As businesses across Africa accelerate AI adoption, new cybersecurity vulnerabilities are emerging, exposing organisations to data breaches, fraud and operational risks.
Allan Juma, Lead Cybersecurity Engineer at ESET, discusses the growing threats, gaps in AI governance and the measures businesses should take to secure their systems while embracing responsible AI adoption.
How prepared are African businesses for AI-related cyber risks?
Preparedness is uneven. While some organisations are well prepared, others are not. Governments and the private sector have stepped up awareness of AI-related cybersecurity risks, particularly following high-profile vulnerabilities discovered in frontier AI models.
However, awareness has not necessarily translated into preparedness. Recent threat reports from Kenya, Africa and globally point to rising cyberattacks exploiting known vulnerabilities and poor cyber hygiene.
Are existing cybersecurity frameworks adequate for emerging AI threats?
AI adoption has outpaced governance, although African governments are making progress in closing the legislative gap. Several countries, including Kenya, have introduced AI-specific governance laws and established relevant agencies.
However, gaps remain, particularly around liability when security breaches involve AI systems.
What new cybersecurity risks are emerging from AI adoption?
Several risks are becoming increasingly prominent:
Shadow AI: Employees using unauthorised AI tools can expose sensitive business information, including customer data, contracts, source code and financial records, to public chatbots without organisational oversight.
Data leakage: Prompts and uploaded files may contain personal information, exposing organisations to data protection violations.
Excessive AI access: AI assistants and copilots may access confidential documents beyond an employee’s authorised permissions, especially where internal access controls are poorly managed.
Prompt injection: Malicious instructions hidden in emails, websites or documents can manipulate AI tools that process them.
Insecure AI-generated code: AI-generated code may contain vulnerabilities and should always undergo human review before deployment.
Third-party risks: Vendors may introduce AI features and new data flows without adequate disclosure, creating additional security vulnerabilities.
Credential exposure: Access keys used by AI agents and integrations may be leaked or left unrotated.
AI hallucinations: Inaccurate AI-generated information can lead to poor assumptions and critical business decisions if human verification is absent.
How do AI-powered threats differ from traditional cyberattacks?
AI-powered threats stand out in three ways: scale, sophistication and speed.
AI makes attacks faster, cheaper and more persistent. It also lowers the barrier to entry for cybercriminals, enabling less-skilled attackers to develop more sophisticated capabilities.
Social engineering has also become more convincing. Traditional phishing emails often contained identifiable warning signs, such as poor grammar and language. AI now enables attackers to produce fluent, convincing messages that are harder to distinguish from legitimate communication.
Additionally, AI accelerates reconnaissance, exploit development and adaptation to targeted systems during an attack.
What happens when AI agents have unrestricted access to company systems?
Unrestricted access can lead to data leakage, exposure of sensitive information and incorrect actions executed at machine speed. These could include deleting records or initiating payments that may be difficult to reverse.
There is also the risk of a domino effect, where one compromised or malfunctioning agent triggers other agents or tools it should not have access to, escalating the damage.
What are the financial and reputational consequences of poorly governed AI?
The consequences can be significant.
Under Kenya’s Data Protection Act, the Office of the Data Protection Commissioner can impose penalties of up to KES 5 million or 1 per cent of annual turnover, where applicable, for data protection violations.
Businesses may also suffer direct financial losses through AI-enabled fraud or operational disruptions caused by rogue AI agents and models.
A security breach can undermine customer trust, resulting in lost business and damaged partnerships.
There are also potential legal consequences. AI systems can produce biased or discriminatory decisions based on the data they process. Decisions influenced by factors such as demographics, race or religion could expose organisations to legal action over discrimination or incorrect automated decisions.
Additionally, hallucinated outputs, biased decisions and leaked prompts can cause public embarrassment and reputational damage.
What safeguards should businesses establish before deploying autonomous AI agents?
AI governance must be embedded throughout the organisation, starting at the top. Businesses need to establish a clear case for AI adoption, define its purpose and identify the expected benefits.
This will help streamline the selection of approved AI models, prevent Shadow AI and establish accountability at every stage of the AI lifecycle.
What warning signs suggest an organisation’s AI systems are creating security risks?
Three major warning signs stand out:
Lack of an AI inventory: The organisation does not know which AI tools and models are being used across its systems.
Absence of clear policies: Employees lack guidance, training and awareness on responsible AI use and associated risks.
Poor monitoring: The organisation cannot track AI usage or provide logs showing how its AI systems are accessed and used.
What three immediate steps should businesses take to secure their AI environments?
First, identify and inventory all AI tools. Organisations cannot protect what they do not know exists. Businesses should survey employees and review network and software-as-a-service (SaaS) logs to identify AI tools and integrations. They should also establish what data each tool can access.
Second, develop an AI usage policy and approve specific tools. Businesses should define what information must never be entered into AI systems, including personal data, credentials and confidential client information. They should also provide vetted enterprise AI tools to discourage employees from using unapproved public platforms.
Third, strengthen access controls. AI models should operate under the principle of least privilege, receiving only the permissions necessary to perform their functions. Organisations should also enforce multi-factor authentication and regular key rotation. Human oversight is essential, particularly for AI actions involving financial transactions or the movement of sensitive data.
How can businesses encourage responsible AI use without compromising security?
Organisations should focus on enabling responsible AI adoption rather than simply imposing restrictions.
First, provide effective, approved tools. When employees have access to reliable alternatives, they are less likely to seek unauthorised ones. Blanket bans often push AI usage underground.
Second, explain risks through practical examples, such as deepfake CEO voice messages and prompt-injection demonstrations, rather than relying solely on policy documents.
Third, create a safe reporting culture where employees who disclose mistakes promptly are encouraged rather than blamed.
Fourth, provide role-specific training. Finance teams need training on deepfake-enabled fraud, developers on secure AI coding, and HR and customer-facing teams on responsible data handling.
Organisations should also appoint AI champions in each department, ensure executives lead by example and keep policies simple. A colour-coded green, amber and red data classification guide, for instance, can make AI usage rules easier to understand and follow.
Any final thoughts?
AI risks should be treated as business risks and board-level issues, not simply as IT security concerns.
www.eset.com
Are you interested in having your interview published on our website, click here.
——————————————————-
Click Here For The Original Source.
