On Friday 23 October, Rand Mutual Assurance (RMA), the insurer that handles compensation for workplace injuries and occupational diseases, received an alert about a possible breach of its systems. A threat actor has since claimed it holds 366GB of RMA data, including 1.68 million claims records and 593,786 files. It is demanding $95,000 (about R1.5 million) and has set a deadline of Thursday 5 November.
None of that is confirmed. RMA says it is still investigating and that whether personal information was accessed, acquired or disclosed “has not yet been established.” The claim first surfaced through a dark web monitoring account, which itself says it is unverified.
That uncertainty is the point. An unverified claim, a deadline, and no confirmed facts are the standard opening position of a modern extortion attempt. What matters is what an organisation can do inside that window. New research from Cisco suggests the limiting factor is rarely technology.
What Cisco asked 8,000 security practitioners
Cisco’s Relentless Defense Report 2026 surveyed 8,000 security professionals across 30 markets in April and May, including 170 in South Africa. These are self-reported responses, but the pattern is consistent. Asked what would have made the biggest difference in their last incident, about six in ten named an organisational blocker rather than a technical one. Cisco’s scoring reflects this, with internal friction carrying half the weight.
- Only 41% say security, network and IT operate as one team with shared visibility and tooling. Cisco’s local release puts South Africa at the same figure.
- 34% of South African organisations still coordinate incident response manually, according to Cisco South Africa’s general manager, Smangele Nkosi.
- Globally, around 60% take more than a day to update controls when a new threat is detected. Only 14% can do it in real time.
- Four in ten spend more time collecting and correlating data than dealing with the threat. 35% of South African respondents say critical insights are missed because the data sits out of reach.
- Money alone did not fix it. Of organisations that raised security spending, 41% saw fewer incidents and 45% saw incidents rise or stay the same.
Only 8% of organisations globally, and 9% in South Africa, qualified as “Relentless Defenders.” Of those, 83% operate as a single coordinated team, against 37% of everyone else.
One respondent described “confusion about who had the final authority to shut down the affected systems.” That is an ownership failure, not a tooling one.
What this means inside a window like RMA’s
We have no visibility into how RMA is handling this, and nothing public suggests it is handling it badly. The point is general. Any organisation facing an alert, a claim, and a deadline has to make a series of decisions within hours, and each one needs a named owner before the incident, not during it:
- Who can take systems offline, and on whose authority.
- Who tests the actor’s claims against your own data.
- Who decides whether and how to engage the actor, and who signs off any payment.
- Who decides when the evidence meets the POPIA section 22 threshold for notifying the Information Regulator and data subjects.
- Who speaks to staff, customers, regulators and the media, and from which verified facts.
Cisco’s own recommendation is to pre-delegate these decision rights and rehearse them. A playbook nobody has run under pressure is a document, not a capability.
RMA’s deadline falls on Thursday. Whatever the investigation finds, the organisations that handle the next alert well will be the ones that settled who was in charge before it arrived.
