Executive summary
South Africa's risk profile is dominated by violent acquisitive crime rather than political violence. The controls that matter are behavioural and routine-based: how staff move, when, and how predictably.
Organised extortion targeting construction, logistics and mining supply chains has matured into a systemic business risk, with intimidation and site invasion used as negotiating instruments.
Infrastructure fragility, electricity supply, water reticulation in metros, rail and port throughput, is now a continuity risk rather than an inconvenience, and it interacts directly with security posture when alarms, lighting and cameras depend on backup power.
Full report
Personnel security
Most incidents occur in the first and last two hundred metres of a journey. Controls that work: varied timing and routing, arrival awareness at gates, no phone use while stationary, a rehearsed compliance posture during confrontation, and no resistance in hijack scenarios.
Residential selection should weight perimeter, gate procedure, response arrangements and neighbourhood route options above square metres. Domestic staff vetting is a control, not a discourtesy.
Sources · [10] OpenSanctions · [3] UN OCHA / ReliefWeb
Project and site risk
Extortion demands typically arrive framed as local content or community participation. Organisations need a written engagement standard that distinguishes legitimate procurement obligations from coerced payment, and an escalation path that does not leave a site manager negotiating alone.
Pre-construction community mapping, transparent local hiring processes and documented grievance mechanisms measurably reduce stoppage frequency and give the organisation a defensible record.
Sources · [8] Institute for Security Studies (ISS Africa) · [1] ACLED
Continuity and infrastructure
Plan for scheduled and unscheduled electricity interruption, municipal water outage and intermittent rail and port throughput. Security systems should be on protected power; access control should have a manual mode that does not compromise the perimeter.
Fuel, water and generator maintenance are security controls in this environment. So is a tested crisis communications tree that works when the network is congested.
Sources · [6] NASA FIRMS / Copernicus · [9] INGO ADVISORY analyst desk
Indicators and warnings
Escalation: coordinated blockade of national routes; politically framed calls for shutdown; sustained increase in cash-in-transit attacks; extortion incidents against public infrastructure projects; prolonged loadshedding at higher stages coinciding with municipal water failure.
De-escalation: measurable decline in contact crime in metro precincts; successful prosecutions in extortion cases; stabilised electricity supply; improvement in port and rail throughput reducing logistics friction.
Sources · [4] GDACS · [7] GDELT Project
Key findings
- Vehicle hijacking, armed home invasion and business robbery remain the principal threats to staff, concentrated around predictable transitions: gate arrival, fuel stops and after-dark movement.
- Extortion networks operating under community-business framing impose costs on projects in KwaZulu-Natal, Eastern Cape and Gauteng, with site stoppage as the enforcement mechanism.
- Service delivery protests are highly localised but capable of closing arterial routes and townships at short notice, particularly around municipal billing and water outages.
- Cash-in-transit attacks and copper and cable theft indicate the persistence of well-organised criminal capability with military-pattern tactics.
- Cyber-enabled fraud against corporates and NPOs, particularly business email compromise on supplier payments, is a leading loss category and is under-reported.
Analyst assessment
We assess with high confidence that violent crime will remain the dominant risk to personnel through 2027, with no expectation of a step change in policing capacity.
We assess with moderate confidence that extortion of construction and logistics will expand geographically rather than diminish, and that project pricing should carry an explicit security and community-engagement line.
Nationwide unrest at the scale of July 2021 is assessed unlikely, but a localised trigger with rapid spread remains the credible worst case for continuity planning.
Related reports
Footnotes & sources
- [1] ACLED — Armed Conflict Location & Event Data — Africa event recordsL1 Conflict · reliability A
- [2] UCDP — Uppsala Conflict Data Program — organised violence datasetL1 Conflict · reliability A
- [3] UN OCHA / ReliefWeb — Situation reports, access snapshots and humanitarian updatesL2 Early warning · reliability A
- [4] GDACS — Global Disaster Alert and Coordination System alertsL2 Early warning · reliability B
- [5] FEWS NET — Food security outlooks and alertsL2 Early warning · reliability A
- [6] NASA FIRMS / Copernicus — Active fire detections and open satellite imagery for corroborationL3 GEOINT · reliability B
- [7] GDELT Project — Global media event and tone monitoringL5 Strategic · reliability C
- [8] Institute for Security Studies (ISS Africa) — Regional political and security analysisL5 Strategic · reliability B
- [9] INGO ADVISORY analyst desk — Practitioner interviews, field reporting and imagery verificationL6 Verification · reliability B
- [10] OpenSanctions — Sanctions, PEP and enforcement screening dataL5 Strategic · reliability A
Free operational toolkit
Act on this assessment
Six free operational tools for NGO and charity teams — no sign-up, nothing leaves your browser.
- Travel risk authorisationRisk-tiered approval form with control verification before movement is signed off.
- Vehicle & convoy check13-point pre-departure inspection with go / no-go clearance logic.
- Safeguarding / PSEA referralAnonymised referral log for PSEA and misconduct concerns.
- Cyber hygiene assessmentScored self-assessment producing a prioritised remediation workplan.
- Staff accountability roll callReal-time headcount and status tracking during an incident.
- Endurance calculatorContingency stock planning for water, food, fuel and cash.