The biggest threat to South Africa is the general lack of cyber security awareness and hygiene. WannaCry had the impact it had, because far too many people still don't update their software and click on anything they receive on email (even zip and other archive files). Similarly how many people make backups of personal computers, encrypt their cellphones, use VPN at WiFi hotspots and bother to adjust privacy / personal profiles on social media sites? All free proactive tools. Erasmus is 100% right on what needs to happen at organisational and individual level. Legislation can assist with reporting standards and basic security requirements for IoT (Internet of Things) devices, but you cannot legislate against personal responsibility and poor hygiene. Legislation and government control are easy answers - but has a cost of its own. Security experts / vendors and government agencies are one important part of the debate and dialogue - so is the cost to privacy, freedom and innovation.