A subtle anomaly. An unpopular call to isolate critical systems. Resistance from every direction. That decision, made years ago with a key stakeholder during a live cybersecurity incident I was managing as a consultant, looked excessive at the time. It turned out to be the difference between a contained event and a ransomware attack that could have crippled operations for weeks. The lesson has never left me: resilience is decided in the moments before certainty arrives, when leaders must act on incomplete information, ahead of the crisis, not after it.
I’ve since sat in boardrooms across banking, telecoms, energy, and FMCG, watching organisations struggle not because attackers were unstoppable, but because the hard decisions had never been rehearsed. As Nigeria’s digital economy, and Africa’s with it, races ahead on instant payments, mobile banking, and digital lending, that lesson has only sharpened. Cybersecurity can no longer be viewed as a back-office technology concern. It has become a trust issue, a financial stability issue, and a board-level business priority.
Cyber Risk Is Now Systemic
Keep up with the latest headlines on WhatsApp | LinkedIn
No organisation is immune, and the threat is no longer local. INTERPOL’s Operation Red Card, run across 16 African countries between late 2025 and early 2026, led to 651 arrests and uncovered roughly $45 million in losses affecting 1,247 victims. Its message was blunt: African cybercrime is now organised, platform-enabled, and coordinated across borders. Meanwhile, crime itself has industrialised. Phishing kits, ransomware tools, and stolen credentials are now available as a service, collapsing the barrier to entry even as attack sophistication rises. Increasingly, criminals don’t need to break in. They simply log in, exploiting weak identity controls and misplaced trust. Cybercriminals innovate faster than most organisations.
Preparedness Is the New Advantage
When Captain “Sully” Sullenberger landed US Airways Flight 1549 on the Hudson River, it wasn’t luck. It was years of training surfacing in seconds. Cybersecurity demands the same discipline: in a crisis, organisations don’t rise to the level of their ambition; they fall to the level of their preparation. The most resilient organisations don’t prepare only for the risks that seem likely. Resilience is not achieved by preparing for what is likely. It is achieved by preparing for what is possible.
In 2026, attackers can move from initial access to high-value targets within minutes. Speed is not an advantage; it is survival.
AI Has Turned Trust into the Target
Identity is the new perimeter, and increasingly, it’s synthetic. A publicly available photo, a short video clip, and a modest budget are now enough to produce a convincing deepfake. In many cases, attackers are not exploiting technology weaknesses; they are exploiting trust. In 2024, an employee at a multinational’s Asia office authorised a $25 million transfer after joining what looked like a legitimate video call with senior executives, including the CFO. Every participant except that employee turned out to be AI-generated. Around the same time, a luxury automobile company executive stopped a near-identical scheme — a near-perfect voice clone of the CEO — simply by asking a personal question the impostor couldn’t answer. The difference between those two outcomes wasn’t technology. It was a habit of verification. The question is not whether systems can be breached, but whether organisations can detect, contain, and recover before trust is lost.
The World Economic Forum’s Global
Cybersecurity Outlook 2026 names AI as the single biggest driver of change in the field, simultaneously the best new defence and the sharpest new weapon. For Sub-Saharan Africa specifically, the Forum’s regional analysis points to a harder truth: persistent capability gaps, low confidence in preparedness, and a talent shortfall. Cyber threats may be global, but resilience must be built locally.
Walls Alone Won’t Hold
Banks, fintechs, telcos, and cloud providers are now so interconnected that organisations are rarely breached directly; they are reached through the ecosystems they depend on. Modern institutions are only as resilient as the weakest link in their extended operating environment. The 2024 CrowdStrike outage, which grounded airlines and disrupted hospitals worldwide, was a preview of how fast dependency risk can cascade, with no attacker required at all. Though a number of institutions still lean on a fortress mindset, modern resilience must be built on visibility, intelligence-sharing, and coordinated response across the whole ecosystem, not on walls alone.
What Financial Institutions Owe Their Customers
For banks, trust is not a reputational nicety; it’s the product. For financial institutions, trust is more than a reputational consideration; it is a strategic asset. Customers will forgive a rare outage. They will not forgive repeated failures that shake their confidence in the safety of their money and data. At Standard Chartered, cybersecurity is built into how we operate globally and locally, with continuous monitoring, advanced detection, and governance woven directly into business decisions. But institutional defence only goes so far. Multi-factor authentication, strong passwords, and a healthy suspicion of unusual requests remain some of the most effective tools available to everyone.
Sign up for free AllAfrica Newsletters
Get the latest in African news delivered straight to your inbox
The Agenda Ahead
According to the World Economic Forum, nearly two-thirds of organisations in Sub-Saharan Africa say they lack the cybersecurity talent to meet their own objectives. Closing that gap must sit alongside technology investment as a strategic priority, and cybersecurity must be prioritised on the board and management agenda, not just the IT agenda. Compliance is no longer the finish line. The right question isn’t “Are we compliant?” It is “Do we know what can break, how fast, and how ready we are if it does?” The objective is not perfection; it is preparedness. Millions of Africans are entering the formal financial system for the first time through digital channels. That inclusion only holds if people trust the systems carrying it. Trust, in that sense, isn’t a soft outcome of digital growth; it’s the precondition for it. Resilience is shared, or it is incomplete. The threat never sleeps. Neither can our commitment to protecting the trust it depends on.
*Aimienoho is the Chief Information Security Officer at Standard Chartered Bank Nigeria Limited.