Why Nigeria, S’Africa top cybercrime hit lists – Deimos CTO

Chief Technology Officer at Deimos, Jaco Nel, speaks with LAOLU AFOLABI about Africa’s rising cyber threat landscape. The CTO of the leading hybrid/multi-cloud professional services company specialising in cloud-native development and security operations sheds light on why Nigeria and South Africa are vulnerable to cyberattacks and offers insights into addressing these challenges.

Cyber threats are on the rise across Africa, with Nigeria and South Africa emerging as primary targets. What makes these nations particularly vulnerable, and how do their challenges stack up against those faced by other African countries?

Nigeria and South Africa are particularly vulnerable to cyber threats due to their economic prominence, high internet adoption, and rapid digital transformation. As two of Africa’s largest economies, they host significant financial activity and rely heavily on digital platforms, making them prime targets for cybercriminals seeking financial gain. Nigeria has a massive and growing online population, while South Africa boasts one of the highest internet penetration rates on the continent. This widespread connectivity increases the attack surface for malicious actors.

Both countries also face challenges with outdated infrastructure and legacy systems, which are more susceptible to exploitation. While their rapid digital adoption is a strength, it also leaves gaps in security preparedness, creating opportunities for sophisticated threat actors, including organised cybercrime groups and state-sponsored attackers.

Can you share a recent real-world example of a cyberattack that highlights the evolving nature of threats in Africa?

In April 2024, a Nigerian fintech company experienced a security breach leading to unauthorised transfers. While the company did not disclose the exact amount, reports indicated that up to N11bn (approximately $7m) was compromised. The attackers routed funds through multiple accounts across various financial institutions to evade detection, underscoring vulnerabilities in the fintech sector. This specific incident highlights the threat to fintech organisations at the forefront of technology in Africa.

With African governments enforcing stricter data sovereignty laws, what are the biggest security risks businesses now face?

The push for data localisation, along with growing concerns about privacy and security, is driving many African nations to introduce specific regulations dictating how and where data should be stored and processed. While this shift is crucial for protecting sensitive information, it also introduces new security challenges that businesses must navigate.

One of the biggest risks is that localising data, whether in on-premise data centres or local cloud platforms, creates highly concentrated targets for cybercriminals. The more data is clustered in local infrastructure, the more attractive it becomes for attacks, including ransomware, data breaches, and insider threats. The challenge for businesses isn’t just meeting compliance requirements; it’s ensuring that the data they are now required to keep within borders is properly secured against increasingly sophisticated cyber threats.

Regulatory fragmentation is another growing concern. With different countries implementing their versions of data sovereignty laws, companies operating across multiple markets may struggle to create a unified security strategy. The inconsistencies in compliance frameworks could leave businesses exposed to both security vulnerabilities and potential penalties for non-compliance.

To stay ahead, businesses will need to rethink their approach to security. Investing in stronger cybersecurity frameworks that protect data at rest and in transit will be essential. Finding the right cloud and technology partners, like Deimos, who understand Africa’s evolving regulatory environment will also be critical in ensuring compliance without compromising security. At the same time, companies and businesses will need to develop contingency plans for data breaches that align with local legislation to avoid costly penalties.

How should Nigerian businesses balance compliance with global cybersecurity best practices to avoid unintended risks?

Nigerian businesses should view compliance with local cybersecurity standards as the baseline rather than the complete solution. Compliance ensures adherence to essential security measures, but it doesn’t guarantee comprehensive protection. To avoid unintended risks, businesses need to establish a robust security strategy that goes beyond mere compliance and addresses all aspects of their operations.

A strong security posture requires adequate investment in skilled cybersecurity professionals and continuous training to raise security awareness across all levels of the organisation. By fostering a culture where security is a shared responsibility, businesses can better anticipate, detect, and respond to threats. Additionally, integrating compliance with a proactive approach to security — through regular risk assessments, updated incident response plans, and tailored security measures — ensures that organisations are prepared to handle evolving cyber threats, rather than simply meeting minimum requirements.

Ultimately, the goal is to build resilience. Compliance provides the framework, while an adaptable and comprehensive security strategy protects against the full spectrum of potential threats.

AI-driven cyberattacks are evolving rapidly. What are some of the most alarming ways cybercriminals are using AI to bypass security defences?

Cybercriminals are no longer just using AI to automate attacks, they are using it to outthink and outmanoeuvre security systems in real-time. In 2024, we saw a surge in AI-powered phishing campaigns, where attackers leveraged machine learning to craft hyper-personalised messages that could bypass traditional detection methods. These scams adapted dynamically, making them incredibly difficult to recognise, even for experienced users.

Looking ahead to 2025, we predict that these attacks will become even more sophisticated. Attackers use AI to predict human behaviour and refine their strategies in real-time. One of the most concerning developments is AI-generated voice deepfakes, which allow cyber criminals to impersonate executives or trusted colleagues with startling accuracy. This could be used to authorise fraudulent transactions, manipulate employees into sharing sensitive data, or even disrupt business operations.

Also, attackers can now automate the process of gathering information on a target, using AI to analyse vast amounts of publicly available data to craft highly convincing and targeted attacks. This means that social engineering efforts will no longer be generic; they will be uniquely tailored to each victim, increasing their effectiveness.

How can businesses proactively defend themselves against AI-powered phishing and social engineering attacks?

The rise of AI-driven cyberattacks means that businesses must rethink their approach to security. The old methods of phishing awareness training and basic email filters are no longer enough. Attackers are now using AI to create phishing attempts that are nearly indistinguishable from legitimate communications. To counter this, businesses need to adopt a multi-layered, proactive defence strategy.

One of the most effective ways we’ve found is to deploy AI-powered cybersecurity tools. These systems use machine learning to analyse behavioural patterns and detect anomalies, flagging potentially malicious activity before it can cause harm. Unlike traditional security solutions that rely on predefined rules, AI-based defences continuously learn and evolve, making them far better equipped to identify emerging threats.

Employee training also needs to evolve. Standard phishing simulations are no longer enough, and staff must understand how AI is being used to manipulate them. Organisations should emphasise awareness around AI-driven impersonation tactics, including hyper-personalised phishing attempts. Encouraging a culture of healthy scepticism, where employees verify requests for sensitive actions through secondary channels, can help prevent social engineering attacks. For instance, at Deimos, we encourage the consistent use of video calls to verify sensitive information.

Additionally, implementing strong identity verification protocols is essential. Multi-factor authentication (MFA) can make it significantly harder for attackers to gain access to critical systems, even if they manage to deceive an employee.

The rise of Cybercrime-as-a-Service means even low-level hackers can launch sophisticated attacks. How does this shift the cybersecurity landscape for African businesses?

The growing accessibility of cybercrime tools also means that African businesses will face more frequent and more sophisticated attacks. Advanced persistent threats, once the domain of state-sponsored hacking groups, are now available for purchase on the dark web, allowing even low-level criminals to carry out long-term, stealthy breaches. This makes early detection and rapid response more critical than ever.

To navigate this evolving threat landscape, businesses need to shift from a reactive to a proactive cybersecurity approach. Threat intelligence will play a crucial role in identifying and mitigating risks before they escalate. Organisations need to monitor emerging cybercrime trends and establish rapid response frameworks. Collaborating with trusted security partners can also help businesses stay ahead of new attack methods and build resilience against an increasingly sophisticated cybercriminal ecosystem.

The unfortunate reality is that cyber threats will only become more automated, scalable, and accessible. For African businesses, the challenge is no longer just about defending against expert hackers; it’s about securing their systems against a growing army of cybercriminals who now have the tools to launch devastating attacks at the click of a button.

We are seeing a link between climate change and cybersecurity risks. How exactly do cybercriminals exploit natural disasters and infrastructure weaknesses?

As climate change intensifies, so do the cybersecurity risks that come with it. Natural disasters disrupt infrastructure, weaken security measures, and leave businesses vulnerable. Cybercriminals are quick to exploit these opportunities. When companies are focused on physical recovery, attackers launch ransomware campaigns, phishing scams, and so on, taking advantage of the chaos.

Per our prediction at Deimos, we are anticipating an increase in cyberattacks timed around climate-related disasters. The growing frequency of extreme weather events means businesses must rethink their cybersecurity strategies to account for both physical and digital threats.

To prevent these risks, it’s advisable for businesses to integrate cybersecurity into their disaster recovery planning. This includes investing in climate-resilient infrastructure, ensuring backup power and data protection, and preparing for cyber threats that could strike when defences are down.

Nigeria has a booming blockchain and DeFi sector. What are the biggest security threats facing businesses in this space?

Nigeria’s blockchain and DeFi sector has experienced rapid growth, unlocking new financial opportunities and driving innovation. However, this expansion has also made the ecosystem a prime target for cybercriminals. In 2024, hackers exploited vulnerabilities in smart contracts, decentralised exchanges, and wallet security, leading to significant financial losses. Many businesses rushed to adopt blockchain, but the lack of maturity in securing these systems led to significant losses.

As 2025 unfolds, these threats are likely to become more sophisticated. Decentralised applications (dApps) are expanding beyond finance into sectors like healthcare and government, broadening the attack surface. Weaknesses in smart contract development and poor private key management remain major risks, with cybercriminals refining their methods to breach these systems. Without proactive security measures, businesses in the decentralised economy face the dual threat of financial loss and reputational damage.

These risks call for prioritising security from the outset. Regular smart contract audits, robust private key protections, and the use of multi-signature wallets can help safeguard digital assets. Additionally, educating employees and stakeholders on blockchain security best practices will be critical in preventing breaches.

What specific security measures should companies investing in blockchain technologies implement to mitigate risks?

Companies investing in blockchain technologies must emphasise secure key management, least privilege access, and robust observability to mitigate risks, including insider threats. Private key management is critical to protecting blockchain assets. Businesses should adopt secure storage solutions like hardware security modules (HSMs), multi-signature wallets, and encrypted vaults. Multi-factor authentication must be enforced for key access, and teams should receive regular training on secure handling to prevent phishing and social engineering attacks.

Least privilege access is essential for reducing the risk of breaches and misuse. Role-based access control (RBAC) ensures that individuals only have access to the resources necessary for their specific roles. Access levels should be reviewed and adjusted often to align with changes in responsibilities, and identity and access management (IAM) tools can automate workflows to reduce misconfigurations. Limiting administrative privileges to only a small number of trusted users is crucial, particularly for critical blockchain systems.

To detect and respond to threats proactively, companies should implement advanced observability and anomaly detection tools. These systems can monitor blockchain transactions, user activity, and infrastructure for unusual patterns or behaviours that could indicate security incidents or insider threats. Coupling real-time monitoring with automated alerts enables swift responses to anomalies. Comprehensive logging, auditing, and periodic reviews further enhance accountability and transparency, ensuring businesses can detect and mitigate risks before they escalate.

What are the biggest misconceptions businesses have about cybersecurity, and what are the top three actions they should take immediately?

One of the biggest misconceptions businesses have about cybersecurity is that cyberattacks only target large corporations or highly sensitive industries. In reality, attackers are increasingly shifting their focus to small and medium-sized businesses, particularly in emerging markets like Africa, where cybersecurity measures are often weaker. Businesses that assume they are too small to be targeted risk leaving themselves vulnerable to ransomware, phishing scams, and other cyber threats.

In terms of the top three immediate actions, businesses must first adopt a proactive cybersecurity strategy with real-time threat monitoring and rapid response plans.

Next, employee training should evolve to focus on identifying threats like hyper-realistic phishing, deepfakes, and social engineering, making cybersecurity a company-wide priority.

Finally, businesses should strengthen their infrastructure by securing cloud environments, auditing smart contracts, and implementing multi-factor authentication (MFA). With years of expertise in cloud-native infrastructure and cybersecurity, Deimos is well-positioned to support businesses through all these actions.

Looking beyond 2025, what emerging cybersecurity threats should African businesses start preparing for?

Looking beyond 2025, African businesses should begin preparing for increasingly sophisticated cybersecurity threats driven by advancements in artificial intelligence. One major concern is the utilisation of AI in social engineering attacks. Threat actors are leveraging AI to craft highly personalised and convincing phishing emails, texts, and voice messages, making it harder for individuals to differentiate between legitimate communications and malicious ones. Spear phishing campaigns, in particular, are expected to grow more precise and effective, targeting key individuals within organisations to gain access to critical systems.

Deepfakes and AI-driven impersonation are also poised to become significant threats. With AI-generated videos and audio becoming more convincing, attackers can impersonate executives, employees, or even trusted partners to manipulate victims into transferring funds, disclosing sensitive information, or executing unauthorised actions. Businesses must prepare to verify communications through independent channels and implement advanced detection mechanisms to counter these risks.

Additionally, AI-powered malware and automated attacks will escalate, enabling cybercriminals to launch faster, more targeted campaigns with minimal effort. African businesses must invest in AI-driven defensive tools capable of detecting anomalies and responding to threats in real-time. Proactive measures, such as employee training on identifying AI-enhanced threats, multi-factor authentication, and strict verification protocols, will be essential to staying ahead of these emerging risks. Preparing now will enable organisations to adapt to the rapidly evolving cybersecurity landscape.