Cybersecurity is the Infrastructure Africa is Forgetting to Build

In June 2024, a ransomware attack on South Africa’s National Health Laboratory Service rendered patient records inaccessible, disrupted diagnostics and forced hospitals to cancel surgeries. The incident was a stark reminder that when essential services become digital, attacks on their underlying systems can quickly become disruptions to everyday life. It was not simply a cybersecurity incident affecting an IT network; it affected health institutions’ ability to deliver services.

This distinction matters as Africa accelerates its digital transformation. Governments and businesses across the continent are investing in digital identity systems, mobile money, instant payment platforms, e-government services and other forms of digital infrastructure that increasingly shape how people access financial services, interact with the state and participate in the economy. Yet the capacity needed to protect these systems has not expanded at anything close to the same pace. Africa is building the infrastructure of a digital economy, but it is not building enough of the capacity required to defend it.

The scale of the challenge is becoming harder to ignore. INTERPOL’s 2026 assessment documents a threat landscape in which government institutions, financial services, healthcare systems and other critical infrastructure are increasingly exposed to cyberattacks. The problem is not confined to one part of the continent. In North Africa, the Central Bank of Libya reported in June 2026 that a cyber incident affecting some of its systems and technical services had been fully contained following comprehensive technical investigations and system recovery efforts. The bank also said it had found no confirmed indications that accounts, balances or financial assets had been compromised. In East Africa, the picture is similarly concerning: Kenya recorded more than 46,000 DDoS attacks against telecommunications infrastructure in the first half of 2025, while SIM-swap fraud surged, with more than 123,000 fraudulent SIMs issued and an estimated USD 3.8 million drained from mobile wallets. Tanzania and Rwanda reported similar patterns. In West Africa, Nigeria’s National Bureau of Statistics also saw its website compromised, highlighting the vulnerability of institutions whose digital platforms hold and communicate strategically important public information.

What makes these incidents particularly important is not simply the damage caused by individual attacks, but the growing dependence on the systems being attacked. A decade ago, the disruption of an online government service might have been inconvenient. Today, a digital platform may be the primary way a citizen accesses a public service, a business receives payment, or an institution manages sensitive information. As digital systems become more deeply embedded in economies and public administration, their security becomes inseparable from the resilience of the services they support.

Yet the human capacity to secure this infrastructure remains limited. The 2024 Cybersecurity Workforce Report by the Boston Consulting Group (BCG) and the Global Cybersecurity Forum (GCF) estimates that fewer than 300,000 cybersecurity professionals work across Africa, while the continent faces a workforce shortage of about 68,800 positions—equivalent to a 23% gap in the required cybersecurity workforce. ISC2’s 2023 Cybersecurity Workforce Study estimated that South Africa had around 57,000 cybersecurity professionals, compared with about 8,000 in Nigeria. Expertise is also concentrated in a relatively small number of countries, including Kenya and Egypt. For governments across the continent, this creates a growing gap between the digital systems they are putting in place and the capacity they have in-house to protect them. As more public services move online, that gap becomes harder to ignore.

The challenge starts well before professionals enter the workplace. INTERPOL’s 2026 assessment shows just how uneven cybersecurity capacity remains across Africa. Some 94% of the agencies surveyed reported not having enough digital-forensics tools, while 78% pointed to limited budgets and a shortage of specialised staff. Only 17% of countries had cybercrime units with more than 100 personnel, and just 22% of digital-forensics units said they had working knowledge of AI-driven threats. These numbers suggest that the issue is deeper than simply needing more people or better equipment. Many countries still rely on a relatively small pool of cybersecurity specialists, while the threats they face are becoming more complex. Buying new security technologies can help, but technology alone cannot make up for gaps in skills, experience and institutional capacity. Building stronger digital economies therefore also means investing in the people and institutions that are expected to keep them secure.

This is why Africa’s cybersecurity challenge should not be understood solely as a shortage of skilled professionals. The deeper issue is how digital infrastructure itself is being conceived. A digital identity system is not simply a database and an authentication mechanism. It depends on people who can monitor threats, identify vulnerabilities, respond to incidents and protect the information it contains. A national payment platform requires more than the technology that enables transactions; it requires the capacity to detect fraud, investigate attacks and restore services when something goes wrong. A digital government portal needs people and institutions capable of securing the system throughout its lifecycle. In other words, the people and institutions responsible for keeping digital systems secure are part of the infrastructure too.

The consequences of failing to recognise this extend beyond the immediate impact of a breach. One is economic. Investors in fintech, e-commerce and digital infrastructure need confidence that the systems they fund can withstand disruption. Repeated breaches and weak institutional capacity to respond can increase the perceived risk associated with digital investment.

There is also a question of state capacity. Governments are increasingly moving services online because digital platforms can make public administration more accessible and efficient, and for citizens can offer greater convenience and shorten processing times. But digitisation also creates new dependencies. When a government replaces a physical process with a digital one, it assumes responsibility for keeping the underlying system secure, available and recoverable. If it cannot respond effectively when that system is attacked, digitisation may create a new institutional vulnerability even as it solves an existing administrative problem.

Closing the gap will require sustained investment across several areas. African countries need stronger domestic education and certification pipelines capable of producing cybersecurity professionals at a scale that matches the growth of their digital economies. They also need to address the retention problem. Skilled professionals can often command higher salaries in the private sector or internationally, making it difficult for governments to retain the expertise they have invested in developing. Training more people without creating the conditions for them to remain in public institutions risks leaving governments permanently dependent on external expertise.

Regional cooperation is equally important. Cyber threats do not stop at national borders, and countries with limited domestic capacity can benefit from mechanisms for sharing threat intelligence and incident-response expertise. No single African country needs to build every cybersecurity capability independently. Stronger regional and cross-border arrangements could allow countries to pool expertise and respond more effectively to threats that increasingly operate across jurisdictions.

Most importantly, cybersecurity needs to be built into digital infrastructure from the outset. Security requirements should be part of the design, procurement, and deployment of digital systems rather than added retrospectively after vulnerabilities emerge. This is particularly important as governments invest in systems that will operate at national scale and support services on which millions of people depend.

Africa’s digital transformation represents a major opportunity. Digital payments can broaden financial access, digital public services can change how citizens interact with government, and digital identity can make it easier for people to access services and participate in the economy. But the durability of these gains will depend not only on whether the infrastructure can be built, but whether it can be trusted and defended.

When a health laboratory cannot access patient records, a payment system goes down, or people are unable to access a government service, cybersecurity stops being a purely technical issue. It becomes a much more practical question: can the systems people depend on continue to work when they need them most?

Across Africa, governments and regional institutions increasingly treat digital identity, payments, data exchange, and other digital public infrastructure as foundational systems for economic development and public services. Cybersecurity capacity needs to be understood in the same terms. The continent cannot build a trusted digital economy simply by connecting more people and deploying more platforms. It must also build the human and institutional capacity to protect the infrastructure it is creating.

The infrastructure of Africa’s digital future is being built now. The question is whether cybersecurity will be built alongside it, or left to catch up after the next breach.

The post Cybersecurity is the Infrastructure Africa is Forgetting to Build appeared first on African Arguments.