Armata and RedRok partner to protect businesses against increasing AI-driven cyberthreats

Caesar Tonkin, Managing Director at Armata Cyber Security.

"This is not a new engagement but the strengthening of an existing, proven relationship between the two companies, as RedRok's engine has already been powering Armata's Advanced Cyber Defence and Third-Party Risk Assurance Services. With the partnership, continuous threat exposure management is being made a standard layer of protection for Armata's current and future clients without introducing operational complexity. This builds on our expanding offerings and strategically positions Armata for future growth in the industry," says Caesar Tonkin, Managing Director at Armata Cyber Security.

These advances are becoming necessary as today's attack surface expands across hybrid clouds and remote workforces, while the enforcement of data privacy laws, such as the Protection of Personal Information Act (POPIA), and the Cyber Crime Act continues to tighten, and the cost of data breaches for organisations keeps getting higher.

"More concerning is the rise of offensive AI, as in the past, threat actors typically targeted large enterprises, as these offered the most 'reward' for their efforts. With technology at their fingertips, the time and cost of attacks have become negligible, and mid-market organisations that have a fraction of the resources that large and enterprise customer segments have are now defenceless against highly sophisticated attacks that are partially or entirely carried out by machines," adds Uri Levy, CEO at RedRok Cyber.

Threat report highlights vulnerabilities of local organisations Securing data is already a challenge for local businesses. A threat-exposure report was commissioned by Armata and powered by RedRok's RedPool threat intelligence platform. This Report found a significant amount of anomalously analysed stolen-credential exposures across 37 major South African organisations spanning ICT/Technology & Telecom, Financial & Professional Services, Government & Public Sector, Energy/Chemicals/Industrial, Education & Research, Aviation & Aerospace, and NGO/Civil Society sectors. This independent threat intelligence Report examined concentration risk, credential staleness (71% unseen over a year), blurred personal/corporate device use, and third-party/supplier exposure, closing with five prioritised remediation actions led by rotating high-access credentials.

Derived entirely from criminal stealer-log telemetry, the RedPool Report, which was presented at the Armata Cybersecurity Leadership Summit held on 29 July this year, revealed 5,376 circulating credentials, 225 infected devices, and 100 reachable services, with Education & Research accounting for 97% of leaked credentials despite representing just 2 of 37 organisations in this threat intelligence assessment.

To counter these fast-moving threats, organisations must transition from retrospective snapshots. Relying on annual penetration tests or quarterly scans means defending systems based on outdated information. What businesses require today is a continuous, always-on view of exposure that operates at the speed of modern attackers.

"I think about the Chief Information Security Officer (CISO) carrying that risk on their own shoulders without the internal team to run continuous exposure management themselves. Our goal was to close that gap for them. Armata's model has been to find the best technology and wrap our own people, our own service level agreements (SLAs), and our own accountability around it so a client isn't left holding sophisticated security tech that their internal teams are effectively using as part of their cyber defense," explains Tonkin.

Adopting an 'assume breach' security posture The joint solution integrates RedRok's platform with Armata's Advanced Cyber Defence expertise. RedRok's AI engine maps internal, external, and cloud exposure and traces actual attack paths to critical assets and identifies 'choke points' where multiple paths converge and passes these onto the security experts at Armata. Armata's Security Analysts then validate these paths using breach-and-attack simulation and the MITRE ATT&CK framework, translating this data into tickets that are addressed. In this way, as part of the rapidly evolving "early warning" capabilities that come with Armata's Advanced Cyber Defence expertise, action is taken even before an attack, and preventing this exposure eliminates the chances of an attack succeeding.

This proactive approach enables businesses to adopt an 'assume breach' security posture: "Every CISO knows the uncomfortable truth: it's not if; it's when. What we're building with RedRok tells you, before anything happens, exactly what an attacker could reach if they got a foothold today. And then we go test whether your existing controls would actually stop them, using breach-and-attack simulation, not just theory. That's the difference between assuming breach as a slogan and assuming breach as an operating model. This is not just another security tool; it's a business risk mitigation platform that will help them retain confidence with their customers, shareholders and suppliers," explains Tonkin.

For Armata, existing customers retain their trust in our Cyber Security teams, Service Centre, and predictable terms under Armata's monthly Cybersecurity-as-a-Service model, while giving them real-time visibility across internal, cloud-based, and third-party attack surfaces, all rolled into a single SLA.

"Our vision is to equip mid-market organisations with the capabilities to protect and defend themselves effectively against such sophisticated attacks by giving them an enterprise-grade view of their exposure without having to run the RedRok platform themselves. Rather, these organisations are looking for trusted partners, and we recognise Armata as this kind of trusted partner that is committed to protecting their customers by providing the advice, capabilities, skills and tools that these organisations don't have access to," concludes Levy.

ENDS//

ABOUT ARMATA Armata is a niche private cyber security company, with operational presence throughout South Africa, whilst servicing several of our Clients which have international presence. Armata delivers cyber intelligent solutions that help minimise business interruption from cyber risks to their business, whilst protecting our 650 + Clients' data and critical business systems, based on defined Service Levels. We partner with Clients to solve their information and cyber security problems & challenges. We offer outsourced Cyber Security Operations on a turnkey basis, with an SLA

Armata customers' delight is clear. "Throughout our engagement, Armata has demonstrated a consistent standard of technical competence, operational diligence, and client responsiveness. Of note is Armata's contribution to raising assurance levels for our manufacturing organisation to our many industry customers — an outcome evidenced by an independent audit conducted against applicable sector cyber security standards, in which Armata's preparation, advisory and technical remediation work was instrumental. They exceeded Service Level expectations." CISO, Manufacturing Organisation, July 2026

For more information, visit https://armata.co.za/

ABOUT REDROK RedRok is a cybersecurity company delivering Continuous Threat Exposure Management (CTEM): a single, unified platform that finds an organisation's exposures and removes the risk they create. Where most security programmes rely on separate tools for attack surface discovery, threat intelligence, and control testing, RedRok brings them together into one continuous cycle. The platform maps internal, external, and cloud attack surfaces, traces the real paths an attacker could take to critical assets, and draws on live criminal telemetry to surface compromised credentials and infected devices before they can be used against the business.

What sets RedRok apart is what happens after discovery. Its AI engine correlates technical exposure, identity risk, and human risk into a single prioritised view, identifying the choke points where multiple attack paths converge, so that fixing a handful of issues closes hundreds of routes to compromise. Every finding is validated against the controls an organisation already has in place, so teams act on what is genuinely exploitable rather than on a list of thousands of theoretical vulnerabilities. The result is a measurable, continuous reduction in risk, not another dashboard.