Johannesburg

Recently I was in Johannesburg, South Africa, speaking at the ITWeb Security Summit and participating in a closed-door executive roundtable with more than twenty senior decision-makers. The panel explored a simple question: How do you assess which cybersecurity solutions your organization needs? The roundtable went further, examining strategies for responding to major cyber incidents across the continent, with particular attention to the payments and telecommunications sectors.

What struck me most was how consistent the underlying problem is, regardless of geography. The organizations making genuine progress in AI and cybersecurity are not the ones acquiring the most tools. They are the ones with clarity on three questions: What are they protecting? What threatens it? What would failure cost the organization?

A populated dashboard is not assurance. Vanity metrics do not equate to security. Activity is not the same as risk reduction.

The broader conversations in Johannesburg reinforced that AI-related cyber threats in Africa are not theoretical. Payments and telecommunications infrastructure are live targets today. Threat actors are already weaponizing AI, and where personal data is involved, the issue stops being purely technical. It becomes a governance, privacy, and cybersecurity challenge at the same time.

One question surfaced repeatedly: Who owns the decision, and who owns the consequences?

From the United States to Europe, the Middle East, and Africa, organizations are accelerating AI adoption faster than they are assigning accountability for it. Regulators, boards, customers, and shareholders will ask this question whether organizations have answered it internally.

Johannesburg did not reveal a different AI governance challenge. It reinforced one I continue to encounter across global executive rooms.