Your installed base is hardware you can count. Your book is a list of names, addresses, account numbers and site details, and it does not set off an alarm when it walks out the door. One large operator found that out this month, and the way it happened is worth a few minutes of your day. Let's get into it.

No malware, no stolen password, nothing for multi-factor authentication to catch. Just a phone call and somebody being a little too helpful...

In July this year, an extortion crew sent a ransom to a large American monitoring company, threatening to leak more than 41 gigabytes of files from their Salesforce instance (i.e. customer info). When the company didn’t pay up, the list appeared online in early August.

Thing is, there was no prior warning: Monitoring continued as normal, panels kept reporting, signals kept arriving at the control room and every alarm on that network carried on doing its job. The attackers had gotten in and made off with names, contact numbers, account details, site information and years of support conversations.

How? The security company had no way of telling, but the attackers claim they got in by phoning and fooling an employee (it has not been verified, but that’s the claim). And it’s worth considering, because if it can still happen in the US in 2026, how prepared are we for this kind of attack in SA right now?

In SABRIC’s most recent figures of digital fraud, we see that fraud in SA rose 29%, and most of it is not hacking but vishing and phishing (using phone or email to impersonate others in an attempt to convince company staff or clients to divulge classified information or access).

Some R2.4 billion protected by some of the best-funded security teams in the country was lost this way last year. And none of it involved defeating the intricate systems the teams built.

Now the big question: If that’s the shape of fraud in banking, what’s to say it’s not the modus operandi everywhere else? Security, for example.

The breach in the international example involved a sales tool provider, but access could have been granted internally. So it’s always worth asking how ops works with your customer data. You might be ticking all the boxes on your system, but what about external tools like a CRM or customer data living on an employee’s WhatsApp?

Worthwhile auditing where your customer data actually lives, who has access, etc. And then build in security processes to help ensure it can’t leak due to tech or human error.

On site, most of us already have some anti-persuasion control: the client passphrase and duress words. The problem is that it only faces one direction (verifying the client’s identity). But what about the other way?

Scammers pretending to be a technician, the estate's managing agent, or the alarm supplier’s IT person are just as much of a risk — it’s exactly what’s happening in banking.

A possible fix could be creating rules like no account, contact-list or credential changes, or access grant ever happens on an inbound call. Perhaps even a designated number to phone to check, and if there’s no number on file, the answer is no until there is. Empower your team by saying that a controller who refuses even a senior person on the phone has done the job correctly.

A scaled-down version works at the gate: Access control has the same vulnerability if someone claiming to be a visitor or contractor arrives, so it’s worth having a rule of one number to call back on and maybe a short list of people who may authorise access.

For estates, it’s worth time and money: A written procedure for what happens when somebody phones this gate claiming to be from your managing agent, who is allowed to authorise access on your scheme and the log and how it works is a powerful answer when a trustee asks why your quote is higher than the operator down the road at the next AGM.

Toyota South Africa confirmed on 14 August that a cybersecurity incident at a third-party bulk SMS provider pushed fraudulent messages to its customers, promoting a gambling partnership Toyota never agreed to. The affected account was locked, regulators were engaged, and customers whose personal information may have been exposed were notified. Toyota still cannot name the provider publicly.

Signal: Your arm-and-disarm alerts and account notices leave on somebody else's platform. Find out whose, because your name is on every message it sends.

Stolen reservation data is being used to pose as accommodation providers and push guests to enter card details on payment links that expire in five to ten minutes. The urgency is the whole trick, because panic arrives before suspicion does. A hospitality cloud platform serving South African properties was breached in June, exposing two million records including names, phone numbers and stay dates.

Signal: The advice your hotel and estate clients are getting is to phone the number on the website instead of trusting the message. That is your callback rule in their language.

At the 46th SADC summit in Durban, Natjoints confirmed on 16 August that two people were stopped at an access control point because their identities did not correspond with the accreditation they presented. A third had allegedly sought credentials as a performing artist. Every part of that worked at the door, where somebody compared a face to a card.

Signal: Every estate you service issues visitor and contractor credentials. Ask who compares the card to the person holding it, and what happens when the two do not match.

Video found in Apple's macOS 26.7 release candidate, reported on 18 August, shows AirPods with cameras feeding Siri's Visual Intelligence. People were up in arms over privacy concerns. But Bloomberg clarified that the cameras capture low-resolution visual information only to act as eyes for Siri, are not designed to take photos or video, and include an LED that lights when visual data goes to the cloud.

Signal: Estate device rules were written around phones and glasses. Earbuds are not covered by any of them, and you are the person trustees will ask about it.

Chery took over the Rosslyn plant outside Pretoria in July, keeping all 692 staff, with production due mid-2027 and South Africa positioned as its African hub for manufacturing, exports and research. On 19 August, its robotics arm said it has 110 humanoid police robots deployed across Chinese cities for traffic management and crowd guidance. Nothing announced points to robots being built or sold here, but you never know.

Signal: Ask what a client means when they say robot. In South Africa, the honest answer is still a camera on a pole, and knowing the difference is what makes you the expert in the room.

Wireless changes what you can sell into a site. No chasing cables through a finished building, no cutting into a client's walls, and a lot more properties worth quoting. Olarm ONE is Olarm's wireless system, and the free Olarm ONE Solution Mastery course is where your team learns it properly, before the first job rather than during it.

Three reasons it's worth your team's two hours:

Sit a technician down with it now and the next wireless enquiry becomes a quote instead of a maybe.

Chinese robot-maker Unitree went public recently, listing on the Shanghai stock exchange. By 19 August, they’d risen nearly sixfold, so the company celebrated by demoing a new unnamed humanoid it is calling Superman. And for good reason, it’s a real athlete: top speed is 12.66 metres per second (beating Usain Bolt’s 12.4), and it can jump two metres straight up from a standing start. Check out the video…

Making robots that way outperform humans is now a reality, but we can’t help wondering for how long: Unitree is known for its marketing stunts; we’d love to know the battery life on Superman.

Signal: Peak specification and duty cycle are two different numbers. It is the same gap between what a camera does in a demo room and what it does at three in the morning in the rain.

The calendar is busy from today, which is convenient:

Running or fishing something we should be shouting about? Hit reply and put it on our radar.