Tag: artificial-intelligence

Article 4: Governing the Cognitive Domain – Why South Africa Is Structurally Unprepared for Influence Operations

Given SHINGANGE

The first three articles in this series established three core points. Article 1 defined influence operations as a defining feature of contemporary conflict, operating primarily in the cognitive domain. Article 2 examined how digital platforms and fragmented media ecosystems enable influence at scale. Article 3 demonstrated why South Africa is particularly exposed, drawing on empirical indicators such as rising identity salience, declining intergroup trust, and widespread perceptions of institutional unfairness.

These indicators are not abstract social trends. They are measurable signals of cognitive vulnerability. Article 4 therefore turns to the institutional question: despite the visibility of these signals, is South Africa structurally capable of recognising and responding to influence operations as a governance and security challenge?

The short answer is no—not because of a lack of concern or policy language, but because South Africa’s governance architecture remains fundamentally misaligned with the nature of cognitive and information-layer threats.

The Category Error in South Africa’s Security Thinking

South Africa continues to treat influence, disinformation, and narrative contestation as peripheral issues—communication problems, political risks, or media ethics concerns—rather than as core national security challenges. This is a category error. Influence operations operate below the threshold of traditional security responses, yet they shape the conditions under which democratic governance, social cohesion, and institutional legitimacy function.

The country’s security architecture reflects an earlier era of threat perception. Cybersecurity is framed largely in technical terms: systems, networks, critical infrastructure, and cybercrime. Strategic communications are treated as a government messaging function. Social cohesion is addressed through social policy and symbolic nation-building initiatives. These domains operate in silos, despite the fact that influence operations exploit precisely the gaps between them.

As a result, no single institution is responsible for understanding or defending the cognitive domain as a system.

Policy Without Strategy, Strategy Without Structure

South Africa does not suffer from a complete absence of policy. The National Cybersecurity Policy Framework (NCPF), now a decade old, acknowledges information security and cyber threats in broad terms. However, it offers little conceptual clarity on influence operations, cognitive security, or narrative resilience. More importantly, it does not translate these concerns into institutional design, roles, or accountability.

This reflects a deeper structural problem: policy has not been followed by strategy, and strategy has not been followed by structure. Influence operations cut across cybersecurity, intelligence, communications, education, and social trust, yet no coordinating mechanism exists to integrate these domains. Responsibility is diffused, and accountability is absent.

In such an environment, responses to influence-related incidents are necessarily reactive, fragmented, and politicised.

The Absence of Cognitive Security as a Governance Concept

One of the most significant gaps in South Africa’s security discourse is the absence of cognitive security as an explicit governance concept. There is no shared framework for understanding how identity, trust, perception, and information interact as security variables. As a result, influence is either over-securitised—treated as a threat to be suppressed—or under-securitised—dismissed as free speech, politics, or noise.

This false binary paralyses response. Cognitive security does not require censorship or information control. It requires the capacity to anticipate how narratives form, spread, and harden, and how institutional behaviour either mitigates or accelerates those processes. Without this conceptual foundation, even well-intentioned interventions risk undermining legitimacy further.

Institutional Trust as a Strategic Variable

Article 3 showed that trust erosion is a central vulnerability in South Africa’s cognitive battlespace. Yet trust is rarely treated as a strategic variable in governance design. Institutions measure performance through compliance, outputs, or political alignment, not through their contribution to societal trust and interpretive stability.

This omission is consequential. Influence operations thrive where institutions are perceived as opaque, inconsistent, or self-interested. Every governance failure, communication misstep, or policy contradiction becomes material for narrative exploitation. In this sense, institutional behaviour itself becomes part of the information environment.

South Africa’s challenge is therefore not only defensive, but reflexive. Institutions must recognise their role as narrative actors, whether they intend to be or not.

Why Tactical Responses Will Continue to Fail

Calls for fact-checking initiatives, platform regulation, or counter-disinformation units are understandable, but insufficient. These are tactical responses to a strategic problem. Without an overarching framework for cognitive security, such measures risk becoming symbolic, selectively enforced, or politically contested—further eroding trust.

Influence operations adapt faster than regulatory or bureaucratic processes. By the time a narrative is identified and countered, its cognitive effects may already be embedded. Resilience, not reaction, is therefore the appropriate objective.

Conclusion: Structure Follows Strategy, or Failure Persists

This article has argued that South Africa’s vulnerability to influence operations is not primarily a function of hostile actors or technological change. It is the result of structural misalignment: governance systems designed for a different era confronting threats they were never configured to address.

Influence operations exploit gaps between institutions, disciplines, and mandates. Until South Africa recognises the cognitive domain as a legitimate and shared security concern—and aligns policy, strategy, and structure accordingly—those gaps will remain exploitable.

The implication is not that South Africa needs more laws, louder messaging, or heavier regulation. It needs a coherent way of seeing. In the cognitive domain, perception is not merely the object of security; it is the terrain on which security is decided.

South Africa’s Cybersecurity Failure Is Not About Policy Gaps. It Is About State Capability.

Given SHINGANGE

1. Introduction: South Africa’s Cybersecurity Problem Is Not a Knowledge Problem

South Africa does not suffer from a lack of cybersecurity knowledge, frameworks, or international guidance. It suffers from a persistent failure of execution, authority, and accountability. For more than a decade, the country has produced policies, frameworks, and institutional arrangements that acknowledge cybersecurity as a national priority. Yet cyber incidents continue to rise, critical services remain exposed, and state capacity to respond coherently remains weak.

This is not a technical problem. It is a governance problem.

The latest Guide to Developing a National Cybersecurity Strategy, 3rd Edition (2025) makes this distinction explicit. The Guide is no longer focused on helping states understand what cybersecurity is. It is focused on helping states translate intent into durable capability. In this respect, South Africa stands as a clear example of a country that has absorbed the language of cybersecurity without internalising its discipline.

More concerning is that South Africa’s cybersecurity posture remains poorly aligned with the reality of modern hybrid threats, where cyber operations, disinformation, influence campaigns, economic coercion, and institutional weakness intersect. The country continues to treat cybersecurity as a narrow ICT or compliance issue, while adversaries treat it as a tool of power, leverage, and strategic influence.

This article argues that South Africa’s cybersecurity weakness is not caused by the absence of strategy. It is caused by the inability or unwillingness of the state to convert strategy into authority, funding, skills, and enforcement.

2. What the Guide Actually Says, Not What We Prefer to Hear

The 2025 Guide is explicit in its intent. It positions national cybersecurity strategy as a living governance instrument, not a policy document to be published and forgotten. It introduces a lifecycle approach that forces states to confront uncomfortable realities, such as sustainable funding, institutional leadership, implementation sequencing, and performance measurement.

At its core, the Guide emphasises three non-negotiables:

First, clear leadership and mandate. A national cybersecurity strategy cannot succeed without a single, empowered authority that coordinates across government and society.

Second, implementation and sustainment. Strategies without funded action plans, timelines, and accountability mechanisms are meaningless.

Third, adaptability to evolving threats, including emerging technologies and hybrid threat models that blur the line between civilian, economic, and national security domains.

The 3rd Edition strengthens these points by focusing heavily on financing, monitoring, evaluation, and technological foresight. This shift is significant. It reflects a global recognition that many states no longer fail at the level of ideas, but at the level of execution.

South Africa’s problem is that it continues to behave as if drafting a strategy is the same as building capability.

3. Using the Guide as a Benchmark: Where South Africa Falls Short

When the Guide’s overarching principles are applied to South Africa, the gaps are immediate and systemic.

Clear leadership and authority

South Africa does not have a single, clearly empowered national cybersecurity authority with the political weight and operational mandate required to coordinate across government, regulators, state-owned entities, and the private sector. Responsibilities are dispersed across departments, agencies, and committees, many of which lack enforcement power.

This fragmentation violates one of the most basic principles of the Guide: cybersecurity governance requires clarity of leadership, not collaborative ambiguity.

Whole-of-government coordination

The Guide assumes that cybersecurity cuts across sectors and functions. In South Africa, coordination often exists in theory but collapses in practice. Interdepartmental processes are slow, politicised, and frequently undermined by competing mandates and budgetary silos.

Cybersecurity is discussed, but rarely prioritised when trade-offs must be made.

Risk-based prioritisation

South Africa continues to struggle with national-level cyber risk management. There is limited evidence of a continuously updated national cyber risk register that informs policy decisions, investment, or crisis preparedness. Risk assessments, where they exist, are often static and compliance-driven.

Sustainable funding and capacity

The Guide is unambiguous. Cybersecurity requires predictable, multi-year funding and sustained investment in people. South Africa’s approach remains ad hoc. Cybersecurity initiatives are launched without long-term funding commitments, resulting in fragile systems that degrade over time.

This is not a budgeting issue alone. It reflects a failure to treat cybersecurity as a strategic investment rather than a discretionary expense.

4. Lifecycle Failure in the South African Context

The Guide’s lifecycle model provides a useful diagnostic tool to understand where South Africa consistently fails.

Initiation without authority

Strategies are initiated without clearly designating a lead authority with the power to compel cooperation. Committees are created, but authority is diluted.

Stocktaking without consequence

Assessments are conducted, reports are written, and gaps are identified. Yet these findings rarely result in decisive action or structural reform.

Strategies without funding

Cybersecurity strategies are published without binding financial commitments. Action plans, if they exist, are aspirational rather than operational.

Action plans without enforcement

Implementing entities are named, but consequences for non-delivery are absent. Performance management is weak or non-existent.

Monitoring without accountability

Monitoring and evaluation processes are often procedural, producing reports that are noted rather than acted upon.

In short, South Africa moves through the motions of the lifecycle without internalising its discipline.

5. Focus Areas Applied to South Africa’s Reality

Governance

Governance remains fragmented. No central authority has the mandate or legitimacy to enforce national cybersecurity priorities across sectors. This leads to duplication, gaps, and institutional paralysis.

Critical infrastructure and essential services

Despite repeated warnings, the protection of critical infrastructure remains uneven. Cybersecurity requirements are inconsistently applied, oversight is weak, and interdependencies between sectors are poorly understood.

National cyber risk management

There is no mature, dynamic national cyber risk management framework that informs strategic decision-making. Risk insights are not systematically linked to investment or crisis planning.

Incident response and CSIRT maturity

South Africa’s incident response capability is uneven and insufficiently integrated across sectors. Information sharing remains limited, and large-scale national exercises are rare.

Skills, capacity, and awareness

The skills deficit is acute, not only at technical levels but at senior decision-making levels. Many leaders responsible for cybersecurity policy lack the expertise to understand the consequences of inaction or poor design.

Legislation and regulation

While laws exist, enforcement is inconsistent. Regulatory overlap creates confusion, while gaps remain in areas related to cyber-enabled hybrid threats.

International cooperation

South Africa participates in international forums, but domestic capacity limits its ability to translate cooperation into tangible resilience.

6. Hybrid Threats and the Blind Spot in South Africa’s Cyber Policy

One of the most serious shortcomings of South Africa’s cybersecurity posture is its failure to fully integrate hybrid threats into national cyber policy.

Cybersecurity is still treated as an ICT issue, separate from disinformation, influence operations, economic coercion, and cognitive manipulation. This separation is artificial and dangerous.

Hybrid threats exploit institutional weakness, social divisions, and governance gaps. They target trust, decision-making, and legitimacy. South Africa’s fragmented cybersecurity governance makes it particularly vulnerable to such operations.

The Guide implicitly recognises this reality through its emphasis on cross-sector coordination and technological foresight. South Africa has yet to operationalise this insight.

7. Strategic Risks of Continued Inaction

The risks of continued failure are not abstract.

Critical services remain exposed to disruption. Public trust in digital systems erodes. The state becomes increasingly vulnerable to foreign influence operations that exploit weak cyber governance. Crisis response capabilities remain inadequate during national emergencies or high-profile events.

Most importantly, cybersecurity failure undermines state credibility and sovereignty.

8. What South Africa Should Be Doing Now

South Africa does not need another strategy. It needs discipline.

First, designate a single national cybersecurity authority with clear legal and political authority.

Second, align funding with strategy through multi-year commitments embedded in national budgeting processes.

Third, establish enforceable accountability mechanisms for implementation.

Fourth, integrate cybersecurity fully into national security and hybrid threat frameworks.

Finally, invest in decision-maker capability, not only technical skills.

9. Conclusion: From Strategy Documents to State Capability

Cybersecurity is a test of governance. South Africa has repeatedly failed that test, not because it lacks guidance, but because it lacks the will and structure to act.

The 2025 Guide does not offer comfort. It offers a mirror. What South Africa sees in that mirror should be deeply unsettling.

The question is no longer whether the country understands cybersecurity. The question is whether it is prepared to govern it.