Coder Legion - Recent posts tagged cyberresilience

South Africa Accounts for 92% of Africa’s Ransomware Detections. Here’s What IT Teams Should Learn From It

Tue, 22 Sep 2026 18:29:39 +0000

South Africa has become a major focal point in Africa’s ransomware landscape.

According to INTERPOL’s African Cyberthreat Assessment Report 2026, South Africa accounted for 92% of ransomware detections recorded across Africa in 2025, based on TrendAI telemetry. That figure is striking, but it needs context: it represents detections, not proof that 92% of all ransomware attacks on the continent occurred in South Africa.

Even with that distinction, the signal is impossible to ignore.

South African organizations are operating in an environment where highly connected businesses, government institutions and critical services are attractive targets. And the most useful lessons are not found in the percentage itself. They are found in the incidents behind it.

Recent attacks against organizations such as the National Health Laboratory Service (NHLS) and the South African Weather Service (SAWS) demonstrate that ransomware is no longer simply an endpoint-security problem.

It is a business continuity problem.

The 92% Statistic Is a Warning, Not the Whole Story

A common reaction to a statistic like this is to ask why South Africa is being targeted more heavily than other African countries.

There is a more useful question for IT leaders:

Why do some attacks become business crises while others remain contained security incidents?

South Africa's highly connected digital economy means attackers have access to valuable systems and data, while organizations often depend heavily on technology to deliver essential services.

INTERPOL's latest assessment also highlights a wider cyber-threat environment involving phishing, business email compromise, vulnerabilities and increasingly automated attacks. South Africa accounted for 70% of Africa's business email compromise detections in 2025, according to the same TrendAI telemetry.

The lesson is that ransomware rarely exists in isolation.

It often begins with the things security teams already worry about: a stolen credential, a phishing message, an exposed vulnerability or excessive privileges.

The Incidents Behind the Headline

The NHLS ransomware attack in June 2024 is one of the clearest examples of how a cyber incident can quickly become an operational emergency.

The attack encrypted systems used by the National Health Laboratory Service, affecting internet and intranet services, the laboratory information system and access to historical laboratory data. Because NHLS provides diagnostic pathology services to more than 80% of South Africa's population, the disruption extended far beyond an internal IT environment.

The important lesson is not simply that healthcare was attacked.

It is that critical services continued to depend on systems that were suddenly unavailable.

The South African Weather Service experienced a similar reality after a January 2025 cyberattack that affected most of its systems. Its annual report records that data recovery continued while the organization used alternative mechanisms to distribute severe-weather warnings and information.

That is what ransomware resilience ultimately looks like.

Not preventing every incident.

Continuing to operate when prevention fails.

The Attack Path Is More Important Than the Ransom Note

Ransomware tends to receive attention when files are encrypted and a ransom demand appears.

Defenders should be looking much earlier.

A simplified attack path looks like this:

Initial Access → Identity Compromise → Lateral Movement → Privilege Escalation → Data Access → Encryption/Disruption

The important part is the middle.

An attacker who reaches the encryption stage has often already succeeded at several earlier stages.

That means an organization's security programme cannot depend entirely on detecting ransomware at the endpoint. It needs visibility into the behaviors that often precede it.

Unusual sign-ins. Suspicious privilege changes. Unexpected remote administration. Abnormal PowerShell activity. Attempts to disable security tools. Large-scale access to files. Unusual movement between systems.

These signals can provide defenders with something incredibly valuable: time.

And in ransomware response, time is often the difference between isolating one compromised machine and recovering an entire environment.

Identity Has Become a Critical Security Boundary

For organizations using Microsoft 365, Entra ID, Intune and Defender, identity deserves particular attention.

A compromised account can provide an attacker with a much easier path into an environment than attacking every endpoint individually.

That makes strong authentication, Conditional Access, privileged-access management and identity monitoring essential parts of ransomware defense.

Multi-factor authentication is important, but it should not be treated as the finish line.

IT teams should also ask whether privileged accounts are separated from normal user accounts, whether dormant accounts are removed, whether service identities are properly governed, and whether suspicious authentication behavior is being investigated quickly.

The objective is simple:

A compromised account should not automatically become enterprise-wide access.

Backups Are Not the Same as Recovery

Ransomware conversations often end with the phrase:

“We have backups.”

That is not enough.

The better question is:

Can we still recover if the attacker compromises an administrator account and discovers our backup infrastructure?

This is why immutable, isolated and offline recovery mechanisms matter.

The South African Weather Service's post-incident procurement requirements provide a useful example. Its specifications called for capabilities including immutable and air-gapped backups, anomaly detection, malware scanning and Zero Trust controls.

The broader lesson is that backup security must be designed around an attacker who is already inside the environment.

And backups must be tested.

A backup that has never been restored successfully is an assumption, not a recovery strategy.

The Biggest Gap May Be Business Continuity

The NHLS incident exposed another important problem: traditional downtime procedures are not necessarily designed for a cyberattack.

A ransomware event can simultaneously affect applications, authentication, network access, files and internal communications.

That makes cyber resilience fundamentally different from planning for a normal infrastructure outage.

IT teams should be able to answer:

What happens when our primary identity service is compromised?

What happens when our file servers cannot be trusted?

What happens when users cannot access normal collaboration tools?

Which business services must be restored first?

These are not purely technical questions.

They require IT, security, operations and business leaders to agree on priorities before the incident occurs.

From Reaction to Resilience

The biggest mistake South African organizations could make is treating the 92% figure as another alarming cybersecurity headline.

The better response is to use it as a design challenge.

Assume that a credential will eventually be compromised.

Assume that an endpoint will eventually be breached.

Assume that an attacker will eventually bypass one of your controls.

Then ask what happens next.

Can the attacker move laterally?

Can they obtain privilege?

Can they reach the backup environment?

Can they disable security controls?

Can you detect them before encryption begins?

Can you isolate affected systems quickly?

Can the business continue operating?

Can you restore the most critical services in the correct order?

Those questions reveal far more about an organization's ransomware resilience than the number of security products it owns.

What South African IT Teams Should Do Now

The practical response does not need to begin with buying another security platform.

Start by understanding where one compromised identity or device could cause disproportionate damage.

Prioritize privileged identities. Strengthen authentication. Reduce unnecessary administrative access. Patch externally exposed systems quickly. Segment critical services. Protect backup infrastructure from ordinary administrative paths. Centralize security telemetry. Define clear isolation procedures. Test recovery.

Most importantly, run an exercise that assumes the attackers have already bypassed the first layer of defense.

The objective should not be to prove that the security controls work.

It should be to discover what happens when they do not.

The Real Meaning of 92%

South Africa accounting for 92% of Africa's ransomware detections is a statistic worth paying attention to.

But the percentage is not the most important part of the story.

The more important story is what recent incidents have demonstrated: when ransomware succeeds, the consequences can move rapidly from compromised credentials and encrypted systems to disrupted public services, delayed operations and difficult recovery decisions.

That changes the question IT leaders should be asking.

Not:

“How do we stop ransomware?”

But:

“How do we make ransomware less capable of stopping us?”

That is the difference between cybersecurity and cyber resilience.

And for South African IT teams, it may be the most important lesson behind the 92%.

When the Attacker Has Admin Privileges: Everpure's Case for Making Storage the Last Line of Defense

Tue, 19 May 2026 13:23:35 +0000

A Fortune 100 organization got hit hard. Attackers used stolen credentials and native tools — no malware. They deleted thousands of endpoints and virtual clusters. Traditional defenses never fired.

But the data layer? Untouched.

That's the story Brandon Willitts, Director of Cyber Resilience at Everpure, keeps coming back to. Not because it's a good marketing story — though it is — but because it illustrates a shift in how security and engineering teams need to think about recovery.

"We don't ship storage," Willitts told me. "We ship trust."

How That Fortune 100 Organization Actually Recovered

Willitts didn't want to speculate on how the attackers pulled it off. But he was direct about how recovery happened — and it's worth paying attention to the specifics.

"We trained a customer engineer in 20 minutes to recover snapshots," he said. Not days. Not a war room of 15 people with a 200-page runbook. Twenty minutes.

That's possible because of how SafeMode snapshots work. The configuration is out-of-band — no single admin, machine, or human being can reach in and misconfigure or delete that access and control point. The snapshots are immutable and indelible. When the attack hit, the attacker had global admin privileges everywhere else. They had nothing at the storage layer.

"Your identity system is going to be compromised. Your endpoints are going to be compromised. Your network is going to be compromised," Willitts said. "But what happens when it gets to the storage and there's an entire deletion of that data? How do you recover?"

If you have SafeMode configured, you already know the answer.

The Gap Between "DevOps Backup" and Actual Recovery

Most developers think about backup as a checkbox. Snapshots. S3 buckets. Maybe an off-site copy. Willitts isn't dismissive of that — he just says it misses the point.

"You take backups for a lot of different reasons," he said. "But there's been a disconnect between where IT operations sits in an organization versus the business outcomes they're trying to support."

He gave a concrete example: a hospital where nurses can't see patients because the system is down. Recovery isn't about retrieving data. It's about opening the doors tomorrow — processing loans, seeing patients, running payroll.

"We aren't just recovering from a backup. We're making sure you can recover your business."

That reframe matters for developers and platform engineers. Backup is not a one-size-fits-all problem. The question isn't whether you have a copy of your data. It's whether you can get to the right copy, fast, and know it hasn't been tampered with.

The Human-in-the-Loop Isn't a Bottleneck

One detail in Everpure's architecture that caught my attention: the Human-in-the-Loop (HITL) requirement. For a developer audience that's used to automation handling everything, mandatory human authorization sounds like a recovery killer.

Willitts pushed back on that reading. The HITL requirement applies to deletion, not recovery. You don't need multi-party authorization to restore your data. You need it to delete it.

"We're providing a security layer for the event that your credentials are compromised," he said. "If you want to delete your data, you need multiple parties present. You don't need multiple parties present to recover your data."

SafeMode is auto-on by default. The snapshot capability is always there. The human layer is protection against a compromised identity or a rogue agent — not a gate between you and your data when you need it back.

On AI: The Velocity Changed, Not the Playbook

Willitts has an interesting take on AI-accelerated attacks that's worth hearing directly. He's not an alarmist.

"The attack patterns aren't changing. It's the velocity with which you're seeing attacks that's changing."

Wiper attacks aren't new. Credential harvesting isn't new. What AI does is put those things on hyper drive. The attack window, he said, is now down to 15 minutes in some cases.

"Security is no longer compliance," he said. "You're not waiting around for someone to eventually patch that system. You're doing it now because the attack window is 15 minutes."

That has a practical implication: the controls you configure today need to hold up against an attacker moving at machine speed. Which is exactly why out-of-band configuration and immutable snapshots aren't nice-to-haves anymore.

Where Platform Engineers and SREs Should Start

If you're an SRE or platform engineer thinking about the "outside-in" model — assuming perimeter failure as your baseline — Willitts had a straightforward answer.

Start with your primary. Configure your basic security controls and resilience policies. Then set up a secondary site, whether public cloud or on-prem, and replicate across sites. Turn SafeMode on. And then — this is the part most teams skip — test it.

"Test it, and test it, and test it," he said. "You build that muscle. The more you sweat in peace, the less you bleed in war."

He drew the comparison to Netflix's chaos engineering approach — injecting failure modes in a production environment until recovery becomes muscle memory. You start in dev and staging. You work up to production. The goal is making it easy to do the right thing, not adding another tax on your engineers.

"We all love bridges and roads and we hate taxes," he said. "Same is true with security. You have to make it easy to do the right thing."

What the 1touch Acquisition Actually Adds

Everpure's acquisition of 1touch isn't just about data discovery as a feature. It's about business context — specifically, knowing what depends on what before the incident.

"Everybody is independent," Willitts explained. "You're asking Steve to ask Alicia to ask Stan what they think is important. And everyone is incented to think their stuff is most important."

But an ERP system that sits idle most of the quarter might be mission-critical on the last day. Without knowing the dependency map between applications, data, and business outcomes, recovery becomes guesswork.

The 1touch integration is meant to replace that guesswork with a policy-driven unified view — arrays, applications, regions, protection policies — surfaced in a single control plane. No one has to ask what's most important. The policies already know.

The Metric That Actually Matters

Willitts closed with the reframe that his team keeps pushing: downtime, not intrusion, is the number that matters.

He's not saying stop investing in the perimeter. The opposite. "Continue to invest," he said. "Lock your doors and lock your safe." Defense in depth still applies. But if you're not equally serious about what happens after the breach, you're building a security program that can detect a fire and has no sprinklers.

"Resilience and security are two sides of the same coin," he said. "Especially in today's day and age."

That's the ask. Not a replacement for what you're already doing. An honest look at whether you can recover — and how fast — when the thing you're defending against actually happens.

Tom will be covering Everpure Accelerate next month. Stay tuned for more from the event.

Why Data Governance and AI Governance Matters

Mon, 15 Sep 2025 05:31:29 +0000

How Strong Governance Frameworks Drive Responsible AI and Data Use

Imagine a world where AI-generated deep fakes sway elections, fake news spreads like wildfire, and your personal data fuels unseen biases in decisions that affect your life. This isn't science fiction—it's today's reality. In this digital storm, data and AI governance isn't just a buzzword; it's your organization's lifeline.

Introduction

Picture this: In 2019, Apple Card's AI algorithm charged a couple different interest rates based on gender, sparking bias accusations and regulatory scrutiny Apple Card gender bias. Or consider the 2022 deep fake video of Ukraine's President Zelenskyy falsely urging surrender, nearly derailing wartime morale Zelenskyy deepfake video. These aren't rare mishaps—they're stark warnings. Without solid governance, data and AI can amplify misinformation, question source credibility, and cause real harm, from financial discrimination to geopolitical chaos.

That's where data governance and AI governance step in. These frameworks aren't bureaucratic hurdles; they're smart strategies to handle data ethically, securely, and openly. They make AI reliable and fair, shielding against biases, privacy slips, and deep fake disasters. In the end, they forge unbreakable trust with customers, regulators, and partners. Ready to navigate this landscape? Let's dive in.

Data Governance and AI Governance: Building Trust in the Age of Intelligent Data

What is Data Governance?

Ever wondered why some companies thrive on data while others stumble into scandals? The difference? Data governance—the backbone that keeps your data sharp, safe, and purposeful from collection to deletion.

Think of it as the rulebook for your data's lifecycle: policies, processes, and standards ensuring accuracy, availability, and responsible use.

Key Elements:

Data Quality Management: Scrub out errors to make decisions you can bank on.
Data Privacy and Security: Lock down sensitive info against hackers and leaks.
Compliance with Laws: Stay ahead of GDPR, CCPA, and beyond to dodge hefty fines.
Data Ownership and Stewardship: Assign clear guardians so no data falls through the cracks

"Data governance isn't a checkbox—it's the spark that turns raw data into trusted insights and business gold."

Take Target's 2012 pregnancy prediction fiasco: Their AI sent tailored ads to a teen based on shopping data, outing her pregnancy to her family and igniting a privacy firestorm Target pregnancy prediction. Or the 2017 Equifax breach, where poor data stewardship exposed 147 million people's info, leading to $700 million in settlements (Equifax breach settlement). Strong governance prevents such self-inflicted wounds.

What is AI Governance?

Now, extend that rulebook to AI. As machines learn and decide, AI governance ensures they're not just smart, but ethical and aligned with your values.

It's about guiding AI from design to daily use: making it transparent, unbiased, and accountable.

Key Elements:

Why Data Governance and AI Governance MattersClear and Explainable Algorithms:** Demystify the "black box" so you know why
AI decides what it does.
Detecting and Fixing Bias: Root out unfair patterns before they discriminate.
Accountability for Decisions: Pin responsibility on humans, not just code.
Ongoing Checks and Audits: Monitor like a hawk to catch drifts early.

In the generative AI boom, this is crucial. Recall the 2024 deep fake of Taylor Swift promoting lewd content, viewed millions of times before takedown, highlighting how ungoverned AI erodes trust in digital media (Taylor Swift deepfake). Or the 2023 case where AI chatbots like Google's Bard hallucinated facts, misleading users on critical topics (Google Bard error). Proper oversight verifies sources, halts misinformation, and keeps content credible—vital for industries like news, finance, and healthcare.

Why Governance Matters: Key Benefits

Why bother? Because in a world drowning in data and AI hype, governance isn't optional—it's your competitive edge. It turns potential disasters into opportunities.

Trust: Verify sources and cut false info, reassuring users who stick with you longer.
Compliance: Sidestep regulatory traps and fines that could sink your budget.
Quality: Deliver spot-on data and AI outputs, minus errors or hidden biases.
Security: Fortify against breaches that expose your secrets.
Innovation: Scale AI boldly, taming risks like deep fakes in ads or ops.

Consider the 2018 Cambridge Analytica scandal: Facebook's lax data governance allowed harvested user data to manipulate elections, costing $5 billion in fines and shattering public trust Cambridge Analytica scandal. Or the 2020 Hong Kong deep fake audio scam, where fraudsters mimicked a CEO's voice to swindle $35 million in transfers—caught only by quick human intervention Hong Kong CEO deepfake scam. Governance isn't just protection; it's the key to fearless innovation. Without it, one misstep can tarnish your brand forever.

5 Key Points for Effective Data & AI Governance

Building a fortress around your data and AI doesn't have to be overwhelming. Here's your roadmap—simple steps to supercharge your setup:

Set Clear Policies: Define who's who and what's what in data and AI ops. No gray areas.
Promote Transparency: Shine a light on data sources, AI logic, and decisions. Knowledge builds confidence.
Check Regularly: Run audits like clockwork to ensure quality, fairness, and compliance.
Involve Teams: Rally business, tech, legal, and ethics pros—diverse eyes spot blind spots.
Use Tools: Harness tech to automate the grunt work, freeing you for big-picture wins.

Implement these, and watch governance evolve from chore to champion, just as companies like Microsoft have with their AI ethics board Microsoft responsible AI.

Best Practices and Resources

Theory is great, but action wins. Here's how top players make governance stick—and how you can too.

Follow Standards: Lean on proven playbooks like the NIST AI Risk Management Framework for AI or ISO/IEC 38500-1:2024 for data. They're battle-tested, as seen in IBM's compliance with NIST to avoid AI pitfalls IBM AI ethics.
Train Staff: Empower your team with workshops on ethics, privacy, and AI pitfalls. Make spotting deep fakes second nature, like how journalists now use tools post-Zelenskyy incident.
Adopt Platforms: Streamline with tools like Collibra for data catalogs or Alation for collaboration—IBM's suite packs a punch too, helping firms like Deloitte manage vast datasets securely .
Leverage Blockchain and Web3: Blockchain's tamper-proof ledgers track data lineages immutably, boosting transparency. Web3 decentralizes control, empowering users to own their data via smart contracts—perfect for privacy-first ecosystems like DeFi or NFTs, as in Estonia's e-governance blockchain for citizen data .
Apply Ethical Practices: Bake in privacy by design from day one. Conduct routine ethical audits and assemble diverse teams to squash biases. Embrace principles from the EU AI Act: fairness, accountability, and transparency aren't suggestions—they're safeguards, evident in how OpenAI audits models to prevent biases like those in early GPT versions OpenAI safety.

Start small: Pick one practice, measure impact, then scale. Your future self (and stakeholders) will thank you.

Conclusion

In the rush of AI and data revolutions, governance might seem like the boring bit. But flip that script: It's the hero ensuring your innovations don't backfire. From dodging deep fake debacles to building ironclad trust, strong data and AI governance unlocks true potential—legally, ethically, and profitably.

Don't wait for a crisis like Equifax or Cambridge Analytica. Assess your current state today. Grab a framework, rally your team, and chart a course. The age of intelligent data is here—what will you build?

Ready to act? Your first step: Schedule a governance audit this week.

Key Takeaways:

Governance isn't red tape—it's your trust engine in a data-driven world.
Tackle real risks like deep fakes head-on with transparency and checks.
Team up, tool up, and ethic up for sustainable wins.
Innovate fearlessly: Strong governance turns threats into triumphs.

For More Insights, Visit:

Data Governance Institute – Practical tools and certs.
AI Now Institute – Cutting-edge AI ethics research.

AI agents now autonomously protect, recover, and manage enterprise data without human intervention.

Tue, 19 Aug 2025 13:01:35 +0000

Druva's DruAI Agents: How Agentic AI is Revolutionizing Data Security for Developers

Hook: AI agents now autonomously protect, recover, and manage enterprise data without human intervention.

The cybersecurity landscape just shifted dramatically. Druva, a leading data security provider, has announced the industry's first AI agents specifically designed for cyber resilience, marking a pivotal transition from reactive AI tools to proactive, autonomous systems that can take meaningful action on behalf of developers and IT teams.

Beyond Query-Based AI: The Rise of Agentic Systems

Traditional AI in cybersecurity has largely been limited to answering questions and providing insights. You ask, it responds. But Druva's new DruAI Agents, built on Amazon Bedrock AgentCore, represent a fundamental shift toward agentic AI; systems that can interpret intent, analyze complex data patterns, and execute tasks autonomously.

For developers, this isn't just an incremental improvement; it's a paradigm shift. Instead of manually piecing together recovery workflows or digging through dashboards to understand security anomalies, AI agents now handle these complex orchestrations independently.

Three Types of AI Agents Working in Concert

Druva has architected three distinct but interconnected agent types, each serving specific functions in the data security ecosystem:

Data Agents function as intelligent sentries, continuously monitoring telemetry data, risk indicators, and historical patterns. They surface critical signals and trends that might otherwise remain buried in vast datasets, essentially providing developers with a real-time threat intelligence layer that requires no manual analysis.

Help Agents serve as AI-powered consultants, troubleshooting problems, investigating incidents, and recommending optimal next steps. For development teams dealing with security incidents, these agents can dramatically reduce mean time to resolution by providing contextual guidance based on similar historical events.

Action Agents represent the most significant advancement, AI that not only recommends but also executes. These agents can orchestrate full workload recovery, create protection policies, adjust retention settings for cost optimization, and perform other complex operational tasks that traditionally required extensive manual intervention.

Real-World Impact: From Hours to Minutes

The practical implications for developers are substantial. Consider a common scenario: an EC2 instance compromise requiring full restoration. Previously, this involved manually coordinating instance recovery, volume restoration, network reconfiguration, and security policy reapplication, a process that could take hours and required deep infrastructure knowledge.

With DruAI Agents, developers can issue a single command: "Restore the compromised production web server from yesterday's backup." The Action Agent then orchestrates the entire recovery process, including infrastructure components, configurations, and networking—all in one automated workflow.

Early metrics from Druva's deployment are impressive. The company reports that 63% of customer issues are now resolved directly through DruAI, while cases requiring human intervention are resolved 58% faster. Perhaps most critically for enterprise adoption, the system maintains a 0% hallucination rate, crucial for security-critical operations.

Security and Privacy by Design

For developers working in regulated environments, DruAI's security architecture addresses common AI deployment concerns. The system operates with zero-trust methodology and leverages existing API integrations to maintain the same rigorous permissions and access controls already in place.

Crucially, DruAI doesn't access or learn from customer data. Built with isolated large language models and private Retrieval-Augmented Generation (RAG), the system works exclusively with organizational metadata while keeping sensitive information encrypted and compartmentalized.

The Developer Experience: Natural Language Infrastructure

One of DruAI's most compelling aspects for developers is its natural language interface for complex infrastructure operations. The system allows teams to express intent in conversational terms while the underlying agents translate this into precise technical execution.

This capability is particularly valuable for organizations with diverse technical skill levels. Junior developers can perform sophisticated recovery operations without deep infrastructure expertise, while senior engineers can focus on higher-level architectural concerns rather than routine operational tasks.

Testing and Validation: Synthetic Data Environments

Recognizing that developers need confidence before deploying AI in production environments, DruAI includes synthetic dataset capabilities. Teams can test AI prompts, simulate recovery scenarios, and evaluate outputs within secure sandbox environments, allowing for thorough validation and user training before production deployment.

Looking Forward: The 12-Month Roadmap

Druva's ambitions extend well beyond current capabilities. Over the next year, the company plans to reduce average cyber investigation time by up to 70%, enable 90% of routine data protection tasks through natural language interactions, and compress backup troubleshooting from hours to minutes.

For the broader developer community, DruAI represents a glimpse into the future of infrastructure management—where AI agents handle routine operations, enabling human expertise to focus on innovation rather than maintenance.

The Broader Implications

Druva's announcement signals a maturation of AI in enterprise environments, moving from experimental implementations to production-ready autonomous systems. For developers, this evolution promises not just improved efficiency but a fundamental reimagining of how we interact with complex infrastructure systems.

As agentic AI becomes more prevalent, developers who understand how to work alongside these autonomous systems—designing for AI collaboration, understanding agent capabilities and limitations, and leveraging natural language interfaces effectively—will have significant competitive advantages.

The era of AI as a passive tool is ending. The age of AI as an active teammate has begun.