With immense pressure on Nigeria’s cyberspace following the increase in threats and actual attacks from cybercriminals, which appeared not to be abating, cybersecurity expert, Adebowale Emmanuel Adetunji, in an interview with ADEYEMI ADEPETUN, shares insights on the country’s digital threat landscape and the role of AI in shaping a safer ecosystem
.
Activities of cybercriminals, especially in the financial sector, have been immense lately. What is causing this spike?
The Nigerian financial ecosystem has made significant strides in digital transformation, but cybersecurity maturity is still uneven across institutions. While Tier-1 banks have invested heavily in layered defences — such as SIEM systems, endpoint detection and response (EDR) and even early-stage threat intelligence platforms — smaller institutions and fintechs often lack robust threat modelling or real-time detection capabilities.
We are seeing a surge in credential stuffing, business email compromise (BEC) and increasingly targeted ransomware attempts. Cybercriminals are becoming more organised, often exploiting third-party vulnerabilities, legacy infrastructure and insufficient security operations centre (SOC) capabilities.
The truth is that Nigeria’s cybersecurity framework is reactive in many quarters. Many institutions still prioritise compliance-based security rather than risk-based and intelligence-driven defence strategies.
Beyond the financial ecosystem, how would you assess Nigeria’s national cybersecurity architectures?
Nationally, we have seen good progress with the Nigeria Data Protection Act and the ongoing work of the Office of the National Security Adviser and NITDA. But these efforts are still heavily policy-driven without enough technical muscle or cross-sector enforcement. There is a lack of real-time national threat sharing mechanisms akin to the U.S. FS-ISAC or CISA model.
Our critical financial infrastructures — including payment processors, switch providers, and interbank platforms — are still vulnerable to distributed denial-of-service (DDoS) attacks and logic bombs due to gaps in national coordination and incident response readiness.
Cybersecurity cannot be siloed. We need a national cyber fusion centre that brings together intelligence from telecoms, banks, regulators, and law enforcement. Cyber resilience is not just about prevention but about how quickly and effectively we can detect, respond, and recover.
How can Nigeria build resilience amid the growing targeted attacks?
Resilience means ensuring continuity under stress. For financial institutions, as an example, this requires embedding cybersecurity into operational resilience frameworks. We need to adopt a zero-trust architecture — where access is continually verified, not assumed.
As Nigeria’s financial sector rapidly digitises, so do the threats lurking in the background — from phishing attacks targeting mobile banking users to increasingly sophisticated cross-border cyber fraud.
Instead of this, disaster recovery and cyber incident playbooks must evolve. Many institutions still treat cybersecurity as an IT issue rather than an enterprise risk. The board must be cyber-literate. Recovery time objectives (RTO) and recovery point objectives (RPO) should now factor in not just business continuity, but data integrity and threat containment.
One key area is the simulation of real-world attack scenarios using red team/blue team exercises. These stress tests not just the technology, but the people and processes as well.
What roles can emerging technologies like AI play in strengthening cybersecurity?
Artificial intelligence is a game-changer. AI and machine learning can provide predictive insights into abnormal behaviour before attacks happen. For example, anomaly detection engines can flag unusual login patterns or transaction flows — even if they haven’t been previously classified as threats.
In security operations centres, AI can accelerate Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR), reducing manual triaging and enabling analysts to focus on high-value threats. Natural language processing (NLP) models can process thousands of threat intel feeds in real time to deliver actionable insights.
However, AI is a double-edged sword. Threat actors are already using generative AI to craft hyper-realistic phishing attacks and automate vulnerability scans. Hence, it’s not about using AI in isolation, but embedding it in a broader cyber defence lifecycle — from attack surface management to post-incident forensics.
How can Nigeria position itself better for the future?
First, we need to invest in talent. The cybersecurity skills gap in Nigeria is real. We must incentivise cybersecurity certifications, create a national cyber talent registry, and encourage knowledge-sharing platforms.
Second, there must be regulatory modernisation. The Central Bank of Nigeria’s (CBN) Risk-Based Cybersecurity Framework was a good start. But it needs teeth. Regulations should include sector-wide cyber maturity assessments, mandatory breach disclosures and stricter third-party vendor risk oversight.
Lastly, public-private collaboration must move beyond memorandums. We need active threat-sharing consortia, periodic cybersecurity drills, and coordinated national incident response strategies. If we can secure Nigeria’s financial sector — one of the most digitised on the continent — we can set a benchmark for all of Africa.
Source: Guardian
