Red Hat Survey Shows Blind Spots in South Africa Enterprise Software Supply Chains

Red Hat, the world's leading provider of open source solutions, has announced the results of a survey examining enterprise artificial intelligence (AI) adoption and risk management across 1,400 CIOs across 14 countries, including South Africa. The research indicates that while autonomous AI agents are rapidly moving into enterprise production, with 99% of South African businesses surveyed already deploying agents in production, a critical gap persists between perceived governance and actual operational visibility.

The majority of South African CIOs surveyed (93%¹) report high confidence that their AI agents operate securely and in compliance with regulations, supported by guardrails and monitoring. However, the data highlights that this optimism can mask a lack of visibility:

• 61% of respondents report having a precise understanding of data flows within their organisation and the knowledge of where data is stored and processed.
• Only 44% have a comprehensive overview of their software supply chain as well as direct and indirect dependencies.
• Just under half (48%) continuously assess the risks posed by AI providers, beyond initial onboarding.

These results indicate that while survey respondents feel that their AI agents and environments have appropriate security and sovereignty controls, the reality shows a lack of auditable proof in these operations. The dynamic nature of AI innovation and market forces makes it possible for a system to have high levels of security and compliance at deployment, but then be completely exposed soon after.

Small gaps in visibility, major risk to data

South African enterprises are accelerating their AI adoption curve, with 63% of respondents stating they can fully rely on tested guardrails, continuous monitoring and automated intervention mechanisms. A further 30% of South African companies are 'fairly confident' that they have security and compliance under control, but acknowledge minor gaps in their guardrails and monitoring.

In production environments, however, unmonitored data exchanges between enterprise platforms, cloud services, and external AI models can create risks. 28% of South African companies report minor gaps in the visibility of data flows, and 9% have already introduced AI functions without fully understanding the data flows.

The great risk of indirect software dependencies

As many as 81% of South African companies surveyed report that they are able to patch critical software vulnerabilities within 24 hours once a fix becomes available. The remaining companies take a few days, with none indicating that it takes longer than two weeks.

However, most companies do not know exactly which software components are in use. Only 44% have a complete and constantly updated overview of all the open source components they use, including their origin, version numbers and direct and indirect dependencies. Across all the countries, the average figure is just under 33%.

Whilst 45% of South African companies have a good overview of the components and versions, they note concessions when it comes to understanding origins and indirect dependencies. 11% of respondents in the country lack a complete overview.

Indirect dependencies are common in many open source software projects, meaning that they incorporate libraries, frameworks and other components from other projects. These dependencies can often pose significant risks for an organisation's IT estate, especially if they are not effectively evaluated (56%²).

Risk assessments as an ongoing rather than a one-off task

When it comes to assessing risks posed by AI providers, only 48% of South African companies report that they are well-prepared and have measurable, continuously monitored criteria as part of their day-to-day AI operations.

Although 34% of companies surveyed in South Africa conduct a risk assessment before implementing new AI technologies, they struggle to monitor and evaluate those risks afterward. 10% rely solely on an initial evaluation, which can be insufficient in the rapidly evolving world of AI, as models, data, regulatory requirements and threats change almost daily.

This challenge and the need to address it through measurable, internally controlled methods is not lost on survey respondents. Only 5% of South African companies rely solely on external audits, certifications and contractual assurances for their risk assessments. And only 3% rely on the reputation of providers and past experience.

Quotes

Dion Harvey, regional general manager Sub-Saharan Africa, Red Hat

"Adopting enterprise AI is a process that varies from organisation to organisation. But what every process has, and should have in common, is the prioritisation of visibility and auditability. Regardless of industry or even business use case, enterprise teams should be able to identify and understand how data is managed across their technology estates. That becomes critical as more South African businesses explore the potential of agentic AI. By being able to trust software supply chains and consider the use of open source projects, they can innovate with confidence and keep full control and oversight of ever-evolving infrastructure."

Chris McBrayne, senior vice president and general manager, EMEA, Red Hat

"Although companies' self-assessments vary slightly when compared internationally, most are relatively confident that they can effectively monitor and control AI agents. However, this confidence in their own capabilities is not always justified, with our research showing a lack of comprehensive and continuous transparency regarding data flows, software dependencies and vendor risks. Open architectures with centralised management can, however, help companies maintain control and remain flexible when selecting models and providers."

1 Combines 'Very confident - we have tested guardrails, continuous monitoring and mechanisms to intervene or stop agents when required' and 'Fairly confident - we have guardrails and monitoring in place, but some gaps remain'

2 Combines 'We have good visibility into components and versions, but limited visibility into their origins or indirect dependencies', 'We know which major open source components we use, but do not have a complete view of the wider software supply chain', 'Our visibility varies significantly between apps and business areas', 'We have limited visibility into the open source components and dependencies used across our critical applications',' We do not systematically track our open source software supply chain'

Research was conducted by Censuswide among 1400 CIOs (25+) in the UK, France, Italy, Germany, Spain, UAE, Sweden, Turkey, Switzerland, Poland, South Africa, Netherlands, Belgium, Saudi Arabia between 24.08.2026-01.09.2026. Censuswide is a member of the Market Research Society and the British Polling Council, and a signatory of the Global Data Quality Pledge.