The Africa Cybersecurity Indaba, held in Sandton from 27 to 29 October 2026 under the theme “Securing Africa’s Digital Future: Innovation, Trust & Resilience”, places workforce capability alongside policy and technology.

That focus is warranted. Cyber incidents can interrupt services, expose information and weaken confidence in organisations. Responding well depends on trained people, clear accountability and processes tested before a crisis.

A CSIR survey of South African organisations found that 63% reported cybersecurity roles that were partially or fully unfilled. The finding describes survey respondents rather than every vacancy in the country, but it points to a practical problem: employers need people who can perform defined tasks, while young entrants need supervised experience to demonstrate what they can do.

What the Africa Cybersecurity Indaba signals

The Indaba’s programme connects cybersecurity policy and digital sovereignty with cybercrime, artificial intelligence, critical infrastructure, trust and skills development. The Department of Communications and Digital Technologies is identified as co-host with CyberM8 in the official co-host announcement.

These topics point to a national capability question. Digital sovereignty depends on the ability to make informed choices about data, technology and infrastructure.

The NextGen Skills Bootcamp and HackSecure Challenge put practical talent development on the programme. The official Indaba programme lists the dates, venue and activities.

A cyber incident is an operational event

If a payment service or case-management system becomes unavailable, teams may have to delay work or use manual processes. If personal information is exposed, an organisation must establish what happened, contain access, meet its legal obligations and communicate with affected people. A compromised supplier or staff account raises the same operational question: who can isolate access and coordinate recovery?

Readiness depends on rehearsed decisions

Before an incident, leaders should identify who can isolate access, authorise recovery, manage notifications and coordinate with suppliers. Tabletop exercises test whether those responsibilities and escalation routes are clear. A plan that has never been rehearsed may fail under pressure.

For organisations reviewing their controls, Lebone Marang’s IT Security Maturity Assessment describes an assessment of security controls and remediation priorities.

What the CSIR survey shows

The CSIR’s national cybersecurity surveys, conducted at the end of the 2023/24 financial year, collected more than 300 responses for each survey. In the incident survey, 47% of responding organisations reported between one and five cybersecurity incidents in the previous year.

These findings reflect survey respondents rather than a complete census of South African organisations. They show why staffing, response planning and operational readiness belong in the same discussion. The methodology and results are set out in the CSIR’s national cybersecurity survey announcement.

South Africa’s workforce gap is about capability and access

The same CSIR skills-gap survey found that 63% of participating organisations reported cybersecurity roles that were partially or fully unfilled. This is evidence about vacancies in the surveyed organisations, not a count of every South African cybersecurity job or a measure of how quickly each vacancy could be filled.

The survey does not establish why posts remained open, so employers should examine their own recruitment data before assuming that more classroom training is the only answer.

Make the first role attainable

Employers should define junior roles around observable tasks, then separate requirements that must be present on day one from skills that can be developed after hiring. Candidates need supervised opportunities to show how they document an alert, escalate uncertainty and handle sensitive data.

ISC2’s 2025 hiring-trends study surveyed 929 cybersecurity hiring managers in Canada, Germany, India, Japan, the United Kingdom and the United States. South Africa was not included, so the findings are not a local jobs forecast.

Respondents identified internships and apprenticeships as useful early-career recruitment routes and listed documentation, alert and event management, and reporting among tasks suitable for junior staff. See the ISC2 2025 Cybersecurity Hiring Trends study.

Cybersecurity is a career system, not one job title

Entry routes can start in IT support, privacy, administration or business operations. These are illustrative pathways, not guaranteed promotions:

• IT support or administration. user access, devices and basic troubleshooting. Possible progression: security operations or identity management.
• Awareness and training. training material, reporting processes and safe behaviour. Possible progression: security-culture or awareness-programme design.
• Governance, risk and compliance. evidence gathering, control records and risk registers. Possible progression: risk management or security governance.
• Security operations. alert triage, documentation and escalation. Possible progression: incident response or threat analysis.
• Privacy and data protection. data handling, access requests and process checks. Possible progression: privacy or data-protection specialisation.

Security work therefore includes technical, analytical, governance and communication responsibilities. A young person does not need to begin as an expert hacker, but does need an honest entry point, relevant foundations and a safe way to practise.

Build practice into talent development

A useful pathway connects four elements.

1. Foundations. Teach digital literacy, ethical judgement, clear writing and how organisations handle information.
2. Applied practice. Use safe labs, simulated phishing, incident-reporting exercises and realistic scenarios.
3. Work exposure. Pair learners with mentors, shadowing, structured projects or internships.
4. Employment pathways. Use accurate junior job descriptions, skills-based screening, onboarding plans and continued learning.

At each stage, learners need a task they can practise, clear supervision and feedback against the role. Employers and training providers should assess applied capability as well as course completion.

Info-Tech Research Group recommends defining required competencies, assessing current proficiency and aligning development plans with security goals. The same discipline applies to youth pathways: specify the tasks a learner should perform, provide supervised practice, then assess performance against the role. See Info-Tech’s research on cybersecurity competency gaps.

Actions for employers, educators and policymakers

Each stakeholder can make the route from learning to work more visible and measurable.

Employers

• Within 90 days, review junior cyber and adjacent IT job descriptions. Separate essential skills from those that can be taught.
• Define three to five supervised tasks, assign a named mentor and track whether new hires complete a six-month development plan.

Educators and training providers

• Include assessed workplace scenarios and ask learners to produce an incident note or risk explanation.
• Track work placements and relevant employment at six and twelve months, not course completion alone.

Policymakers and industry bodies

• Connect skills funding to employer-designed role profiles and report course completion, work exposure and employment as separate outcomes.
• Use those results to adjust programmes when participants are not moving into practical work.

Youth-development organisations

• Connect learners to mentors, safe practice environments and employers. Lebone Marang describes its youth skills and opportunity pathways on the For Youth page.

Make the pathway part of resilience planning

The Indaba has brought policy, industry and emerging talent into the same conversation. Its value will depend on what organisations do afterwards: whether they assign accountability for cyber risk, create supervised entry points and connect training to real work.

Inaction leaves security teams dependent on a narrow pool of experienced people, while young candidates are told they need experience before they can begin.

The first practical move is to identify one junior task a team needs done, define the competency and supervision required, and create a route for a learner to practise it. Employers and partners can explore working with Lebone Marang on youth skills and employment pathways. Cyber resilience improves when organisations plan capability as deliberately as they plan technology.