David Loxton chats about the current state of cybersecurity in South Africa
Banks, fintechs and other service providers invest heavily in cybersecurity. But is the network of third-party providers, technology partners and outsourced services they depend on as well protected as their internal operations?
“In the field, we sometimes see a relaxing of critical checks and balances, especially as the relationship between the organisation and its providers matures,” says David Loxton, CEO at Loxton Forensics.
Such complacency could cause a cybersecurity disaster with severe legal and reputational consequences.
A growing threat
AI and AI agents have introduced dangerous new forms of attack for cybercriminals, state-sponsored groups, hacktivists and others seeking to breach corporate systems.
Cybersecurity is now an evolving battleground on which organisations must continually adapt.
In July, autonomous AI agents broke free of their sandboxed testing environment at OpenAI, accessed the internet and launched an unauthorised cyberattack on the Hugging Face AI platform. Their objective was to obtain information needed to complete a task assigned by their trainers.
Imagine the consequences in the hands of a determined cyberattacker.
“Organisations are rushing to keep up, but they need to assure themselves that their vendors are moving at the same pace and all routes in their service supply chain are locked down,” says Loxton.
Trust no one
Under Zero Trust principles, companies should treat service providers and their systems as untrusted and vulnerable, even if cybersecurity audits suggest otherwise.
This demands continuous verification of external attempts to access, transfer or process their data.
“However, once the data is outside the organisation, providers must guarantee the appropriate level of system security required to protect it—one that cascades down to their own vendors,” says Loxton.
Most companies have contracts binding providers to strict SLAs, timely intrusion alerts, prompt patching, regular audits and other good practices.
Trouble arises when personal relationships compromise these commitments. Loxton says the worst sin is leniency.
Relationship woes
He has encountered poorly drafted contracts, even at major financial institutions, giving vendors too much leeway in implementing essential standards because of their reputation or previous dealings.
Even an ironclad contract can unravel. Renewals may be awarded without the strict reviews conducted at initial signing.
“Unfortunately, the trust developed between the parties can lead to an almost automatic renewal that assumes, without question, that the vendor has maintained its original standard,” says Loxton.
One-time deviations or compliance lapses may initially be overlooked but become more pronounced with each renewal.
“This can result in a fairly unregulated relationship with the vendor, leading to unacceptable operational and legal risks that go unnoticed until catastrophe strikes,” says Loxton.
Assured impartiality
Due diligence when onboarding a vendor is insufficient. Non-compliance typically emerges through ongoing monitoring, access-rights audits and reviews of incident notification obligations.
An independent department should regularly monitor vendors, assess their performance and review contractual obligations for inconsistencies.
“Most importantly, this independent body should monitor and review the relationship between the approver and the vendor to ensure contracts are based on demonstrable value rather than industry reputation or personal trust,” says Loxton.