HEINO GEVERS | AI reshapes cyber response as boards demand faster recovery

A major cyber incident can wipe as much as 30% off a company’s share value. For South African organisations, narrowing the gap between breach and response is no longer just a technical challenge but a financial imperative. Boards are demanding a new kind of cyber leadership to deliver it.

Regarding breach readiness, South African organisations fare better than many of our global counterparts. IBM data shows local organisations take an average of 227 days to identify and contain a breach, a full month faster than the global average of 258 days. This relative strength is partly due to the rapid adoption of artificial intelligence (AI)-enabled security tools, now used by 78% of local organisations.

These tools are transforming what security teams call “time to context” (the time it takes to understand what happened, who is affected, and what to do next). Instead of trawling through disconnected email archives, Teams logs and Slack channels, AI can consolidate signals across systems in minutes, presenting a clear, unified view of an incident.

With anomaly detection, based on years of behavioural and metadata patterns, it allows attacks to be identified earlier. It also equips leaders to respond decisively, not just meeting the Protection of Personal Information Act’s 72-hour notification requirement, but to manage stakeholder and market expectations.

Getting started

But detection is only half the story. The real risk lies in what happens next. When an attack hits, security teams often spend days figuring things out, after attackers have wreaked their havoc in hours.

Globally, full recovery remains painfully slow, with 65% of organisations still not fully recovered 100 days after a breach. During this time the financial impact compounds. But research shows that an average shareholder loss of 30% drops sharply when response times improve, to 4% if addressed within hours, 10% within days, and rising again if recovery drags into weeks.

AI is beginning to close this gap by collapsing investigation timelines from days into minutes. By unifying search across all communication channels into a single interface, organisations can accelerate decision-making, contain damage faster, and reduce direct and indirect costs, many of which, such as reputational harm, are difficult to quantify but deeply felt.

For boards, time is money

Boards are paying attention. The cost of a cyber incident is no longer defined by ransom demands alone, but also by detection and escalation work, downtime, investigations, regulatory exposure, legal risk and the erosion of revenue and customer trust.

Poorly handled incidents amplify these costs. This includes slow or confused disclosure, which increases the risk of fines, prolonged disruption and reactive remediation with ad‑hoc mop‑up exercises, often requiring expensive third‑party support.

As it’s simply a matter of time before an organisation is attacked, the boardroom conversation has shifted. The question is no longer, “Are we secure?”, but “How quickly can we recover?” This shift is redefining expectations of the chief information security officer (CISO), with boards now looking for the following:

• Measurable resilience. CISOs must track key metrics such as mean time to identify and contain a breach (the time to context), and show how these compare with global benchmarks.
• A living cyber resilience strategy that is not just a document on a shelf, but a regularly tested, simulated and improved capability. Regulators are increasingly focused on evidence: when plans were last exercised, how they performed, and what has improved since.
• Visibility into emerging risks, particularly the use of shadow and unsanctioned AI tools. Boards want assurance that leadership understands how employees are using AI, what data may be exposed, and what guardrails are in place.

Boards are not expecting guarantees that breaches will never happen. They are looking for proof that when they do, the organisation can move from impact to recovery at speed. That is the new benchmark for cyber maturity: not prevention alone, but tested plans leveraging key metrics that can control new risks and protect value when it matters most.

Significantly, they are demanding that every rand invested in resilience will meaningfully reduce the financial, regulatory and reputational cost of the next inevitable incident.

• Gevers is senior director: technical support at Mimecast.