DEV Community: Maxwell Afamefuna Nzekwe

Cybersecurity Is No Longer an IT Function—It Is a Leadership Responsibility

Maxwell Afamefuna Nzekwe — Fri, 02 Oct 2026 09:59:00 +0000

For many years, cybersecurity was treated as a specialist concern.

The IT department managed the firewall. The network team monitored traffic. The security team investigated alerts. Senior management became involved when an incident affected customers, revenue or reputation.

That model is no longer adequate.

Cybersecurity is now a leadership responsibility because digital risk is business risk.

A compromised system can interrupt operations. A stolen identity can expose confidential information. A weak supplier can create an entry point into a stronger organisation. A delayed software update can become an expensive incident. A culture that rewards results at any cost can quietly weaken the controls designed to protect the business.

Cybersecurity is therefore not only about technology. It is about governance, culture, decision-making and accountability.

The Biggest Vulnerability May Be Organisational

Organisations often focus on external attackers while overlooking internal weaknesses.

These weaknesses may include:

Unclear ownership of critical systems
Excessive user privileges
Poorly documented processes
Inadequate employee training
Weak vendor oversight
Delayed patching
Untested recovery plans
Fear of reporting mistakes
Pressure to prioritise speed over security

Technology can reduce risk, but it cannot compensate for an organisation that consistently ignores warning signs.

A strong cybersecurity programme begins with an honest assessment of how the organisation actually operates—not how its policies say it operates.

Culture Determines Whether Controls Work

A security policy is only effective when people understand it, believe it and follow it.

If employees are afraid to report suspicious activity, incidents may remain hidden until the damage is significant. If leaders bypass controls whenever they are inconvenient, employees learn that security is optional. If teams are measured exclusively on speed, they may take shortcuts that increase exposure.

Culture is expressed through daily behaviour.

Leaders shape that behaviour by deciding:

Whether security concerns are taken seriously
Whether employees can raise issues without retaliation
Whether senior people follow the same controls as everyone else
Whether mistakes are investigated or concealed
Whether security performance is discussed alongside financial and operational performance

This is why ethical leadership belongs in the cybersecurity conversation.

An organisation can purchase advanced tools and still remain vulnerable if its culture rewards concealment, negligence or uncontrolled access.

Cybersecurity Must Be Connected to Business Objectives

Security teams should not operate in isolation from the wider organisation.

They need to understand what the business is trying to achieve, which services are essential, what data is most valuable and which failures would cause the greatest harm.

Likewise, business leaders need to understand cybersecurity in practical terms.

The key questions are not limited to, “How many alerts did we close?” They include:

Which business services are most exposed?
How quickly can we detect a serious incident?
How long would it take to restore critical operations?
Which third parties have access to sensitive systems?
Are our most important accounts protected?
Do we know where sensitive data is stored?
Have we tested our response plan under realistic conditions?

These questions translate cybersecurity from a technical topic into a business resilience conversation.

Zero Trust Is a Mindset, Not a Product

The principle commonly associated with Zero Trust is simple: do not automatically trust a user, device or connection merely because it is inside the organisation’s environment.

But Zero Trust should not be reduced to a technology purchase.

It is a way of designing access and accountability. It requires organisations to continuously evaluate:

Who is requesting access?
What are they trying to reach?
Why do they need it?
Is the device secure?
Is the activity consistent with normal behaviour?
Should access be limited in time or scope?

This mindset is especially important as organisations adopt cloud services, remote work, mobile devices, artificial intelligence and complex supplier ecosystems.

The old assumption that the organisation has a clear perimeter is becoming less useful. Security must follow the identity, data and activity wherever they operate.

Education Must Become Practical and Continuous

Cybersecurity awareness should not be reduced to an annual compliance course.

Employees need to understand how security affects their actual work. They should know how to identify suspicious messages, protect credentials, report incidents and handle sensitive information.

Technical teams need continuous opportunities to practise detection, investigation and recovery.

Senior leaders need exercises that help them make decisions during an incident, including communication with customers, employees, regulators and partners.

The objective is not to create fear. It is to create confidence and readiness.

A well-trained workforce is more likely to report problems early. Early reporting can significantly improve an organisation’s ability to contain and recover from an incident.

Africa’s Cybersecurity Future Depends on Talent Development

Africa needs a larger and more diverse cybersecurity workforce.

The demand is not limited to penetration testers or security operations analysts. The ecosystem also needs:

Security architects
Governance and risk professionals
Privacy specialists
Incident responders
Digital forensics experts
Secure software developers
Cloud security engineers
Cybersecurity educators
Technology leaders who can connect security to business strategy

This creates an important opportunity for education and career development.

People entering cybersecurity should be encouraged to build strong foundations in networking, operating systems, data, communication and problem-solving. Certifications may be useful, but practical ability and sound judgement remain essential.

The industry should also make room for people from non-traditional backgrounds. Cybersecurity needs investigators, writers, policy specialists, educators, project managers and business professionals—not only engineers.

Leaders Need a Measurable Security Agenda

Every organisation should be able to answer five questions:

What are our most important digital assets?
What are the most credible threats to them?
Which controls reduce those risks?
How quickly can we detect and respond to a serious incident?
What have we changed after testing or experiencing a failure?

The answers should be communicated in language that boards and executives understand.

Metrics should focus not only on activity, but also on resilience. Examples include:

The time required to detect an incident
The time required to contain it
The proportion of critical systems covered by tested recovery plans
The number of high-risk weaknesses that remain unresolved

Measurement does not eliminate risk. But it makes risk visible, discussable and manageable.

Security Is a Trust Promise

Customers do not experience cybersecurity as a technical function. They experience it as trust.

They trust an organisation to protect their information, process transactions accurately, maintain service availability and respond responsibly when something goes wrong.

That trust can take years to build and only moments to lose.

The strongest organisations will be those that understand cybersecurity as part of their promise to customers, employees, shareholders and society.

The Leadership Test

A leader’s commitment to cybersecurity is tested when security competes with convenience, speed or short-term revenue.

Will the organisation delay a launch to resolve a serious vulnerability?

Will it invest in training before an incident occurs?

Will it investigate a concern raised by a junior employee?

Will it hold a high-performing executive accountable for bypassing controls?

These decisions reveal whether cybersecurity is genuinely valued or merely discussed.

Cybersecurity is not the responsibility of one department. It is a shared organisational discipline led from the top.

The future belongs to organisations that treat security not as an obstacle to growth, but as the foundation that makes sustainable growth possible.

Africa’s AI Opportunity Will Be Won by Secure Infrastructure, Not Hype

Maxwell Afamefuna Nzekwe — Sun, 27 Sep 2026 13:22:24 +0000

Artificial intelligence is often discussed as if the future depends primarily on better models, larger datasets and faster applications.

Those things matter. But they are not enough.

Africa’s AI opportunity will be determined by something more fundamental: whether we can build the secure, resilient and trusted digital infrastructure required to deploy AI responsibly at scale.

The continent does not need more excitement without execution. It needs an AI ecosystem designed around three principles:

Infrastructure that can be trusted
People who can build and manage it
Organisations that understand the risks as well as the opportunities

This is not an argument against innovation. It is an argument for durable innovation.

AI Cannot Be Stronger Than the Systems Beneath It

Every AI system depends on an underlying environment of networks, data, applications, identity systems, cloud infrastructure and human processes.

If those foundations are weak, AI can increase the speed and scale of existing problems.

Poorly governed data can produce unreliable outputs. Weak access controls can expose sensitive information. Flat networks can allow compromise to spread. Unmonitored systems can turn small vulnerabilities into major operational failures.

My experience in enterprise networking and data-centre transformation taught me an important lesson: resilience is not created by adding technology at the last minute. It is designed into the architecture from the beginning.

The same principle must guide AI adoption.

Before organisations ask what AI can automate, they should ask:

What data will the system access?
Who is allowed to use it?
How will decisions be reviewed?
What happens when the system is wrong?
Can the organisation detect misuse?
Can operations continue if the AI system becomes unavailable?
What evidence will be available after an incident?

These are not theoretical questions. They are the foundation of responsible digital transformation.

The Security Conversation Must Move Upstream

Too many organisations still treat cybersecurity as a final inspection after a product, platform or service has been built.

That approach is no longer sufficient.

Security must be considered during strategy, procurement, architecture, development, deployment and day-to-day operations. It must be part of the business case—not merely a technical requirement.

For AI-enabled organisations, this means protecting more than devices and networks. It means protecting:

Training and operational data
User identities and privileges
Application interfaces
Automated workflows
Model inputs and outputs
Customer information
Intellectual property
Decision-making processes

Security teams must also understand how AI changes the threat environment. Attackers can use automation to increase the scale of phishing, social engineering, fraud and reconnaissance. At the same time, poorly controlled AI tools can create new routes for data leakage and unauthorised access.

The answer is not to reject AI. The answer is to build governance and security into its adoption.

Africa Needs Practical AI, Not Imported Assumptions

AI solutions designed for one market may not automatically solve the problems of another.

African businesses operate across different connectivity realities, languages, regulatory environments, payment systems, consumer behaviours and levels of digital maturity. A solution that assumes constant connectivity, abundant computing capacity or uniformly structured data may struggle when deployed in real operating environments.

This is why African AI innovation must be:

Context-aware
Affordable to deploy
Designed for local operating conditions
Sensitive to privacy and trust
Supported by local technical talent
Measured by real-world outcomes

The objective should not be to adopt AI simply because it is fashionable. The objective should be to use it to solve meaningful problems in financial services, healthcare, education, agriculture, media, public services, logistics and small business.

The strongest solutions will be those that combine global technical progress with local understanding.

The Skills Gap Is a Strategic Risk

Technology adoption without talent development creates dependency.

Africa needs more people who understand not only how to use AI tools, but also how to secure, evaluate, govern, integrate and maintain them.

That requires a broader definition of digital skills. The future workforce will need capabilities across:

Data analysis
Cloud and infrastructure
Cybersecurity
Software development
AI operations
Digital ethics
Risk management
Business analysis
Product leadership

This is one reason practical education matters. My work in data analysis, cybersecurity education and the DeepLearning.AI community has reinforced my belief that people learn best when theory is connected to real problems.

We should therefore invest in learning programmes that help people build, test and improve systems—not simply collect certificates.

A young professional who understands networks, data, security and business operations can become far more valuable than someone who knows only how to operate a single tool.

Trust Will Become a Competitive Advantage

As AI becomes more visible in customer service, financial services, recruitment, education and decision-making, trust will determine adoption.

People will want to know:

Is my data protected?
Can I challenge an automated decision?
Will a human review important outcomes?
Is the system transparent about its limitations?
Who is accountable when something goes wrong?

Organisations that answer these questions clearly will have an advantage over those that treat trust as a marketing slogan.

Trust is not created by a privacy statement alone. It is created through architecture, governance, transparency, responsible leadership and consistent behaviour.

A Practical Agenda for African Organisations

Every organisation beginning its AI journey should consider five immediate actions:

First, create an AI and cybersecurity baseline.

Map the systems, data, users, vendors and risks involved.

Second, establish clear accountability.

AI should not operate in an ownership vacuum. Someone must be responsible for its performance, security and impact.

Third, apply least-privilege access.

People and systems should access only the data and functions required for their roles.

Fourth, build human review into high-impact decisions.

Automation should support judgement, not eliminate accountability.

Fifth, develop internal capability.

Invest in people who can understand the organisation’s technology environment rather than relying entirely on external providers.

The Real African AI Advantage

Africa’s advantage will not come from copying every technology trend.

It will come from solving real problems with disciplined execution, secure infrastructure, local talent and a clear understanding of human needs.

The continent has an opportunity to build digital systems that are not only intelligent, but also inclusive and trustworthy.

The question is no longer whether Africa should participate in the AI economy.

The more important question is:

Will we build AI systems that merely automate activity—or systems that strengthen trust, resilience and opportunity across the continent?

The answer will depend on what we choose to build now.