EY Cybersecurity research. Image: EY
Cybersecurity Awareness Month is shining a spotlight on the growing cyber threat facing South Africa’s financial sector, with rising digital banking losses and increasingly sophisticated scams forcing institutions to reassess their approach to risk, insurance and resilience.
Digital banking crime losses in South Africa reached R2.4 billion in 2025, a 29.2% increase from the previous year, according to SABRIC data.
The growing financial impact of cybercrime is prompting organisations to look beyond cybersecurity alone and consider how insurance, governance and risk management work together when incidents occur.
Against this backdrop, Greg Harrup is leading a new Financial Institutions division at GIB Insurance Brokers focused on helping financial institutions manage increasingly complex risks.
Cyber risk
According to Harrup, cyber incidents can quickly escalate from technology failures into broader organisational crises.
“Financial institutions have always been specialist risks, but the way things go wrong for them has changed. A breach isn’t simply a breach anymore. Within a week you’re dealing with the regulator, worried clients, maybe lawyers, and the board wants to know who’s accountable.”
Research by EY has highlighted how cyber threats are exposing organisations to operational disruption, regulatory scrutiny and reputational damage, making cybersecurity a board-level concern.
Report
The threat landscape is also evolving rapidly. The INTERPOL African Cyberthreat Assessment Report 2026 found that artificial intelligence is linked to 55% of reported cybercrime cases across Africa.
Insurance cover under scrutiny
Harrup warned that having insurance does not automatically guarantee protection.
“An organisation may offer both cyber and crime cover but still find that a fraud loss falls between the two.”
Policies
He said institutions should test how different policies would respond in realistic cyberattack scenarios and identify any gaps before a claim arises.
Accountability and resilience
The consequences of a cyber incident often extend far beyond restoring systems. “None of that gets fixed by the IT department.”
Outsource
Harrup also highlighted risks linked to third-party service providers.
“You can outsource the service, but you can’t outsource the blame.”
He urged organisations to regularly bring together risk, compliance, IT, finance and leadership teams to assess their readiness for cyber incidents.
“Most institutions learn something uncomfortable the first time they do that. Better to learn it in a workshop than in the middle of a claim.”
ALSO READ: KZN launches groundbreaking fibre-ready housing project
