While headlines often focus on the rising costs of ransomware, the hidden toll may be even more damaging: the pressure placed on the people responsible for stopping these attacks.

Sophos’s latest State of Ransomware in South Africa 2025 report reveals that beyond the data breaches and financial losses, ransomware is reshaping how cybersecurity teams operate – and cope.

The research found that 76% of South African IT and security professionals experienced increased pressure from senior leaders after an attack. Nearly half (47%) reported heightened anxiety about future incidents, while 42% said their workload had increased permanently.

It’s clear: ransomware doesn’t just hit systems – it hits people.

As the stakes get higher, many teams are reaching breaking point. Sophos data shows that organisations are less prepared today than they were a year ago. Fewer are relying on backups (just 35% this year vs 72% in 2024), while ransom payments are on the rise, with the median payment nearly tripling to nearly R8-million.

One root of the problem is capacity. Some 58% of local respondents cited a lack of cybersecurity expertise, and 53% said they weren’t aware of the security gaps that led to the attack. These are clear signals that teams are overwhelmed, under-resourced and often unaware of the full scope of their risk exposure.

The growing adoption of managed detection & response (MDR) services reflects a shift in how businesses are adapting. By outsourcing around-the-clock threat monitoring and response to experts, internal teams can focus on policy, prevention and training – areas where their contextual understanding of the business adds the most value.

It’s time to rethink resilience. This includes not only the technology and tools, but also how we support the people defending our digital infrastructure. With burnout and stress rising, and attacks becoming more sophisticated, the case for bolstering internal capabilities with external support has never been stronger.

Ransomware is as much a human crisis as it is a technical one, and our response must acknowledge both.