Galeboe Mogotsi, CISO at University of Witwatersrand, reveals the academic sector’s unique vulnerabilities and how a collaborative, people-first approach is key to its digital resilience.
In a digital landscape where threats evolve quicker than policies can adapt, South Africa’s universities have become prime targets for cybercrime. Open by design and decentralised by nature, higher education institutions confront increasing threats to intellectual property, research outputs and student data.
For Galeboe Mogotsi, Chief Information Security Officer at Wits ICT, the solution lies not only in firewalls and filters but also in fostering a culture shift that balances collaboration with vigilance.
“We’re not like corporates,” Mogotsi said, speaking from his Johannesburg office. “Universities are inherently open, fluid and collaborative. That’s what makes them valuable. But it also makes them vulnerable.”
There are several challenges; phishing remains the most persistent and widespread threat, with students and academics regularly targeted by socially engineered emails to extract login credentials.
Once attackers are in, they can move laterally through systems, mining sensitive data or disrupting operations. “Phishing is still number one,” Mogotsi confirmed. “But ransomware is catching up, and we’re also seeing more data breaches – particularly as we operate across hybrid environments that include both on-premise and multi-cloud systems.”
Complicating matters further is the ever-present risk of internal missteps. “You can have all the best security tools in place,” he said, “but it only takes one person to click the wrong link.”
An architecture of readiness
In response, Wits ICT has built what Mogotsi described as a ‘multi-layered’ security approach. It includes advanced email filtering systems, routine security awareness training for staff and students, and constant network monitoring. Like many institutions across South Africa, Wits also partners with a managed Security Operations Centre (SOC), a move driven by the chronic shortage of cybersecurity talent within academia.
“We don’t have the luxury of large security teams,” he explained. “The managed SOC fills that gap and provides us with ongoing threat intelligence and monitoring capabilities.”
But this is more than a matter of technical controls. Preparedness is as much about mindset as it is about machines. “We’ve moved away from thinking about whether an attack will happen,” Mogotsi said. “Now, it’s about how well we can respond when it does.”
An incident response plan is firmly in place, and data protection protocols are being reinforced – particularly around critical research data. Access management has also been tightened to limit the impact of insider threats. Still, Mogotsi knows that the institution’s open culture can’t be compromised in the name of control.
Balancing openness with risk
“We don’t want security to become a barrier to learning,” he said. “The university experience depends on the freedom to share, experiment and build things together. Security controls must respect that.”
To maintain this equilibrium, Wits uses adaptive security policies – frameworks that scale protections depending on context and risk. In parallel, Mogotsi and his team regularly engage with academic staff and student representatives, ensuring cybersecurity concerns are understood and integrated without disrupting the learning environment.
“This can’t be a top-down imposition,” he added. “People need to understand why security matters and how it protects what they value.”
Embedding cybersecurity into Digital Transformation
Cybersecurity is no longer an afterthought in Digital Transformation efforts at Wits – it’s a foundational pillar. Mogotsi is involved from the outset of any new project led by the CIO or other departments, ensuring risks are assessed early and mitigated before systems are deployed.
“If you involve security at the end, we become the bottleneck. That’s not the reputation we want,” he said. “I’ve raised my hand and said: bring us in from the beginning.”
This approach extends across departments and faculties. As teaching and learning increasingly move onto digital platforms, Mogotsi ensures alignment between academic innovation and institutional security policies. Cross-functional working groups help identify gaps and set shared priorities.
The cybersecurity budget is discussed openly with other stakeholders, tying investment decisions to broader institutional goals.
The talent tug-of-war
One of the most pressing concerns is the lack of cybersecurity talent across the public sector. “We’re a public university,” Mogotsi said candidly. “We can’t match the salaries that banks or big tech firms offer. When our staff are poached, we can’t compete financially.”
To adapt, his team focuses on upskilling internal talent, especially in areas like AI and threat detection. Managed SOC services fill some of the remaining gaps. But Mogotsi is also thinking long-term.
He’s begun advocating for a collaborative national approach that draws from the student pipeline. “Why can’t we tap into our third and fourth-year computer science students? We train them, partner with industry and build a talent pipeline for all 26 public universities in South Africa.”
He’s already initiated conversations with fellow CISOs and academics to explore creating a shared cybersecurity training and internship platform. “The talent is already here. We need to organise it and focus it.”
A lesson from crisis
Mogotsi’s philosophy regarding cybersecurity was shaped by a previous experience he describes as a turning point. While working for another organisation – he declines to name it – a major breach exposed just how unprepared they were. “It was a wake-up call,” he said. “It forced me to think differently about what resilience really means.”
The breach prompted a complete overhaul in how he approached leadership: greater focus on incident response, clearer communication channels and a more profound commitment to embedding cybersecurity culture into every layer of the organisation. “Cybersecurity isn’t just about firewalls and policies,” he said. “It’s about people. It’s about awareness. It’s about creating a collective sense of responsibility.”
Building shared defences
Mogotsi also advocates for a more unified front across the higher education sector. “We’re all fighting the same enemy,” he said. “Every university holds student data, IP, and research outputs. Yet our threat intelligence is fragmented.”
All 26 public universities in South Africa share the same national research and education network. Mogotsi argues that this commonality should allow for a unified threat intelligence platform – a shared cybersecurity backbone that can spot patterns and alert institutions before it’s too late.
He’s begun reaching out to peers and even national government bodies to advance this idea. “If we collaborate and build this together, we’ll be far stronger than any university can be alone.”
Advice to the Next Generation
For young professionals entering cybersecurity – especially within the academic or public sector – Mogotsi offers simple advice: be intentional, stay curious and never stop learning.
“Cybersecurity evolves constantly. You must evolve with it,” he said. He recommends pursuing certifications, engaging with online simulations, and joining professional communities. He serves as Vice President of the Cloud Security Alliance’s local chapter, supporting training and best practices.
“Understand how cybersecurity fits into the broader mission of your organisation. Especially in academia, it must be woven into the fabric – not forced on top of it.”
The work is demanding. The hours can be extended. And the enemies are often invisible. But for Mogotsi, the reward lies in knowing you’re protecting the future – one system, one student, one step ahead of the next threat.
“We are soldiers,” he said. “Not in uniform, but on the frontlines of a different kind of war. One that’s fought with knowledge, vigilance and the willingness to stay ahead of what others don’t see coming.”
