The latest figures from Sophos’ State of Ransomware in South Africa 2025 report reveal that the median ransom payment nearly tripled over the past year, increasing from approximately R2.8 million to R8.3 million, underscoring the significant financial risks posed by ransomware attacks.
These rising ransom payments accompany a marked increase in attackers’ demands, with the median ransom now set at R18 million, up substantially from previous years. The data indicates that 60% of ransomware incidents involve data encryption, with almost 40% also resulting in data theft, exposing organisations to further compliance, legal, and reputational risks.
Responding to these escalating threats, cybersecurity firm Sophos and cyber insurance specialist Phishield have announced a groundbreaking partnership, integrating proactive cybersecurity solutions with cyber insurance. This collaboration—the first of its kind in sub-Saharan Africa—aims to provide businesses with a comprehensive solution, aligning cybersecurity technology with financial protection.
“Sophos is committed to tackling ransomware proactively,” said Pieter Nel, Sales Director SADC at Sophos South Africa. “The reality is that traditional cybersecurity measures alone are no longer sufficient. Organisations need continuous monitoring and response to stop attacks in progress, which is why Sophos Managed Detection and Response (MDR) is such a critical component. By linking MDR directly to tailored insurance cover, this partnership gives businesses both the protection to prevent ransomware and the financial response mechanism to recover if they are targeted.”
Sarel Lamprecht, Managing Director of Phishield, emphasised that businesses are increasingly recognising cyber insurance as a crucial component of their broader risk management strategies. “Many companies underestimate how devastating a ransomware attack can be financially,” Lamprecht said. “Cyber insurance, particularly when combined with sophisticated threat detection capabilities, significantly mitigates these risks.”
Sophos’ findings also reveal the broader business impacts of ransomware. Recovery costs, excluding ransom payments, have increased sharply, now averaging R24 million per incident. These costs reflect not only technical recovery but also operational downtime, legal fees, and reputational repair.
Lamprecht highlighted that through this collaboration, Phishield offers tailored insurance coverage up to R100 million, linked directly to the cybersecurity measures implemented by Sophos’ customers. “Businesses who adopt Sophos’ MDR will see direct benefits in their insurance coverage and pricing, incentivising organisations to prioritise cybersecurity improvements.”
The report further identifies human error and compromised credentials as leading causes of ransomware attacks, underscoring the need for continuous staff training and robust access controls. Additionally, businesses must stay vigilant about software vulnerabilities and maintain rigorous patching and update schedules.
The human toll of ransomware incidents is also evident, with the report noting increased pressure and anxiety within IT teams. “Ransomware attacks are incredibly stressful events,” Nel noted. “Our integrated cybersecurity and insurance offering helps alleviate this stress by providing businesses with clear, actionable recovery pathways and the financial protection needed to reduce anxiety and pressure.”
Both Nel and Lamprecht advised businesses to adopt a proactive stance against ransomware, urging companies to reassess their cyber defences continually. “Organisations can no longer afford to be passive about cybersecurity,” Lamprecht said. “Combining advanced threat detection and responsive cyber insurance is now a fundamental component of strategic risk management.”
Phishield is Underwritten by Bryte Insurance Company Limited. A Fairfax Company. Registration Number 1965/006764/06, a Licensed insurer and authorised FSP (17703).
