Abstract
The increasing digitalisation of the South African banking sector has intensified exposure to cyber threats, demanding a robust, adaptive, and strategically integrated cybersecurity practice. Despite substantial investment in technological defences, many banks continue to experience fragmented strategy implementation and limited cyber resilience against complex cyber-fraud incidents. This study analysed the implementation of cybersecurity strategies in South African banks, focusing on the interplay between organisational strategy, human behaviour, technology adoption, and regulatory requirements. Using a selected bank in South Africa as a single-case study, this study aimed to explore how cybersecurity strategies are developed, prioritised, and implemented, while also identifying factors that constrain the effectiveness of cybersecurity strategies.
A qualitative, exploratory case study design was employed, involving semi-structured interviews with 13 employees from a selected bank in South Africa, who were predominantly cybersecurity specialists, cybersecurity strategy managers, executives, digital risk managers, and IT technical leads. The data collected from the participants were analysed using ATLAS.ti version 25 software. Thematic analysis was conducted to extract patterns across identified core themes.
The findings revealed that cybersecurity strategy implementation at a selected bank in South Africa remains reactive, mainly fragmented, and compliance-driven. Employees and customers demonstrate inconsistent cyber awareness, while executives often prioritise revenue-generating initiatives over security. The scarcity of skilled cybersecurity professionals further constrains the development of capabilities.
While incremental progress is visible through emerging data-driven monitoring and adoption of artificial intelligence (AI), these initiatives are not yet strategically embedded or scaled. The external landscape contributes to internal challenges, with an increase in AI-driven fraud, phishing, and ransomware attacks occurring alongside strict regulatory requirements that slow innovation.
To address these gaps, the study proposes the Integrated Cyber Resilience Framework (ICRF). This framework advocates for a shift from compliance-oriented control to adaptive resilience, where technology, people, and governance operate cohesively to anticipate, respond to, and recover from cyber incidents...