One of South Africa’s big five banks has been in the news recently, but not for the right reasons. The bank’s systems were breached by a threat actor named Rootboy, who stole data and then placed it on the dark web after the bank wouldn’t pay the ransom. The threat actor did so in an ongoing sequence of planned and disclosed dates and times – another reminder that, with cyber threats getting more sophisticated every day, every organisation needs serious protection for its network.

Learn more at www.vox.co.za/firewalls

South Africa has experienced a number of high-profile attacks in recent years that show the cost of inadequate network defences. The 2021 Transnet ransomware attack, which disrupted port operations and national logistics, highlighted how cyber incidents can affect supply chains and the economy at a national level. In recent years, public and private sector organisations in South Africa have reported rising ransomware and data theft attempts, making proactive perimeter and network security a business priority.

Firewalls block malicious websites, check even secure website traffic, and make sure that your remote workers can connect safely. In today’s threat landscape, this ‘bodyguard’ is no longer a luxury – it’s a business necessity.

South Africa is a prime target

Cybercrime is not “someone else’s problem”: South Africa is among the most targeted countries in Africa for ransomware and infostealer attacks. According to the latest Sophos State of Ransomware report, South Africa has ranked as the most targeted country in Africa for cyberattacks for almost two years, while also featuring among the top three targeted nations globally.

The attacks are not random, either: in June 2024, South Africa’s National Health Laboratory Service was hit by a ransomware attack that disrupted its systems, deleted backups, and stole 1.2TB of data, while the country was in the middle of an mpox outbreak. Cell C suffered a breach in which roughly 2TB of sensitive customer data, including ID numbers and banking details, was exfiltrated and leaked online. In January 2025, the South African Weather Service had its systems disrupted by RansomHub, a ransomware-as-a-service group that has racked up hundreds of victims globally.

Small and medium-sized businesses are especially vulnerable because they are less likely to have robust defences in place. Cybercriminals know this and exploit it. The question for any business owner is no longer if they will be targeted, but when. Business managers need to ask: what’s standing between your data and the people trying to steal it?

How does a firewall ‘bodyguard’ work?

A firewall is your network’s gatekeeper, sitting between your internal business systems and the outside world, in this case the internet. Your firewall decides what traffic is allowed in or out, based on a defined set of security rules.

Think of it as being like a security checkpoint at the entrance to a building. Every vehicle (data packet) that tries to enter or leave is examined. Legitimate visitors are waved through. Suspicious ones are stopped, turned away or flagged for closer inspection.

Modern firewalls do far more than basic traffic filtering. A next-generation firewall inspects the actual content of network traffic and not just where it’s coming from or going to. It can identify applications, users and even specific behaviours within encrypted connections, giving businesses a much deeper level of visibility and control.

At a practical level, a firewall can:

Block malicious websites before employees even reach them;
Inspect encrypted HTTPS traffic, catching threats that hide inside secure connections;
Detect and stop ransomware before it can spread across your network;
Control which applications employees can access, reducing security risk and helping to keep productivity levels up;
Enable secure remote access so employees working from home can connect safely to company systems; and
Alert you to unusual activity in real time, so threats are caught early rather than discovered weeks later.

In short, a firewall doesn’t just block threats – it gives you visibility and control over everything happening on your network.

Firewall as a critical part of cybersecurity strategy

Cybersecurity is not a single product. It’s a layered approach, and the firewall is the foundation. Without it, everything else becomes significantly harder to protect.

Consider this: human error accounts for a significant proportion of South African breaches, with phishing emails, weak passwords and social engineering being the leading causes. A firewall cannot stop every mistake a person makes, but it can dramatically limit the damage those mistakes cause. If a staff member clicks a phishing link, a well-configured firewall can block the connection to the attacker’s server before any data leaves your network. If ransomware begins spreading across your systems, a firewall with automatic threat response can isolate the affected segment before the damage becomes catastrophic.

Beyond threat prevention, firewalls also address the reality of remote and hybrid work. When your team is connecting from home, coffee shops or client offices, the traditional boundary between ‘inside’ and ‘outside’ the office has disappeared. A modern firewall creates secure, encrypted tunnels for remote workers, so that your business data stays protected no matter where your people are.

From a regulatory perspective, South Africa’s Protection of Personal Information Act (Popia) requires businesses to take reasonable steps to protect the personal information they hold. A breach that exposes customer data can trigger significant regulatory penalties. In the event of a breach, being able to demonstrate that you had appropriate technical safeguards in place, including a properly configured firewall, is a key part of your compliance posture.

From a productivity perspective, a firewall gives businesses the ability to manage internet usage, blocking time-wasting sites, limiting bandwidth-heavy applications and ensuring that your internet connection is being used for business purposes.

The Sophos Firewall gives South African businesses access to world-class network security, without the complexity or cost that has traditionally made enterprise-grade protection feel out of reach for smaller organisations.

Protect your business perimeter and give your team safe, inspected access to the resources they need. Find out more about the Vox Sophos Firewall offering and enquire online at www.vox.co.za/firewalls.