You’re tired, your mind half on the weekend ahead, when your phone lights up with a call from the CEO. You don’t question it. You’ve heard that voice in dozens of meetings. It’s firm and familiar, the kind that makes you sit up straighter. “It’s urgent,” the CEO says. “We need to move funds now.”
As Cyber Security Awareness Month begins, it’s a reminder that attackers target trust, not just firewalls, and it’s up to all of us to keep questioning, even when the request feels routine.
You want to prove yourself. The request feels weighty, but the tone is so natural, so close. So, you do what you think is right, what you think is expected, never suspecting that everything you trusted was just a sophisticated fake.
So, you process the transfer. You do exactly what any loyal, efficient employee would do under pressure.
But the truth is chilling: the call never happened. That familiar voice, those reassuring pauses, an algorithm stitched every nuance together using just a snippet of public audio. No firewall to breach. No passwords to crack. The only system that needed hacking was human trust.
This is exactly how engineering giant Arup lost roughly US$25 million after an employee in Hong Kong sat through a video call with what appeared to be their real chief financial officer and colleagues, as highlighted in a forensic analysis of the Arup Deepfake Case Study.
The Axis has shifted
To be clear, the technical battleground hasn’t disappeared. Verizon’s 2026 Data Breach Investigations Report shows that exploiting software vulnerabilities has climbed to the top spot for initial system access, accounting for 31% of breaches. But look closer at that same dataset: 62% of confirmed breaches still involve the human element. Local research from the SABRIC Annual Crime Statistics Report outlines a parallel domestic crisis, revealing that digital banking fraud skyrocketed to R2.41 billion in losses, driven heavily by vishing and aggressive social engineering tactics.
Generative AI has weaponised imitation. Your firewall is a moat, but the drawbridge is trust, and AI now wears a masterfully convincing disguise. Technology can scan for threats, but it cannot read doubt in a trembling voice or catch the hesitation behind a seemingly routine request.
We are currently staring down three distinct AI-driven operational risks:
- Voice clones on live calls: Scavenging a minute of public audio lets threat actors mimic an executive’s authority in real-time conversations and override standard internal checks.
- Deepfake video encounters: As seen in the Arup incident reported by The Guardian, attackers can fabricate entire virtual meeting rooms, generating instant unearned trust.
- Shadow AI Exposures: This isn’t external fraud, but honest insider error. It happens when well-meaning employees try to clear workloads faster by pasting proprietary client data, source code, or unreleased financials into public, unsecured AI engines, leaving your corporate data sitting in third-party training logs.
The first two exploits leverage corporate authority. The third leverages employee convenience. Each one completely bypasses your technology by manipulating your people.
The legal and governance reality for SA Boards
Under our Companies Act, directors have an explicit fiduciary duty to act with the care, skill, and diligence reasonably expected of someone in their position. Furthermore, POPIA requires responsible parties to deploy strict technical and organizational measures to safeguard personal data, risking severe regulatory friction and heavy administrative penalties from the Information Regulator of South Africa if a systemic enforcement failure occurs.
The governance bar has risen even higher. The King V Code, active for financial years starting on or after 1 January 2026, places information, data governance, and explicit AI oversight directly in the hands of the governing body. By streamlining the framework down to 13 core principles, King V introduces a mandatory Disclosure Framework that replaces vague intent with outcome-based reporting. While King V remains a voluntary framework, it sets the exact benchmark by which a director’s standard of conduct will be legally measured in court.
When an incident hits, the regulator will not ask your IT team what security software they bought. They will ask the board what systemic questions they asked before the attack.
Before signing off on your quarterly risk register, verify if your board can confidently answer these four operational questions:
- Treasury stress-testing: When did we last stress-test our treasury and payment-approval processes against a deliberate, simulated impersonation attempt?
- Escalation safety: Do our mid-level and junior employees know exactly who has the institutional permission to challenge a direct order from the CEO?
- Shadow AI footprint: What public AI platforms are our teams actively using today, and what specific corporate data has entered them over the last six months?
- Friday-night protocol: If an employee flags a critical security mistake at 6:00 PM on a Friday, do they feel safe escalating it immediately, or will they wait until Monday morning?
If these questions met silence or hesitation around the table, that is your primary vulnerability.
This Cyber Month, resilience isn’t about the strength of your firewalls or the length of your compliance checklist. It’s about the courage to pause, the freedom to question, even when the request comes from the very top, and the shared responsibility to report mistakes without shame. Security is not a product, but a culture, built in every conversation, every challenge, and every moment of candour.
By Sega Tiro, Executive of Commercial and Growth at ASI Connect