There is a number I can’t stop thinking about after reading the latest Interpol African Cyberthreat Assessment, writes Anna Collard, senior vice-president: content strategy and CISO advisor at KnowBe4 Africa.
There are plenty of interesting figures in the report, for example in 2025, South Africa accounted for 92% of all ransomware detections in Africa, according to TrendAI data cited in the report. We also recorded more than 213 000 DDoS attacks and almost 40% of all phishing detections on the continent.
We seem to be the undisputed bullseye for cybercriminals in Africa. Although it might also just be that we are the one with the most detections reported.
Reported cybercrime losses across the continent more than doubled in a single year, from $192-million to $484-million (about R3-billion to R8-billion), according to Microsoft figures cited in the report. And that is only what gets reported. Interpol estimates that cybercrime did at least $5-billion in direct economic damage across Africa in 2025.
The gap between those two numbers is itself a measure of our silence. Southern Africa, the report says plainly, has become a magnet for global threat actors, precisely because we are so well connected. Our greatest developmental achievement, getting a continent online, is also what put a bigger target on us.
In our own 2025 Africa Human Risk Management report, we asked cybersecurity leaders a simple question: are you confident your own people would report a suspicious email if they saw one? One in ten said yes.
Read those two findings together and a very uncomfortable picture forms. We are facing the most industrialised, automated, well-resourced criminal ecosystem the continent has ever seen, and the people best placed to see it coming are the ones we are least sure will say anything.
That is not a technology problem, even though, by and large, we have spent fifteen years and a great deal of money treating it as one.
The security theatre we have all agreed to perform
Walk into most South African organisations and you will find the evidence of serious security intent. Firewalls, endpoint protection, an annual training module everyone completes way too quickly, a policy document nobody has read since onboarding. On paper, everything seems very well defended, both in terms of budgets spent and boxes ticked.
Then watch what happens on a Thursday afternoon all too often across the country when someone in finance gets an email that looks like it is from a supplier, with banking details that have suddenly changed. Employees are busy, under pressure, and the fraudulent material looks nearly perfect. The training they did in March is not in the room with them – the deadline is, though, and so is the quiet knowledge that if they get this wrong, a disciplinary conversation is possible (even if not probable).
So sometimes our hardest working employees say nothing. They often fix it quietly, or hope it was fine, or feel too embarrassed to raise their hand. And the one moment where a human being could have stopped an attack passes in silence.
The distance between what our people know and what they feel able to do about it is probably one of the most important things we need to address if we want to turn the tide against the threat actors.
Three things, none of which require a bigger budget
Here is what gives me hope, and why I think this is very much a solvable problem rather than a permanent condition. The first is to stop punishing the reporter. If an employee clicks something they should not have, and then tells you within five minutes, that person has just handed you the single most valuable thing in incident response: time. An attack reported in minutes can even become something that amounts to little more than a nuisance. But the same attack hidden for three weeks out of fear can become a major problem. Yet according to that same KnowBe4 report, half of South African organisations respondents still respond to an honest mistake with a formal warning or sometimes disciplinary measures that are even more serious. If that is the approach, then we are effectively fining people for the early warning system we claim to want. Make it safe to say “I think I messed up,” and you will hear it while it still matters.
The second is to put the check where the decision happens, not in a classroom six months earlier, because nobody makes a security mistake during the training module. Mistakes are made under pressure, in the flow of real work during the day-to-day motions. A verification prompt that appears at the moment a payment instruction is approved will do more than any annual course, because it meets the person where the risk actually lives.
The third costs nothing, and we are strangely reluctant to use it. Talk about it, out loud, in the languages people actually speak, at the kitchen table and not only in a compliance email. The criminals have already worked out that we are a community that trusts easily and communicates constantly. That same instinct, turned the other way, is a formidable defence. A family that has agreed a code word for emergencies is harder to scam than any spam filter, and a team where “does this look off to you?” is a normal thing to ask across a desk is harder to breach than one relying on a policy that has to be remembered to be used.
The choice we are actually making
The same Interpol report that catalogues the scale of the threat also records what happens when African countries decide to act together: more than 1 500 arrests across four coordinated Interpol operations in the past year, and millions of dollars recovered. . When we move, we are formidable.
So, I would ask every South African leader reading this to sit with the following question. If someone in your organisation made a mistake this afternoon, do you actually believe they would tell you before the day was out?
If the answer is anything other than a confident yes, that is the work you have cut out for yourself.
Click Here For The Original Source.
——————————————————–
