed 3.6 million customer records through a third-party vendor. GPAA was hit with LockBit ransomware. Cell C notified affected customers and the Information Regulator after a 2025 breach. These are the ones that made the news; most SMB breaches never get published, because the business just quietly pays or quietly restores from backup and hopes nobody noticed.
What's changed in 2026 is both the threat and the law. Attackers run as businesses now, ransomware-as-a-service, initial access brokers selling stolen credentials, and intruders who often go undetected inside compromised networks for weeks or months. And the Information Regulator has started actively enforcing breach notification requirements, with fines for both the breach and the failure to notify in time. Underinvestment in cybersecurity has stopped being cheap.
This is the minimum we'd want to see at any client, not a premium tier, just the floor. If anything on this list isn't in place at your business right now, that's where to start.
We don't sell a product. We sell a programme that gets your business to a defensible baseline and keeps you there.
We audit your current state against the baseline above. You get a one-page scorecard (red / amber / green per domain), a prioritised fix list with time and cost estimates, and a short written report that an executive can read in 10 minutes.
Fix the obvious gaps. MFA rollout, EDR deployment, backup configuration, DMARC enforcement, SIEM deployment. Each item has a defined scope and cost upfront, no cost-plus billing.
Managed cybersecurity as part of your monthly service: incident response during business hours (Mon–Fri 09:00–16:00 SAST) with 15-minute P1 response, quarterly posture reviews, phishing training programme, patch management, access reviews. 24/7 automated monitoring (including SIEM monitoring) is available as a separately-priced add-on. If a client wants cybersecurity as a standalone service without full managed IT, we offer that too.
If you've just discovered a breach, or you have strong reason to think you're compromised right now, phone us: +27 65 933 9750. Don't email, we check email in batches. The first few hours after a breach matter more than almost anything else that happens afterwards.
What to do before you call: don't wipe anything. Don't restore from backup yet. Don't tell staff to "just use their personal email for now." Preserve the evidence. Isolate affected systems from the network if you can do that safely. Make a note of exactly what you know and when you noticed it. We'll take it from there.
The modern SMB cybersecurity baseline in South Africa is: MFA on every account (not just email), endpoint detection and response (EDR) instead of traditional antivirus, email security filtering with anti-phishing policies, verified backups following the 3-2-1 rule, patching on a monthly cycle for OS and third-party apps, and a written incident response plan that names who notifies the Information Regulator within breach notification timelines. On top of that, quarterly phishing simulations and user training.
Anything less than this baseline is going to fail a security review and probably a breach.
Traditional antivirus matches files against known malware signatures. Modern attacks don't look like signatures. They use PowerShell scripts, legitimate admin tools (living-off-the-land), fileless techniques, and polymorphic code that changes every hour. Signature-based antivirus misses a large share of modern threats; endpoint detection and response (EDR) tools catch the behaviour patterns and will stop a ransomware deployment mid-execution.
Modern EDR (Microsoft Defender for Business*, CrowdStrike Falcon*, Sophos Intercept X*) is often bundled with licences you already own. Defender for Business comes with Microsoft 365 Business Premium* at no extra cost.
A SIEM is a Security Information and Event Management (SIEM) platform that correlates alerts from your firewall, endpoints, Microsoft 365* sign-ins, and server logs in one place. For SMBs, it means you can actually see what's happening in your environment, unusual sign-ins from foreign countries, mass file encryption attempts, failed brute-force attacks on your firewall, data exfiltration patterns.
Attackers often go undetected inside SMB networks for weeks or months, quietly exploring the network, mapping critical systems and exfiltrating data before deploying ransomware. A SIEM is the single biggest factor in catching them in days or hours instead of months.
South Africa's data protection law requires that any business suffering a security compromise affecting personal information must notify the Information Regulator and affected data subjects as soon as reasonably possible after the compromise is discovered.
A solid incident response plan is a one-to-three page document that names: who detects the incident, who declares it (usually a single person with authority), who contacts the Information Regulator and the data subjects, the template notification wording, who contacts law enforcement if needed, what legal counsel to call, what forensic evidence to preserve before any system is wiped, and a brief "first-hour" technical checklist for containment. We write these for clients as part of their cybersecurity engagement. They're not a document to buy a template of and never read.
Yes, but call us immediately. The first few hours after a breach matter more than almost anything else. We handle incident response for existing managed clients as part of the service, and we take on breach response for non-clients when we have capacity. Our first actions in order: isolate affected systems without destroying forensic evidence, change credentials for compromised accounts, review audit logs for scope and timeline, assess data exfiltration, draft the regulatory notification wording, and coordinate with legal counsel and law enforcement.
We prefer to be your IT provider before a breach, not during one. But if you're reading this because you're in trouble right now, phone +27 65 933 9750.
A full baseline programme for a 50-user SMB typically runs between R15,000 and R35,000 per month depending on scope, with an initial setup project of R40,000 to R120,000 depending on what's already in place. Most clients already have some of the pieces (Microsoft 365* licences, a decent firewall) which pulls the number down.
Compare that to the actual cost of a ransomware incident at an SA SMB, which typically runs to R500,000 to R3m in direct costs plus 2-4 weeks of operational disruption. The maths is uncomfortable only for one direction. We quote after we have talked through what you need, so the number is honest.
* Products named on this page are examples of the stack we deploy. Actual recommendations depend on your environment, scale, and existing licensing. We have zero commission arrangements with any vendor. Recommendations are made on technical fit alone.