By Nkiruka Aimienoho A subtle anomaly. An unpopular call to isolate critical systems. Resistance from every direction. That decision, made years ago with a key stakeholder during a live cybersecurity incident I was managing as a consultant, looked excessive at the time. It turned out to be the difference between a contained event and a ransomware attack that could have crippled operations for weeks. The lesson has never left me: resilience is decided in the moments before certainty arrives, when leaders must act on incomplete information, ahead of the crisis, not after it. I’ve since sat in boardrooms across banking, telecoms, energy, and FMCG, watching organisations struggle not because attackers were unstoppable, but because the hard decisions had never been rehearsed. As Nigeria’s digital economy, and Africa’s with it, races ahead on instant payments, mobile banking, and digital lending, that lesson has only sharpened. Cybersecurity can no longer be viewed as a back-office technology concern. It has become a trust issue, a financial stability issue, and a board-level business priority. Cyber Risk Is Now Systemic No organisation is immune, and the threat is no longer local. INTERPOL’s Operation Red Card, run across 16 African countries between late 2025 and early 2026, led to 651 arrests and uncovered roughly $45 million in losses affecting 1,247 victims. Its message was blunt: African cybercrime is now organised, platform-enabled, and coordinated across borders. Meanwhile, crime itself has industrialised. Phishing kits, ransomware tools, and stolen credentials are now available as a service, collapsing the barrier to entry even as attack sophistication rises. Increasingly, criminals don’t need to break in. They simply log in, exploiting weak identity controls and misplaced trust. Cybercriminals innovate faster than most organisations. Preparedness Is the New Advantage When Captain “Sully” Sullenberger landed US Airways Flight 1549 on the Hudson River, it wasn’t luck. It was years of training surfacing in seconds. Cybersecurity demands the same discipline: in a crisis, organisations don’t rise to the level of their ambition; they fall to the level of their preparation. The most resilient organisations don’t prepare only for the risks that seem likely. Resilience is not achieved by preparing for what is likely. It is achieved by preparing for what is possible. In 2026, attackers can move from initial access to high-value targets within minutes. Speed is not an advantage; it is survival. AI Has Turned Trust into the Target Identity is the new perimeter, and increasingly, it’s synthetic. A publicly available photo, a short video clip, and a modest budget are now enough to produce a convincing deepfake. In many cases, attackers are not exploiting technology weaknesses; they are exploiting trust. In 2024, an employee at a multinational’s Asia office authorised a $25 million transfer after joining what looked like a legitimate video call with senior executives, including the CFO. Every participant except that employee turned out to be AI-generated. Around the same time, a luxury automobile company executive stopped a near-identical scheme — a near-perfect voice clone of the CEO — simply by asking a personal question the impostor couldn’t answer. The difference between those two outcomes wasn’t technology. It was a habit of verification. The question is not whether systems can be breached, but whether organisations can detect, contain, and recover before trust is lost. The World Economic Forum’s Global Cybersecurity Outlook 2026 names AI as the single biggest driver of change in the field, simultaneously the best new defence and the sharpest new weapon. For Sub-Saharan Africa specifically, the Forum’s regional analysis points to a harder truth: persistent capability gaps, low confidence in preparedness, and a talent shortfall. Cyber threats may be global, but resilience must be built locally. Walls Alone Won’t Hold Banks, fintechs, telcos, and cloud providers are now so interconnected that organisations are rarely breached directly; they are reached through the ecosystems they depend on. Modern institutions are only as resilient as the weakest link in their extended operating environment. The 2024 CrowdStrike outage, which grounded airlines and disrupted hospitals worldwide, was a preview of how fast dependency risk can cascade, with no attacker required at all. Though a number of institutions still lean on a fortress mindset, modern resilience must be built on visibility, intelligence-sharing, and coordinated response across the whole ecosystem, not on walls alone. What Financial Institutions Owe Their Customers For banks, trust is not a reputational nicety; it’s the product. For financial institutions, trust is more than a reputational consideration; it is a strategic asset. Customers will forgive a rare
Don't miss out on breaking stories and in-depth articles.
