In his 2026 State of the Nation Address, President Ramaphosa set a clear direction for crime prevention in South Africa. Government, he said, will intensify its fight against organised crime and the illicit economy through intelligence-led operations supported by technology, data analytics, and AI. Multi-disciplinary teams will use consolidated national intelligence to identify syndicates, analyse patterns, and disrupt criminal networks. Technology will no longer be an add-on tool in policing; it will be central to how crime is prevented and prosecuted.
This official stance addresses a reality that is already visible across the private and public sectors: crime has evolved. Globally, there are 5.5 billion malware attacks and 6.3 trillion intrusion attempts each year. South African organisations face the highest probability of repeat attacks, with 83 percent reporting more than one breach. At the same time, 90 percent of South African companies lack the maturity to counter AI-enabled threats.
Dr Stephen Akandwanaho, Executive Dean: Faculty of Information Technology at Richfield, recently attended the SA Police Service Detective and Forensic Services National Excellence Awards, which confirmed the scale of the shift that is needed to combat – and prosecute – cybercrime.
“Modern crime is deeply digital. Investigators must understand encrypted devices, digital trails, metadata, and network evidence. Specialised forensic expertise is critical because, without trained digital forensic professionals, justice systems risk falling behind increasingly sophisticated cybercriminals.”
The nature of evidence has also changed fundamentally, now sitting in cloud storage, mobile devices, IoT systems, or distributed blockchain ledgers. “We are no longer only collecting fingerprints,” Akandwanaho says. “We are collecting log files, blockchain trails, deleted data fragments, and geolocation histories.”
However, as digital evidence becomes central to criminal investigations, there is still widespread confusion about what computer forensics actually is, and what it is not. Dr Akandwanaho is clear about one point that is often misunderstood: computer forensics is not the same as IT or cybersecurity.
“IT builds systems. Cybersecurity protects systems. When system breaches occur, computer forensics investigates incidents, extracts digital evidence, and prepares it for legal admissibility. It requires working knowledge of the relevant laws, forensic methodology, and other specialised tools to bridge technology with the justice system.”
This distinction matters. Demand for computer forensics is growing across law enforcement digital investigation units, financial institutions, corporate fraud and compliance divisions, regulatory bodies, cyber insurance firms, and digital risk advisory practices.
Education has therefore become strategic, with tertiary qualifications providing an edge. Richfield’s Higher Certificate in Computer Forensics covers forensic computing foundations, digital crime and investigation, network forensics, internet forensics, and advanced forensic computing.
But, says Dr Akandwanaho, students also apply what they learn. “Theory alone is not enough. Case based investigation scenarios, digital evidence analysis exercises, and simulated forensic environments. Chain of custody, cyber legislation and evidentiary procedures. These real-world exercises are critical elements of work-integrated learning.”
As government expands its use of AI and data analytics to combat organised crime, the private and public sectors will increasingly require professionals who can investigate digital incidents and produce court-ready evidence. This is where computer forensics plays a role. Building this capability through specialised qualifications will be critical to strengthening cyber resilience, supporting law enforcement, and ensuring accountability in an increasingly digital economy.
