By Keenan Crouch, Executive Associate at Change Logic
Cybersecurity in digital transformation has become just as important as people and process. As organisations accelerate digital change, security can no longer be treated as an afterthought if transformation is to deliver lasting business value. But in today’s hyper-connected world, where every major change is powered by technology, there’s a third pillar that’s too often left out of the conversation: security. The truth is, security can no longer be an afterthought in transformation programmes. If it is, the cost of neglect could bring even the most ambitious change efforts to a standstill.
The Real Cost of Overlooking Security
The numbers paint a sobering picture. In South Africa, the average cost of a data breach in 2024 was a staggering R53.1 million, according to IBM’s annual Cost of a Data Breach report. While that figure dropped to R44.1 million in 2025, the most serious breaches have cost as much as R360 million. These aren’t hypothetical risks; they’re balance sheet realities. The wrong breach, at the wrong time, can derail transformation projects, delay digital rollouts, or even wipe out projected returns on investment.
When Security Comes Too Late: Lessons from Real-World Breaches
Consider Transnet’s ransomware attack in July 2021. The organisation was in the middle of a large-scale digital transformation when attackers brought South Africa’s port and rail operations to a halt. Transnet was forced to declare force majeure and revert to manual, paper-based processes. Instead of modernising, the company spent months recovering—its transformation momentum gone, along with millions in losses and reputational damage.
It’s not just South Africa.
- Capital One suffered a US$190 million fallout after a single misconfigured firewall exposed the data of more than 100 million customers during its cloud migration.
- Marriott inherited a breach from Starwood Hotels because cyber due diligence wasn’t prioritised during acquisition talks. The penalty? A £18.4 million fine in the UK alone, plus multiple U.S. settlements.
- Even Microsoft wasn’t immune: in 2021, default settings on its Power Apps platform exposed 38 million records, from airlines to government agencies.
Each case underscores the same point: transformation without security at the table from day one is a risk no organisation can afford.
Change Management Without Security: A Gap Waiting to Be Exploited
Change management exists to bring order to chaos, establishing governance, communication channels, and adoption frameworks during times of disruption. Yet, if cybersecurity isn’t built into this scaffolding, transformation projects can become soft targets for attacks. On average, it takes 227 days in South Africa to identify and contain a breach. That’s more than seven months of potential damage before organisations even realise what’s happening. For transformation programmes with tight budgets and deadlines, that’s catastrophic. And the risks aren’t evenly spread. Research shows that nearly 20% of breaches in South Africa stem from supply chain vulnerabilities, third-party vendors, low-code developers, and systems integrators. Every new partner in a transformation project represents a fresh point of exposure.
The Financial Sector: High Stakes, Low Budgets
Financial services remain prime targets, with average breach costs reaching R70.2 million. Yet, PwC reports that only 29% of South African organisations plan to increase cybersecurity budgets by even 6–10% in 2025. The disconnect is clear: companies are pouring millions into digital transformation while underfunding the very safeguards needed to protect it. Change leaders, who already advocate for adoption budgets and training resources, must now make the business case for security as an essential part of transformation ROI.
How to Put Security at the Centre of Transformation
Treating security as a core workstream – not a side task – means integrating it into every stage of the change process:
- Planning: Include threat modelling in requirements gathering.
- Design: Embed secure configuration reviews in system designs.
- Execution: Gate go-live milestones with security readiness checks.
- M&A: Conduct cyber due diligence before Day One, and reassess regularly post-integration.
- Cloud rollouts: Use least-privilege access principles and red-team testing before production deployment.
Security decisions are not just IT tasks; they are leadership decisions. Change leaders must bring cybersecurity into the same conversations as people, process, and adoption to safeguard the entire transformation journey. Digital transformation promises speed, agility, and competitiveness. But without security built into its foundations, those same projects risk becoming the very source of vulnerability. For change leaders, the message is simple: security can’t wait until after the change is done; it must shape the change itself. Because in the end, the success of any transformation depends not just on what you build, but on how well you protect it.
_______________________________________________________________________________________________________________________________________________________________________________________________________________________________
Frequently Asked Questions
Why is cybersecurity important in digital transformation?
Cybersecurity protects digital transformation initiatives from data breaches, ransomware attacks and operational disruption. Embedding security from the beginning helps organisations reduce risk, protect customer data and maximise the return on technology investments.
How does cybersecurity affect change management?
Cybersecurity should be integrated into change management to ensure new technologies, processes and behaviours are adopted securely. Change leaders play a key role in aligning people, processes and security throughout transformation programmes.
What are the biggest cybersecurity risks during digital transformation?
Common risks include ransomware attacks, cloud misconfigurations, third-party supplier vulnerabilities, insecure system integrations, phishing attacks and inadequate access controls. These risks increase when security is introduced late in a transformation programme.
Why should security be included from the start of a transformation programme?
Including security from the planning stage allows organisations to identify vulnerabilities early, build secure systems by design and avoid costly delays, compliance issues and business disruption later in the project.
What role do change leaders play in cybersecurity?
Change leaders help ensure cybersecurity becomes part of organisational culture by promoting secure behaviours, supporting user adoption, aligning stakeholders and ensuring security requirements are embedded throughout the transformation lifecycle.
How can organisations improve cybersecurity during digital transformation?
Organisations can strengthen cybersecurity by conducting threat modelling, performing security readiness assessments before go-live, applying least-privilege access controls, completing cyber due diligence for third parties and continuously monitoring adoption and security risks.
What is the cost of a cyberattack during digital transformation?
Cyberattacks can result in significant financial losses, regulatory penalties, operational downtime, reputational damage and reduced customer trust. They can also delay or derail digital transformation programmes, reducing the overall return on investment.
