Ethical hackers given the keys to one South African company found their way to data belonging to one of the country’s largest lenders, through a door the bank didn’t even know was open.
JOHANNESBURG. Nobody went near the bank. Nobody tried its passwords, probed its servers or sent its staff a suspicious email. And yet, by the end of a single authorised security test this week, data linked to one of South Africa’s Big Five banks was sitting on a screen in front of a team of ethical hackers.
It started as a routine job. A local company, wanting to know how well its defences would hold up, commissioned Kingly Clark, a South African ethical hacking firm, to test them. The assessment was authorised by the company from the outset, and the brief was simple: get in, see how far you can go, and report back.
How far they went is the story.
Instead of a small team working through the network by hand, the testers turned an AI-driven system loose inside the company’s environment. It did not stop at the first open door. It kept walking.
What the system reached
The list reads like an inventory of a modern business.
Internal email threads, the day-to-day conversations between staff, clients and suppliers. Document stores holding years of working files. Login credentials sitting in shared drives, saved where colleagues could find them and, as it turned out, where an automated system could too. Client files. Invoice records. And the access logs showing who had touched what, and when.
Then came the contracts. Every contract the company held was opened. From each one, the system pulled the client names, account references and connected systems attached to it. Contract by contract, the picture filled in: who the company worked for, how it was paid, and which outside systems it was plugged into.
By the end, the team held a blueprint of how the business ran, and who it ran it for. One of the names on that blueprint was one of South Africa’s Big Five banks.
The bank that wasn’t the target
The bank was never the target. It was not named in the brief. Its own systems were not attacked, and it was not hacked or breached. Yet data linked to it was reachable from inside a company it had trusted with that information.
That distinction matters. The finding is not that a bank’s defences failed. It is that one of the country’s biggest banks had data reachable through someone else’s front door, held by a supplier whose security sat entirely outside the bank’s own walls.
The findings went back to the company as part of the contract. No data was taken, altered or shared outside the engagement. This was a rehearsal, run by people paid to find the gaps before anyone else does.
A chain, not a wall
South African banks spend heavily defending their own perimeter, and with good reason. But no bank operates alone. Every one shares information with suppliers, service providers, consultants and partners, and each of those relationships is another place its data lives.
Security professionals call this third-party or supplier risk. A bank can lock its own doors tightly, but it has far less control over the doors of the companies it works with: their staff, their shared drives, their habits around passwords and documents.
This week’s assessment followed that chain from contracts to client accounts to connected systems. It didn’t need to break through the bank’s wall. It found a way around it, by starting somewhere else entirely.
Why this test was different
A traditional penetration test is a human craft. One or two specialists work through a network, often over days or weeks, finding a way in and seeing how far they can get before writing it up.
An AI-driven approach changes the pace. Many agents can work in parallel, each picking up a different thread, sharing what they find and moving on without pause. And crucially, they can treat a company’s own paperwork as a map. A contract is not just a document; it is a list of directions pointing to the next client, the next account, the next connected system.
That is how a test of one company ended up touching data linked to a bank.
It is also why the scale of what was reached feels so different from a conventional report. A human team might surface a handful of serious weaknesses and a list of recommendations. A system that reads everything, at once, surfaces the relationships between them: the credential that opens the drive, the drive that holds the contract, the contract that names the client.
None of those things is dramatic on its own. A saved password. A shared folder. A signed agreement. Put together by something that never stops reading, they become a route.
AI moves faster than the rules
The wider backdrop is familiar to anyone in South African business. Companies are adopting AI tools quickly, to write, summarise, search and automate. In many organisations, the governance around those tools, the policies, training and monitoring, is still catching up.
The same technology that makes a business faster can make an assessment like this one faster too. And if ethical hackers can do it under contract, the uncomfortable question is what someone without a contract could do with the same capabilities.
The defence is also AI
There is a twist the testers have hinted at but not yet explained. The people behind the assessment say the same kind of technology is being built for defence: AI agents designed to spot other AI agents at work and respond at machine speed. If the attack of the future does not involve a person at a keyboard, the defence may not either.
What it means in the boardroom
For directors and risk officers, the lesson is less about one company and more about the network every business sits inside. Your own security posture is only part of the picture. The other part sits with every supplier that holds your information, or your clients’.
Few companies can say with confidence how well those suppliers would hold up against a test like this one.
Questions still unanswered
Who carried out the assessment, which tools they used, and how the AI-driven approach got so far so quickly are all still unclear. More detail is expected in the coming weeks.
For South African businesses, the question this week is uncomfortable: if a system following your contracts started at one of your suppliers, where would it end up?
The Joburg Report will be following up.