We asked twenty clients what worries them most about AI. Seventeen of the eighteen who answered named something else entirely. What that says about where AI actually goes wrong.
We ran an event about AI. Seventeen of our eighteen clients were worried about something else.
In July we hosted around twenty of our clients at Crystal Towers for a day on artificial intelligence, in partnership with Mimecast.
Before the event we asked the people who were coming a simple question. What matters most to you right now. Eighteen answered. Seventeen of them put cybersecurity and data protection above AI strategy.
That is worth sitting with. A room that had signed up for a day about AI told us, before anyone arrived, that the thing on their minds was the layer underneath it.
The blunt axe
The morning opened with a line usually credited to Lincoln. Give me six hours to chop down a tree and I will spend the first four sharpening the axe.
It was the part of the day people repeated back to us afterwards, and the reason is not the story. It is that most businesses are chopping. They are buying licences, running pilots and telling staff to use AI more, with a blunt blade.
The work that makes AI pay happens before any of that, and none of it looks like an AI project. Knowing where your data actually lives. Knowing who is allowed to touch it. Knowing what happens when something goes wrong. Unglamorous, all of it, and it decides whether the AI spend returns anything at all.
Three sentences the day kept coming back to
AI without data has limited value.
Data without governance creates risk.
Governance without cybersecurity leaves organisations exposed.
Read in that order they are not a warning. They are a build sequence, and each line is a decision a business can make this quarter.
What the panel argued
Pieter Geldenhuys, technology futurist and founder of the Institute for Technology Strategy and Innovation, moderated three conversations.
Omri Jacobsz of Otomatika started with definitions, which sounds like a detour until you are sitting in a procurement meeting. There are more than fifty competing definitions of an AI agent in circulation, and the vendor across the table is not using yours. If you cannot say precisely what you are buying, you cannot say afterwards whether it worked.
Stephan Mare of Maluti-X covered data platforms and analytics. Most AI problems turn out to be data problems wearing a different jacket. The model is rarely the constraint. The state of what you feed it usually is.
Roxanne Badenhorst, a governance and information security consultant who works as a virtual CISO, made the point that reframed the room. AI does not create governance weaknesses. It magnifies the ones already there. Everything a business has quietly tolerated for years, the shared login, the spreadsheet nobody owns, the permissions never revoked when someone left, gets faster and louder the moment AI is pointed at it.
On that reading governance is not the department that slows things down. It is the thing that lets you move at all.
The part nobody puts on a slide
Somewhere in your business right now, someone is pasting a client list, a contract or a payroll file into a chatbot to save themselves twenty minutes.
They are not being reckless. They are being efficient, with a tool nobody told them not to use.
Under POPIA that is still your business processing personal information, and the accountability sits with the business whether or not it approved the tool. The obligation does not move because the software was free and the decision was made by someone in accounts on a Tuesday.
This is what seventeen out of eighteen were pointing at when they ranked data protection above AI strategy. They were not saying AI does not matter. They were saying they cannot see the edges of their own information any more, and neither can most businesses their size.
If it can happen to the state, it can happen to you
In April this year South Africa’s own Draft National Artificial Intelligence Policy was gazetted, then withdrawn about a fortnight later after it emerged that it contained fabricated citations. The minister withdrew it on the basis that the fictitious sources had compromised the draft’s integrity. It was reported across the national press.
Take the politics out of it and one thing remains. A document that mattered went out into the world with sources nobody had checked, because AI produced them and the review step did not catch it.
That is not a government problem. That is a review step problem, and every business running AI without one has the same exposure at a smaller scale.
The ninety day version
The practical advice from the panel came down to two steps, in that order.
First, understand what AI can genuinely do for a business your size, in your sector, with your constraints. Not what it does in a keynote demo.
Second, map your own bottlenecks and decide which are worth solving. The ones costing real hours, real money or real risk.
Buy licences after that, not before. A tool bought ahead of a defined problem becomes a subscription nobody can cancel, because nobody can prove it is doing nothing.
What the room was really asking for
Of the eighteen clients who answered our survey, ten asked for a one to one conversation about their own environment.
That is the honest state of the market. Most business owners are not resistant to AI and are not confused about whether it matters. They are unsure where they stand, and they would rather ask someone than guess.
The decisions that cause the most damage are rarely the wrong ones. They are the ones nobody got round to making. The access that was never reviewed. The backup that was never tested. The data nobody could account for until the day somebody asked.
Those are the ones worth an hour of your time this quarter.
