Africa’s digital economy is expanding faster than its ability to protect it. INTERPOL’s African Cyberthreat Assessment Report 2026, drawing on information from 36 countries, found that artificial intelligence was involved in 55 per cent of reported cybercrimes across the continent. Reported losses rose from $192 million in 2024 to $484 million, while 72 per cent of surveyed countries reported scam centres operating within their borders.

The figures expose a growing vulnerability. Africa’s digital transformation is creating economic opportunities but also expanding the terrain on which criminals operate. The question is whether African institutions can respond collectively when attacks cross borders, exploit financial systems and use AI to target victims at scale.

Morocco Cybersecurity Week, held in Rabat from 12 to 14 October 2026, placed regional cooperation firmly on the agenda. The emphasis was appropriate. Yet Africa’s challenge extends beyond convening officials and announcing strategies. It is making institutions cooperate effectively under pressure.

Africa does not lack legal frameworks. The African Union Convention on Cyber Security and Personal Data Protection, known as the Malabo Convention, entered into force in June 2023 after years of delays. Morocco, meanwhile acceded to the Council of Europe’s Budapest Convention on Cybercrime in 2018 and signed its Second Additional Protocol on electronic evidence in 2022.

These instruments provide important foundations for criminal investigations, data protection and cross-border cooperation. But legal commitments cannot, on their own, ensure that investigators obtain evidence quickly, financial institutions exchange actionable intelligence or police services coordinate an effective response.

Cybercrime crosses institutional boundaries. A fraudulent transaction may involve a mobile-money provider, a bank, a telecommunications company, a cryptocurrency exchange and digital infrastructure spread across several jurisdictions. Each holds part of the evidence. When requests are delayed or responsibilities are unclear, investigators lose valuable time while criminals move money and erase their tracks. African institutions must therefore measure cooperation by what they can accomplish together, not by the number of agreements they endorse.

There is evidence that coordinated action works. INTERPOL’s Operation Serengeti 2.0, conducted between June and August 2025, brought together law-enforcement authorities from 18 African countries and the United Kingdom. It resulted in 1,209 arrests, the dismantling of 11,432 malicious infrastructures and the recovery of $97.4 million. Private-sector partners contributed intelligence and technical expertise.

The lesson is not that treaties are unnecessary. Investigations still require lawful powers, admissible evidence and safeguards. Rather, Serengeti demonstrates the value of shared objectives, established channels and institutions equipped to act on intelligence together.

This is where Africa should look beyond calls by some of its leaders for a continental equivalent of NATO’s Article 5. On 19 May 2025, Rwandan President Paul Kagame made these remarks in his keynote address at the inaugural International Security Conference on Africa (ISCA), held at the Kigali Convention Centre. Ugandan President Yoweri Museveni has also raised related questions at the African Defence Chiefs Conference on Military Operations. While these calls reflect growing interest in collective African security, NATO’s experience offers a more specific lesson for cybersecurity governance. NATO recognises cyberspace as an operational domain, and significant cyberattacks may, in certain circumstances, constitute an armed attack. However, invoking collective defence is not automatic: each case is assessed individually by the North Atlantic Council.

For African governments confronting cyber-enabled fraud, ransomware and attacks on public services, the more immediate lesson is not collective retaliation. It is collective preparedness.

Consider NATO’s annual Locked Shields exercise, organised by its Cooperative Cyber Defence Centre of Excellence. The 2026 exercise brought together approximately 4,000 participants from 41 countries to defend simulated digital systems against complex attacks. Participants tested technical responses while confronting the coordination challenges that emerge during a crisis. The winning Latvia–Singapore team also demonstrated the value of cooperation beyond NATO’s membership.

Africa should adapt this model to its own circumstances. A recurring continental cyber-resilience exercise could simulate ransomware targeting a regional electricity network, attacks on mobile-money platforms or the compromise of a government identity system. Police, computer emergency response teams, financial regulators, banks and telecommunications operators would have to investigate, communicate and make decisions together.

The objective should not be a staged demonstration in which everyone knows the answers. Exercises must expose weaknesses: who can isolate a compromised system, how evidence is preserved, when neighbouring countries are notified and how essential services continue operating. Participants should publish appropriately sanitised assessments identifying failures and corrective measures.

Morocco is well positioned to contribute. The International Telecommunication Union’s 2024 Global Cybersecurity Index placed the country in Tier 1, the highest performance category, with a score of 97.5 out of 100. In October 2026, Morocco also launched a Cyber Academy programme with the World Bank and Smart Africa Digital Academy to strengthen cybersecurity leadership across Africa.

Such initiatives are valuable, but executive training must complement technical capacity. Africa needs analysts who investigate malware, incident responders who contain attacks and digital-forensics specialists who preserve evidence. It also needs institutions able to retain these professionals and fund the systems they require.

Trust is equally important. Morocco’s cybersecurity directorate operates under its National Defence Administration. This arrangement does not, by itself, establish that information will be misused. However, any continental threat-intelligence mechanism must define who can access shared data, for what purposes and under what oversight. Banks and telecommunications companies will hesitate to share sensitive information if protections and accountability are uncertain. Citizens also need safeguards against the misuse of cybersecurity powers for unlawful surveillance.

Africa must improve how it measures the problem, too. The United Nations Economic Commission for Africa has cited estimates that cybercrime costs African countries an average of 10 per cent of GDP. This should not be treated as a verified annual loss across every country. Estimates differ in scope and methodology, while official incident data remain incomplete. Standardised reporting is essential to distinguish confirmed losses from broader economic damage and establish credible priorities for investment.

Four priorities should follow. First, establish common incident-reporting standards. Second, create a funded, recurring African cyber-resilience exercise open to all African Union member states and involving public and private institutions. Third, develop secure mechanisms for urgent cross-border evidence requests, consistent with domestic law and international obligations. Fourth, establish independent oversight, clear access rules and privacy protections for shared threat intelligence.

Artificial intelligence can strengthen detection and response, but it cannot compensate for institutions that fail to communicate or procedures that collapse during a crisis.

Rabat’s significance should ultimately be measured by what follows the speeches. By the next regional gathering, can agencies in different African countries rehearse a joint response, exchange evidence lawfully and report incidents using comparable standards?

If they can, cooperation will have moved from declaration to capability. If they cannot, Africa will remain vulnerable not because it lacks ambition or legal instruments, but because its institutions have not practised working together.

Criminal networks already operate across borders. Africa’s defenders must learn to do the same.