The financial services sector continues to stand on the frontline of cyber risk. As digitalisation accelerates and interconnectivity deepens, the fourth quarter of 2025 reaffirmed both the sector’s growing cyber maturity and the evolving sophistication of adversaries targeting it.

The savings, investment, and insurance industry associations — the Association for Savings and Investment South Africa (ASISA) and the South African Insurance Association (SAIA) — jointly established a Computer Security Incident Response Team (ASISA/SAIA CSIRT) in 2020. The CSIRT monitors industry-related cyber incidents, coordinates response mechanisms, facilitates information-sharing, and sources global intelligence and expertise. Its primary objectives include reporting on trends, emerging threats, and attack methods; supporting members in combating cybercrime and strengthening their security posture; engaging with key stakeholders; representing industry interests; and contributing to the development of South Africa’s cybercrime-fighting skills.

A Guarded Yet Unsettled Threat Landscape

According to the latest ASISA-SAIA Cybersecurity Incident Response Team (CSIRT) Q4 2025 report, the overall cyber threat level for the financial industry remains Guarded (Green) — a sign of effective resilience, not complacency. Beneath this calm surface, however, lurk increasingly adaptive threats.

Phishing remains the dominant vector, with AI-driven and deepfake-enabled campaigns targeting executives becoming more prevalent. Criminal groups have learned to exploit information about leadership changes and corporate restructuring to craft convincing lures. Encouragingly, many financial institutions reported no major breaches, suggesting that employee awareness initiatives and improved email security protocols are yielding results.

Supply Chain and Cloud: The New Battlegrounds

The quarter highlighted the growing vulnerability of third-party platforms, with incidents involving Salesforce, Oracle, and the NPM ecosystem reinforcing the reality that a single compromised dependency can cascade across hundreds of organisations.

In the case of the Oracle E-Business Suite zero-day vulnerability (CVE-2025-61882), exploitation began weeks before a patch was issued. Although the most notable local victim was Wits University, the incident serves as a sobering reminder of how zero-day exploitation and supply chain weaknesses can expose even well-defended environments.

Compounding these risks, cloud-based ransomware attacks are evolving. The report details how the Storm-0501 threat actor is now leveraging Microsoft Azure’s interconnected environments to move laterally across tenants and execute cloud-native encryption. This marks a significant escalation from traditional ransomware tactics, which are a direct challenge to financial institutions’ hybrid infrastructure strategies.

The Cost of Complacency: Lessons from Abroad

Beyond South Africa’s borders, the Jaguar Land Rover cyberattack illustrates the devastating financial and economic implications of poor preparedness. The UK government’s £1.5 billion emergency loan to the automaker has been noted as the first of its kind in response to a cyber event. This underlines how cyber risk has become a systemic economic threat.

For the financial sector, where trust and uptime are paramount, such an incident would reverberate across markets and customers alike. The absence of cyber insurance coverage in JLR’s case adds another layer of concern, highlighting the need for robust risk transfer strategies alongside prevention and detection controls.

Collaboration: The Industry’s Strongest Defence

Encouragingly, South Africa’s financial sector continues to strengthen its collaborative defence posture. The ASISA-SAIA CSIRT exemplifies how collective intelligence-sharing and joint response protocols can help pre-empt large-scale incidents.

The coordinated awareness campaigns during Cyber Awareness Month and cross-industry participation in threat monitoring are proving instrumental in maintaining the sector’s overall guarded status. However, as the sector’s reliance on digital ecosystems expands from AI-driven services to cloud-native banking, vigilance must evolve in tandem.

Building the Future of Financial Cyber Resilience

The path forward requires more than patching vulnerabilities; it demands a shift in mindset. Financial institutions must treat cybersecurity not as an IT issue, but as a core business enabler — integral to customer trust, market stability, and regulatory compliance.

Key focus areas for 2026 should include:

• Continuous threat intelligence sharing between financial institutions, regulators, and law enforcement.
• Zero-trust adoption across hybrid cloud environments.
• Enhanced vendor due diligence, particularly for SaaS and API-integrated ecosystems.
• Scenario-based resilience testing, simulating both data compromise and operational disruption.
• Cyber insurance alignment with business continuity and recovery strategies.

The South African Insurance Association believes that the sector’s guarded status should not be mistaken for safety but rather, it reflects a well-calibrated state of readiness in an environment of perpetual risk. The threats are advancing, but so too is the industry’s capability to anticipate, adapt, and respond.

As South Africa’s financial system continues to digitalise, the real measure of progress will not be in the number of attacks prevented, but in the speed and unity with which the sector responds when they inevitably occur.