African organisations are struggling to match the speed of artificial intelligence (AI)-enabled cyber crime even as security spending rises, say experts from Kaspersky, Mimecast, Check Point Software Technologies and Galix.
ITWeb Africa interviewed the four security companies for Cybersecurity Awareness Month, observed in October. They warn that threat actors operate at machine speed, exploiting operational fragmentation and leaving defenders weeks behind.
Cybersecurity expenditure across the continent reached $15.3 billion in 2025, according to INTERPOL’s African Cyberthreat Assessment Report 2026.
INTERPOL estimates direct economic damage at about $5 billion, well above the $484 million in reported losses.
Kaspersky research shows 85% of South African small and medium-sized businesses increased their security budgets, yet 78% still experienced at least one cyber incident in the past year.
Attackers have moved from opportunistic strikes to an industrialised, AI-enabled criminal economy, says Heino Gevers, vice-president of global customer value at Mimecast.
“Data breaches now feed synthetic identity fraud, AI-generated phishing, and business email compromise. Meanwhile, ransomware has moved from financial extortion to the sabotage of public services and critical infrastructure,” he says.
Response speed remains a primary bottleneck, says Lionel Dartnall, country manager for the Southern African Development Community at Check Point Software Technologies.
“African organisations took an average of 18 days to detect and contain a breach, compared with 12 days globally. The priority must be moving beyond compliance towards continuously testing whether security controls actually work,” he says.
In an environment where AI-driven attacks deploy in seconds, an 18-day detection window gives adversaries ample time to exfiltrate sensitive data and compromise core infrastructure, Dartnall says.
Mimecast says threat actors are increasingly targeting critical economic infrastructure across the continent, citing attacks on Nigeria’s Customs Service, Uganda’s national power grid operator, Uganda Electricity Transmission Company Limited, and Namibia’s Paratus Telecom.
digital financial platforms have opened new attack surfaces. INTERPOL says Kenya detected more than 123 000 fraudulent SIM cards in 2025, used to drain an estimated $3.8 million from mobile wallets, while Ghanaians lost $1.3 million to mobile money fraud in the first quarter of 2025.
“The combination of AI, identity compromise, and cybercrime-as-a-service means sophisticated capabilities are becoming available to criminals who do not need advanced technical skills themselves. That changes both the scale and the economics of cybercrime,” says Nemanja Krstić, head of operations for Africa, the Middle East and the European Union at Galix.
Email remains the primary attack vector, with Mimecast telemetry showing phishing accounts for 77% of all globally detected attacks. Attackers bypass single-channel security by moving from email to collaboration apps such as Microsoft Teams, often followed by direct phone calls.
“A phishing email is followed by a Teams message or a call from someone posing as a colleague or supplier,” Gevers says. “The attacker moves between channels to get around controls that only watch one of them.”
The experts agree that technology alone cannot close the gap. Unpatched routers, vulnerable VPNs, shadow IT and misconfigured document platforms leave thousands of publicly known weaknesses across African networks, they say, because of resource constraints and patch backlogs.
“Spending more does not automatically translate into stronger protection,” says Chris Norton, general manager for Sub-Saharan Africa at Kaspersky. “Organisations need to know where they are exposed, keep systems current, give security teams enough capacity, and ensure employees understand threats. The strongest organisations connect investment to day-to-day security discipline instead of just relying on a new tool.”
Mimecast research shows 38% of South African organisations rely solely on the native security controls built into email and collaboration platforms, even though 62% acknowledge that these tools are insufficient against modern threats.
Gevers says operational habits need fixing more than software needs buying.
“It is less a technology problem than a practice problem. The tools to stop most attacks exist today. What lets attackers in is how those tools are used: staff not trained to verify requests, access nobody reviews, and controls nobody tests.”
ITWeb has reported INTERPOL’s finding that AI was linked to more than half of the cyber crime cases recorded in Africa in 2025, and that southern Africa accounted for 92% of the continent’s ransomware detections.
The publication also reported, citing Check Point data, that African organisations averaged 3 008 cyber attacks a week in June.
The experts urge African organisations to move from periodic compliance audits to continuous operational resilience, protecting people, data and automated AI agents under a single defensive strategy.
Share
