Generative AI has done to cybercrime what it has done to content production: collapsed the cost and the skill required to produce convincing output at scale. For African enterprises, that shift is arriving faster than most governance frameworks can absorb it.
By Wayne Meisel, market growth and customer officer at SAP
By early 2025, most phishing emails being detected were AI-generated, a dramatic rise from a low base just a year earlier. AI-automated spear-phishing campaigns are now matching the click-through rates of skilled human attackers, while cutting the cost of running a campaign by more than 95%.
Business email compromise (BEC), already one of Africa’s most damaging attack categories, is following the same trajectory, with a meaningful share of detected BEC campaigns now judged to be AI-crafted. Deepfake-enabled fraud, though still a smaller share of total attacks, has grown more than 20-fold since 2022.
African organisations are on the frontlines. INTERPOL’s most recent Africa Cyberthreat Assessment found that cyber-related offences now make up a medium-to-high share of all reported crime across two-thirds of surveyed member states, rising above 30% in parts of Western and Eastern Africa.
South Africa stands out as a regional bellwether: it has the highest suspected digital fraud rate on the continent, reported cybercrime losses running into the billions of rand, and a 60% increase in reported data breaches in a single reporting period. The Information Regulator’s new mandatory breach-reporting tool, launched in April 2026, signals that data governance is moving from best practice to enforced obligation. But INTERPOL also found that most African states still report inadequate training, resourcing and specialised tooling to meet this threat, leaving a gap between how fast attacks are evolving and how fast institutional defences are maturing.
Gap between attacks and defences widening
A recent report found that the median time for someone to click a phishing link is 21 seconds while the median time to report one is 28 minutes. Attackers now operate on a timeline human vigilance was never built to match, especially once that vigilance is up against AI on the other side too. The World Economic Forum’s 2026 outlook and EY’s Africa-focused research reach the same conclusion from different angles: cyber resilience is no longer a technical function that sits beside governance, but increasingly a matter of board-level accountability rather than IT ownership.
The conversation about enterprise AI adoption in Africa needs to be a conversation about governance, not just capability. The organisations best placed to withstand this next wave of AI-enabled attack will be the ones that pair automated, AI-embedded controls with disciplined, well-governed data foundations.
The uncomfortable reality is that human judgement alone cannot keep pace. For many years, cyber resilience centred on awareness training. Employee education remains essential, but it is no longer sufficient on its own. The next generation of cyber resilience will depend increasingly on automated controls, stronger governance and trusted enterprise data.
Agentic AI raises stakes
As organisations introduce AI assistants and increasingly autonomous AI agents into finance, procurement, HR, customer service and supply chain operations, governance becomes inseparable from security. Every AI agent represents another software actor capable of accessing information, making recommendations or triggering business processes. Without appropriate controls, these systems can unintentionally introduce new risks even while improving productivity.
Frontier AI models are already demonstrating unprecedented capabilities in identifying software vulnerabilities and developing exploit techniques under controlled conditions. Recently, a rogue AI agent from OpenAI broke into a tech firm’s systems and went on a hacking spree that lasted days in the first such reported incident.
For organisations, this reinforces the importance of disciplined security practices, as good governance remains the strongest defence. That starts with maintaining robust patch management processes, clear accountability for security responsibilities and disciplined management of identities, permissions and business data. Organisations operating cloud-based enterprise environments also benefit from shared responsibility models in which infrastructure and platform security are continuously managed alongside customer responsibilities for access, configuration and governance.
Responsible industry-wide approach to AI
Equally important is ensuring that enterprise AI operates within business context rather than outside it. Responsible AI requires AI systems that understand business processes, respect existing authorisations, operate within established policies and produce outputs that can be audited and explained. Security must be embedded into the way AI is designed, supervised and governed from the outset.
This philosophy increasingly extends beyond individual organisations. Industry collaboration is becoming essential to ensuring AI develops safely and securely. Initiatives such as the Open Secure AI Alliance, which includes SAP among its founding members, recognise that securing AI will require open cooperation between technology providers, researchers and enterprise software vendors to develop shared approaches for identifying vulnerabilities, governing AI agents and strengthening software resilience.
Ultimately, trust will be determined by which organisations deploy it most responsibly. For African enterprises, AI should be viewed as both a cybersecurity threat and a productivity tool. Organisations that recognise security, governance and data discipline as strategic capabilities rather than technical afterthoughts have an advantage.
With the right governance, trusted data foundations and human oversight, AI can also become one of the most powerful tools organisations have to strengthen their resilience.
Generative AI has done to cybercrime what it has done to content production: collapsed the cost and the skill required to produce convincing output at scale. For African enterprises, that shift is arriving faster than most governance frameworks can absorb it.
By Wayne Meisel, market growth and customer officer at SAP
By early 2025, most phishing emails being detected were AI-generated, a dramatic rise from a low base just a year earlier. AI-automated spear-phishing campaigns are now matching the click-through rates of skilled human attackers, while cutting the cost of running a campaign by more than 95%.
Business email compromise (BEC), already one of Africa’s most damaging attack categories, is following the same trajectory, with a meaningful share of detected BEC campaigns now judged to be AI-crafted. Deepfake-enabled fraud, though still a smaller share of total attacks, has grown more than 20-fold since 2022.
African organisations are on the frontlines. INTERPOL’s most recent Africa Cyberthreat Assessment found that cyber-related offences now make up a medium-to-high share of all reported crime across two-thirds of surveyed member states, rising above 30% in parts of Western and Eastern Africa.
South Africa stands out as a regional bellwether: it has the highest suspected digital fraud rate on the continent, reported cybercrime losses running into the billions of rand, and a 60% increase in reported data breaches in a single reporting period. The Information Regulator’s new mandatory breach-reporting tool, launched in April 2026, signals that data governance is moving from best practice to enforced obligation. But INTERPOL also found that most African states still report inadequate training, resourcing and specialised tooling to meet this threat, leaving a gap between how fast attacks are evolving and how fast institutional defences are maturing.
Gap between attacks and defences widening
A recent report found that the median time for someone to click a phishing link is 21 seconds while the median time to report one is 28 minutes. Attackers now operate on a timeline human vigilance was never built to match, especially once that vigilance is up against AI on the other side too. The World Economic Forum’s 2026 outlook and EY’s Africa-focused research reach the same conclusion from different angles: cyber resilience is no longer a technical function that sits beside governance, but increasingly a matter of board-level accountability rather than IT ownership.
The conversation about enterprise AI adoption in Africa needs to be a conversation about governance, not just capability. The organisations best placed to withstand this next wave of AI-enabled attack will be the ones that pair automated, AI-embedded controls with disciplined, well-governed data foundations.
The uncomfortable reality is that human judgement alone cannot keep pace. For many years, cyber resilience centred on awareness training. Employee education remains essential, but it is no longer sufficient on its own. The next generation of cyber resilience will depend increasingly on automated controls, stronger governance and trusted enterprise data.
Agentic AI raises stakes
As organisations introduce AI assistants and increasingly autonomous AI agents into finance, procurement, HR, customer service and supply chain operations, governance becomes inseparable from security. Every AI agent represents another software actor capable of accessing information, making recommendations or triggering business processes. Without appropriate controls, these systems can unintentionally introduce new risks even while improving productivity.
Frontier AI models are already demonstrating unprecedented capabilities in identifying software vulnerabilities and developing exploit techniques under controlled conditions. Recently, a rogue AI agent from OpenAI broke into a tech firm’s systems and went on a hacking spree that lasted days in the first such reported incident.
For organisations, this reinforces the importance of disciplined security practices, as good governance remains the strongest defence. That starts with maintaining robust patch management processes, clear accountability for security responsibilities and disciplined management of identities, permissions and business data. Organisations operating cloud-based enterprise environments also benefit from shared responsibility models in which infrastructure and platform security are continuously managed alongside customer responsibilities for access, configuration and governance.
Responsible industry-wide approach to AI
Equally important is ensuring that enterprise AI operates within business context rather than outside it. Responsible AI requires AI systems that understand business processes, respect existing authorisations, operate within established policies and produce outputs that can be audited and explained. Security must be embedded into the way AI is designed, supervised and governed from the outset.
This philosophy increasingly extends beyond individual organisations. Industry collaboration is becoming essential to ensuring AI develops safely and securely. Initiatives such as the Open Secure AI Alliance, which includes SAP among its founding members, recognise that securing AI will require open cooperation between technology providers, researchers and enterprise software vendors to develop shared approaches for identifying vulnerabilities, governing AI agents and strengthening software resilience.
Ultimately, trust will be determined by which organisations deploy it most responsibly. For African enterprises, AI should be viewed as both a cybersecurity threat and a productivity tool. Organisations that recognise security, governance and data discipline as strategic capabilities rather than technical afterthoughts have an advantage.
With the right governance, trusted data foundations and human oversight, AI can also become one of the most powerful tools organisations have to strengthen their resilience.