Prepared by the Excellerate Security Intelligence Desk
The Dominant Security Risk In This Cycle
South Africa votes on 4 November across 257 municipalities. The dominant security risk in this cycle is the targeted killing of individual candidates and councillors, and it is well under way. Research recorded through late August counts at least 23 suspected political assassination incidents resulting in 26 deaths across five provinces since the start of 2026, with councillors and candidates increasingly the target. That is roughly one incident every ten days.
The overall risk assessment is HIGH and the direction of travel is negative.
Why Municipal Office Raises The Stakes
Municipal office is where South African politics converts most directly into money. A ward councillor sits across procurement, housing and indigent lists, local appointments and ward committee patronage, and in a thin local economy the council is the largest buyer and employer in the district. That is why 105 of the 186 politically motivated assassinations recorded in South African election years since 2000, some 56 per cent, fell inside municipal cycles. The violence tracks candidate selection within parties. An aspirant who loses a nomination or is placed too low on a list has an instrumental interest in the removal of the person ahead of them, either to force a by-election or to move up.
The Risk Calendar Is Now Live
The risk calendar is now live rather than approaching. Nominations closed at 17:00 on 28 August and final candidate lists become public on 16 September. The fortnight in between is the sharpest phase of the cycle, because those who lost internal contests know the outcome while the public does not. The ANC has extended that exposure by deferring its metro mayoral selection a second time, publishing a pool of 42 names across the eight metros on 22 August with the final decision held to national officials in September. Forty-two aspirants competing for eight posts, decided centrally and still unresolved, is a reliable generator of factional grievance.
What The Threat Looks Like In Practice
Knysna is the clearest illustration of what the threat looks like in practice. Between 19 and 26 August the Western Cape town lost serving Ward 8 councillor and former executive mayor Aubrey Tsengwa, former Ward 7 councillor Mandla Matiwane, local taxi forum secretary Mandla Tyololo, and a police captain deployed to investigate the first three killings. Four suspects are in custody. The cluster confirms the taxi-sector nexus, establishes the Western Cape as a primary hotspot rather than a secondary one, and demonstrates a willingness to engage the state’s own investigators. Treat protective and investigative work in active clusters as a hostile environment.
KwaZulu-Natal remains the highest-intensity province. Premier Thamsanqa Ntuli has confirmed that at least 18 councillors have been assassinated there since the 2021 local government elections, with eThekwini accounting for five, the highest of any municipality in the country. That is roughly one councillor killed every three to four months across a normal council term, before an election cycle is added.
The State’s Response Capacity
The state’s ability to investigate political murder is compromised at the worst possible moment. The Political Killings Task Team was ordered disbanded, had its dockets returned, and is working current cases without settled institutional standing. The National Commissioner is suspended and facing criminal charges alongside twelve other officers, and the police ministry is also under acting leadership. Crime Intelligence is under investigation for an alleged off-the-books operation, and its own head has testified that an organised crime network with international links has penetrated the political sphere while running tender fraud, extortion, kidnapping and contract killing. The Madlanga Commission’s final report has been extended to 16 November, twelve days after polling, so none of this resolves before the vote.
Cabinet condemned the killings on 28 August, commended the speed of the Knysna arrests, and explicitly declined to intervene, with the Minister in the Presidency stating that law enforcement should be trusted to bring the situation under control. No dedicated candidate protection programme and no new task team have been announced. Existing structures carry the campaign.
Three Hazards Run Alongside The Assassination Threat
Three hazards run alongside the assassination threat:
Organised anti-migrant mobilisation has set 30 September as a second national day of action, five weeks before polling, with organisers claiming greater capacity than the 30 June action that produced roughly 150 demonstrations in a month with violence at about a quarter of them. Service delivery grievance is being aimed at the persons and property of local representatives, against an Afrobarometer finding that only 17 per cent of South Africans believe councillors listen to them.
Criminal syndicate with asserted party links are positioning for the post-election municipal spend – with testimony presented to the Madlanga Commission to date pointing to the existence of deeply entrenched criminal networks operating across the public and private sectors.
Hyper-local disinformation generated with AI tools remains the IEC’s own stated integrity concern. The wider threat environment is significant: INTERPOL estimates that AI now enables 55% of reported cybercrime across Africa, while cybercrime losses more than doubled from US$192 million in 2024 to US$484 million in 2025. In South Africa, more than a third of fraud incidents reportedly involve generative AI, including increasingly sophisticated manipulation of documents, images and video.
The Second Peak Falls After Polling Day
The second peak falls after polling day. More than 66 councils were already hung, the ANC is polling below 40 per cent, and most metros will be settled in negotiation rather than at the ballot box. The window from declaration of results to the installation of mayors and executives, November to January, carries elevated risk of council chamber disorder, mobilised protest by excluded parties, and coercion of the individual councillors whose votes decide a mayoralty.
Whilst a repeat of the July 2021 unrest is unlikely, it cannot be discounted because that week killed more than 300 people and cost around R50 billion, and because most of the people who organised it were never convicted.
The Electoral Machinery Has Performed
The picture is not uniformly bleak, and the electoral machinery in particular has performed. The final voters’ roll was certified on 26 August at roughly 29 million registered voters, with about two million added across the June and August registration weekends and around 80 per cent of new registrants aged between 16 and 29. Nominations closed without systems failure.
Treasury has topped up election funding and Parliament is satisfied with IEC readiness. The Commission has moved from advisory statements to draft binding rules requiring parties to label AI-generated campaign material and correct false claims on their own platforms.
Quarterly crime statistics released on 28 August show murder down 5.9 per cent nationally, which makes the rise in political killings a movement against the national trend rather than part of it. The system is under strain, but it is working.
Adriaan Otto, Managing Director, Excellerate Services
“The picture presented in this report is serious, but it needs to be kept in perspective. South Africa is not facing a single, uniform election security threat. Political violence, localised protest, criminal activity and an increasingly complex information environment create different risks in different places.
For businesses and property owners, the response should be preparedness, not alarm. Experience tells us that organisations manage disruption best when they understand their exposure, have reliable intelligence, clear escalation triggers and established lines of communication and decision-making.
Importantly, the risk does not end on polling day. The period following the results and the formation of municipal governments will also require close attention.
Over the coming weeks, our focus will shift from understanding the threat to preparing for it. In October, we will share practical guidance for landlords, property and facilities teams on strengthening site readiness ahead of the election period. We cannot predict every scenario, but we can make sure we are ready to respond when circumstances change.”
DOWNLOAD THE FULL REPORT
Security Risks Surrounding the 2026 South African Municipal Elections
