• Meta products are incredibly popular for African workers, but there isn’t much attention given to security training.
• Only half of employees polled report receiving cybersecurity training.
• As many as 51 percent of respondents had been infected with malware.

Whether you call it by its actual name or What’s Up, Meta’s WhatsApp is an integral part of the lives of Africans. This is revealed in the KnowBe4 African Cybersecurity and Awareness Report 2023.

The report draws from a number of surveys, polls and research conducted by KnowBe4 between 2020 and 2022. The most recent of these was a poll comprised of 800 people from Botswana, Egypt, Ghana, Kenya, Morocco, Mauritius, Nigeria, and South Africa.

The crux of the report is that the matters affecting Africans in 2021, continued to plague citizens in 2022.

What we found notable is how pervasive WhatsApp is. Not only do 97 percent of respondents use the platform in their personal lives, 89 percent use it for work as well. The next closest is Facebook with 59 percent of respondents using it for work and 78 percent using it in their personal lives.

“It found that WhatsApp is used extensively in Africa for work, more so than in other developed countries, and yet there is a lack of corporate advice and awareness around the risks. This underscores the importance of ensuring that users understand the threats and know how to use it safely,” says senior vice president of Content Strategy and Evangelist at KnowBe4 Africa, Anna Collard.

Furthermore, the popularity of WhatsApp as a communication platform makes it more attractive to cybercriminals. This becomes worrying when looking at organisational awareness.

The study found that only half of respondents had received cybersecurity training from their employers and only 21 percent rated this as adequate.

“While the survey did not delve into the definitions of ‘adequacy’, it is important to note that good or adequate content needs to be well produced, delivered well, in a timely manner and relevant to the role the person is involved in. For example, if someone works 100 percent from the office, there is little value in sharing content about travel security. Even if the content is well produced and accurate, the recipient will feel like it is not relevant and hence inadequate in relation to their job. Corporate awareness training programs need to be mindful about correctly timing their interventions. An accountant trying to file year end returns will not be able to spend an hour watching awareness videos,” writes Collard.

Even more alarming is that despite 34 percent of respondents saying they’d be able to spot a security incident, 26 percent admitted to clicking on a phishing email and 51 percent admitting to experiencing a malware infection. As many as 32 percent of respondents had also lost money to a scam.

To add further insult to injury, 20 percent of respondents considered P@$$word! a secure password.

“The report highlights that African businesses and internet users remain uninformed about how to mitigate cyber threats, which leaves them vulnerable. This intensifies the need for training and awareness programs,” concludes Collard.