Insider Threats Rise In South African Organisations As Human Risk Becomes A Growing Security Concern

The company’s ninth annual State of Human Risk Report shows that 46% of South African organisations reported a rise in malicious insider activity, matching the 46% that reported an increase in negligent insider incidents. The parity between deliberate and accidental insider threats marks a shift in the risk profile facing enterprises.

Globally, the proportion of organisations reporting increased concern about malicious insiders rose from 33% in 2024 to 42% in 2026. The study surveyed 2,500 IT security and decision-makers across nine countries.

The report estimates that organisations experience an average of six insider-driven incidents per month, with an average cost of $13.1m per incident. Two-thirds of respondents expect insider-related data loss to increase over the next 12 months.

The findings also highlight gaps in preparedness as artificial intelligence becomes more embedded in attack methods. While 69% of South African security leaders believe AI-driven attacks are inevitable within a year, 60% say their organisations are not fully prepared.

Collaboration tools are emerging as a growing vulnerability. In South Africa, 38% of organisations rely solely on native security controls for collaboration platforms, despite 62% acknowledging that these controls are insufficient against modern threats.

Governance and compliance challenges also persist. The study found that 92% of South African organisations face difficulties maintaining governance and compliance over communications data, and 52% lack confidence in their ability to quickly locate data to meet regulatory or legal requirements.

Tool fragmentation appears to be compounding the risk. More than half of South African respondents said security tool integration is too complex, while only 28% of organisations globally combine regular security awareness training with continuous monitoring.

Mimecast’s chief information security officer, Leslie Nielsen, said insider risk is increasingly being exploited as a route to bypass perimeter defences, with both negligent behaviour and deliberate actions contributing to incidents.

The report concludes that organisations need more coordinated approaches that integrate visibility across communication channels, behavioural analytics, data governance and incident response, as threats become more sophisticated and interconnected.