By Doros Hadjizenonos, Regional Director at Fortinet South Africa
With municipal by-elections taking place across South Africa throughout 2025, attention is once again turning to the strength of local governance. But beyond the campaign posters and voting stations lies a less visible, yet equally vital, concern – cybersecurity.
Never has it been more important to support the entire digital ecosystem that elections rely on. Election infrastructure, if compromised, could indirectly affect public confidence, voter turnout, or even access to services during critical democratic moments.
Municipal vulnerabilities, national implications
Data from Interpol’s 2023 Cyberthreat Assessment ranks South Africa among the top five most targeted countries globally, underscoring just how persistent the threat has become. As South Africa’s municipalities navigate the complexities of digital transformation amidst by-elections, the imperative to secure digital infrastructure has never been more critical.
Cybersecurity is not merely a technical concern, but a foundational element of democratic integrity and public trust. In 2023, the South African Local Government Association (SALGA) flagged cyber threats as a rising concern for municipalities, noting that over 60% of local government entities had not conducted a cybersecurity risk assessment in the previous year. This situation has led to concerns about potential service disruptions, data breaches and financial losses for municipalities.
Fortinet’s research shows that state and local governments often grapple with budget constraints, skills shortages and fragmented security systems, leaving them vulnerable to sophisticated cyber threats.
Reinforcing public trust through digital resilience
In the context of local by-elections, a cyber incident that disrupts municipal services or leaks personal information could erode trust and discourage public participation in democratic processes. Municipal systems must therefore be protected with the same level of care as core electoral infrastructure. This includes:
- Protecting citizen data through advanced encryption and access control,
- Securing public-facing portals and mobile apps with layered defences,
- Ensuring uptime and reliability during periods of heightened demand or public interest.
Importantly, a robust cybersecurity strategy can help safeguard the perception and integrity of democratic processes, even if the elections themselves are not directly managed by local authorities.
What can municipalities do today?
To reduce cyber risk and enhance digital trust, municipalities should focus on four key areas.
1. Adopt a zero-trust architecture – This model assumes that no user or device should be inherently trusted, and requires continuous verification before access to systems is granted. This approach drastically reduces the risk of lateral movement in the event of a breach.
2. Train municipal employees – Human error remains a major cause of breaches. Ongoing awareness and phishing simulations can significantly reduce risk, especially among frontline and administrative staff.
3. Conduct regular vulnerability scans and risk assessments – Identifying weak points in infrastructure before attackers do allows for faster, targeted remediation.
4. Collaborate with national and provincial structures – By leveraging partnerships and shared resources, local governments can improve their defences without needing to scale internal teams significantly.
For municipalities with limited capacity, working with expert partners that offer integrated security operations, real-time monitoring, and endpoint protection can offer a fast, scalable route to resilience.
Cybersecurity is civic leadership
As South Africa continues to build a stronger digital democracy, municipalities have a unique opportunity to lead by example – not only in service delivery, but in safeguarding the systems citizens rely on.
By taking proactive steps to secure their digital infrastructure, local governments can help ensure that the public remains confident in engaging with both everyday services and extraordinary events like elections. In an era where digital resilience underpins democratic resilience, cybersecurity is no longer a background function – it’s a core part of civic leadership.