The digital transformation of public services has positioned e-government systems as vital instruments of modern governance. While enhancing efficiency and accessibility, these platforms are increasingly exposed to complex cyber threats. In developing contexts, such as South Africa, risks are intensified by socio-technical constraints, legacy infrastructure, and fragmented policy environments. This study applies a systematic literature review of 78 sources (2015–2025), complemented by thematic analysis using the Adapted Vulnerability Triad Framework, to categorise vulnerabilities across technical, human, and organisational domains. Findings reveal systemic risks, including outdated infrastructure, susceptibility to social engineering, and fragmented governance, compounded by weak enforcement of laws such as POPIA and the Cybercrimes Act. The study contributes by integrating these vulnerabilities into a multidimensional risk map and a policy–practice gap matrix, providing a novel diagnostic lens for South Africa’s public sector. Building on this synthesis, a phased roadmap is proposed to guide short-term safeguards, medium-term reforms, and long-term resilience strategies aligned with international frameworks. By balancing ambition with institutional realities, the roadmap offers practical guidance for policymakers while advancing scholarly debates on cybersecurity as a socio-technical governance challenge.