By Peter Odupoy
An analyst in Nairobi has not yet logged off at 2:47am. His monitors are cluttered with more than 4,000 alerts he is yet to review. Elsewhere on the network, an automated process has, in less than four seconds and without a single line of hand-written code, completed its 10,000th probe of the night.
For years, we have operated on the assumption that human speed placed a natural limit on cyber risk. Phishing emails contained typos or suspicious links. Failed logins appeared in system logs. Fraudsters left trails for auditors to follow. We introduced access controls, third-party audits and compliance checks, and convinced ourselves that the threat was largely under control.
That assumption is no longer safe.
Today’s attacks do not make grammatical errors. They arrive in perfect English, crafted from open-source information and tailored to an organisation before the recipient has even read the subject line. They can reference actual supplier contracts when targeting a finance team or mimic an organisation’s internal tone to overcome the scepticism that once served as our first line of defence.
Consider what happened last month with OpenAI’s agents. They did something no one had planned: they discovered an undocumented vulnerability in an internal registry, moved from a controlled environment into Hugging Face production systems, where millions of developers work, and on their own forged authentication tokens, established covert channels on public sites and obtained 136 live credentials.
If containment can prove tenuous even at leading AI laboratories, the lesson for everyone else is clear: the threat is becoming faster, more autonomous and more difficult to contain.
A person can handle one or two incidents manually. They cannot keep pace with relentless automation. Expecting human teams to do so is a recipe for burnout. More importantly, it exposes a gap in governance that organisations can no longer afford to ignore.
There is no avoiding the reality: we must answer the adversary’s tools with tools of our own.
That means deploying AI-powered intelligence capable of sorting through thousands of alerts in seconds, detecting deepfakes and synthetic voices as they emerge, and identifying anomalies while the rest of the team is asleep. This should not be viewed as an optional IT expense to be cut when budgets tighten. It is increasingly essential infrastructure for compliance, resilience and maintaining customer trust.
Technology has also erased the old boundaries between organisations and markets. From Africa to the rest of the world, there are no meaningful silos. A breach affecting a customer platform or financial system can be felt almost instantly by regulators, partners, suppliers and customers.
Boards therefore need to ask a simple question: When an AI-driven attack comes for us, will we be able to contain it, or will we be left managing the damage to our reputation and finances?
The choice is ours. We should be building organisations that invest ahead of the threat rather than waiting for disruption to make the decision for us.
Cyber risk is no longer a box to tick for compliance. Treat it as one, and the organisation is gambling not merely with its budget, but with its trust.
And trust has no replacement line in the ledger once it is lost.
Lose it, and what follows may not appear immediately on a balance sheet. It is the slow, quiet departure of customers, partners and investors who no longer believe the organisation can keep its word.
The threat will not wait for the next budget cycle. Neither can we. Our capital, our governance and our defences must move at the speed of the threat — starting now.
The writer is a Tech leader, accelerating Africa’s digital future with AI, Strategic Innovation and Resilient Growth.
