By Collins Emadau, Director, Westcon Rest of Africa at Westcon-Comstor
There is a statistic in INTERPOL’s latest African Cyberthreat Assessment that should get the attention of anyone responsible for technology in the region. AI is now enabling 55% of reported cybercrime across Africa, and cybercrime losses have also more than doubled since 2024, from $192 million to $484 million.
Those numbers come as Africa becomes more digitally connected. The GSMA estimates that mobile technologies and services contributed $240 billion to the African economy in 2025, equivalent to 7.8% of GDP. That growth is creating enormous opportunity, but every new digital service, application, connection and interface also gives security teams something else they need to understand and protect.
For Cybersecurity Awareness Month, I think that is where the conversation needs to go. We cannot talk about Africa’s digital growth separately from the security architecture supporting it.
APIs are becoming part of the security perimeter
APIs are a good example as they sit behind many of the digital services people now use without thinking about them, connecting applications to payment services, mobile networks, identity systems, cloud platforms and increasingly AI.
That role is growing, as the GSMA highlighted in researchpublished this year that examined the potential for network APIs across seven African markets and found the commercial opportunity is real, although the ability to scale differs considerably between countries and API categories. In many cases, regulation and data governance will determine what can be deployed just as much as the underlying technology. Security has to follow those connections.
In my experience, organisations have become much better at protecting obvious assets such as endpoints and applications. It can be harder to maintain the same visibility across everything joining those systems. An API that is unnecessarily exposed, poorly authenticated or given broader access than it needs can create a path into information and services that are otherwise well protected.
We are seeing the same issue with AI. As organisations introduce agents into business processes, APIs, service accounts and other non-human identities start to multiply. Many need access to several systems to do their jobs, so organisations must know what they can reach, what authority they have, and whether that access is still appropriate.
Africa does not have one security starting point
One of the mistakes we make when discussing African technology is treating the continent as though every organisation is starting from roughly the same place. They are not.
Some businesses have mature security operations, specialist teams and access to the latest platforms. Others have limited budgets and small IT teams supporting a rapidly expanding technology environment. The GSMA estimates that almost one billion people in Africa still do not use mobile internet, despite the growth happening elsewhere in the digital economy.
The same unevenness appears around AI. The OECD’s 2026 work on AI governance in Africa found that while more countries are developing national AI strategies, the majority still do not have one. It also identified familiar constraints around infrastructure, compute, connectivity, skills, financing and governance capacity.
That matters for cybersecurity because advice has to be realistic. An organisation with a large security team can approach risk differently from a growing business where the same person may be responsible for infrastructure, cloud and security. Telling both to deploy more technology is not much of an answer.
I would rather start by asking what the organisation can see, what it cannot see, and which systems would cause the greatest damage if compromised.
AI needs controls before it needs autonomy
AI complicates this because it is appearing inside existing environments very quickly. It can help defenders analyse security information, identify unusual behaviour and work through alerts faster. That is useful in a region where specialist cybersecurity skills are not evenly available.
But AI is also changing the other side of the equation. INTERPOL says it is already being used across Africa to automate stages of cyberattacks, including reconnaissance, phishing, extortion and evasion. The answer cannot be to give defensive AI unlimited freedom and hope it moves faster than the attacker.
As agents gain more authority, organisations need controls around identity, privilege and accountability. In practical terms, that means giving an agent only the permissions it needs for its task, assigning a named human owner, logging what it does, and retaining human approval where an action could have serious consequences.
Build security around the Africa we actually have
Africa’s connected future will continue to develop unevenly. That is not an argument for slowing digitalisation, API adoption or AI. It is an argument for security models that recognise the environment organisations are operating in.
For some, that will mean sophisticated automation and integrated security operations. For others, it may mean tightening access to a handful of critical systems, improving visibility or using managed expertise because building a full security capability internally is neither affordable nor practical.
Cybersecurity Awareness Month is a useful reminder of the fundamentals, but the fundamentals themselves are expanding. We now have people, applications, APIs and AI agents interacting across the same business environment. Securing that environment starts with understanding those connections and being much more deliberate about what we allow to move through them.
For these and more stories, follow us on X (Formerly Twitter), Facebook, LinkedIn and Telegram. You can also send us tips or reach out at [email protected].
Also Read: Westcon-Comstor and Palo Alto Networks Launch Partner Growth Circle Across EMEA
