South African Businesses Must Understand Cloud Security Responsibilities

Christo Coetzer, CEO of BlueVision. (Photo: Supplied) As my team and I engage with South African businesses on a daily basis, it is becoming increasingly apparent that there is a major misconception with enterprises in this country that take executive decisions on security strategy under the assumption that a move to the cloud means security is assured. The fact of the matter is that it is not. Cloud providers secure the infrastructure they run − the data centres, the physical servers, the underlying network. What happens inside that infrastructure, who has access, which accounts are compromised, which services are exposed to the open internet and more, remains the customer's responsibility. This is what's labelled as a shared responsibility model and it is one of the least understood concepts in South African business today. Local companies have embraced cloud with a bang. Microsoft 365, Azure, AWS − the migration to cloud platforms is, for most organisations, long since complete. What has not kept pace is a corresponding shift in how those businesses think about security. An attacker rarely needs to "hack" their way into a modern cloud environment in the cinematic sense. Many a slip twixt cup and lip − expect these outcomes if security strategy is founded on misunderstanding. The consequences of this approach are measurable. Globally, and locally, identity-based attacks, including stolen credentials, compromised accounts, unusual or unauthorised access, etc, now sit behind the majority of breaches. An attacker rarely needs to "hack" their way into a modern cloud environment in the cinematic sense. Far more often, they simply log in, using a password an employee reused from another service, or a session token lifted through a phishing page that looked exactly like the real thing. What makes this particularly dangerous is the discovery gap − this is where it gets truly disconcerting. Many organisations only learn they have been compromised weeks after the initial breach − often when the damage is already done, data has already moved, or a regulator or customer has already noticed. In a country where the Protection of Personal Information Act places direct obligations on companies to safeguard personal data and report breaches, that discovery gap is not just an operational problem. It is a compliance and reputational one. A second less obvious problem is compounding this issue and that is alert fatigue. Most security tools generate volumes of notifications that no internal IT team, no matter how capable they are, can meaningfully triage on top of their day jobs. The result is not too little information − it is too much of the wrong kind, with the handful of alerts that actually matter buried in noise. Businesses end up with visibility that looks impressive on a dashboard but delivers little or no useful information about their actual risk. That last point deserves more attention than it typically gets. Security has traditionally been reported upward in technical language, CVEs, log volumes, patch cycles, etc. That means little to a board of directors, or an executive committee whose job is to weigh business risk, not read raw telemetry. Under King IV, directors carry a governance responsibility for technology and information risk, yet many are asked to discharge that responsibility based on reports they cannot properly interrogate. If the executive management of a company cannot understand its own cyber exposure in the same terms it understands credit risk or currency exposure, it cannot govern the business responsibly. None of this argues for abandoning the cloud, or for a return to on-premises infrastructure as some kind of safer default − it is not. This narrative serves to deliver a more honest conversation around what is actually required to 'secure' the business once cloud migration is done. In a nutshell, continuous visibility into identity and cloud configuration is essential; expert judgement applied to what the tools