Question 1

What is the South African attack surface?

Accepted Answer

The South African attack surface refers to the total digital exposure of South African organisations — including open ports, vulnerable services, misconfigured email records, and internet-facing infrastructure that threat actors can exploit.

Question 2

How often is the threat data updated?

Accepted Answer

All threat intelligence data is refreshed daily at midnight SAST, sourced from Cloudflare Radar, Ransomware.live, Shodan, Censys, and other OSINT feeds.

Question 3

Which ransomware groups target South Africa?

Accepted Answer

Attack Surface tracks all ransomware groups with confirmed South African victims, including groups like LockBit, BlackCat/ALPHV, Play, and others actively targeting ZA organisations.