Authors

Dimie Nwankwe

Strategic Procurement Department, Oando Energy Resources Nigeria Limited, Port Harcourt, Nigeria

Boye Aziboledia Frederick

Faculty of Computing, Department of Computer Science and Informatics, Otuoke, Bayelsa State, Nigeria

Abstract

Despite record global spending on cybersecurity, the question of how secure modern societies actually have remained unsettled. This paper answers that question through an integrative review of peer-reviewed literature, international standards and the most recent large-scale empirical datasets on breaches, incidents and workforce capacity published between 2024 and 2026. The evidence points to a security paradox. Defensive capability has improved measurably: organisations now detect a larger share of intrusions internally, extensive use of security automation is associated with substantially lower breach costs, and post-quantum cryptographic standards have been finalised. Yet aggregate exposure is rising faster than defence. The global average cost of a data breach reached a record USD 4.99 million in 2026; vulnerability exploitation overtook stolen credentials as the leading initial access vector; ransomware featured in 48% of analysed breaches; third-party involvement rose to 48% of breaches; and the human element remained present in roughly six in ten. Artificial intelligence has moved from a theoretical amplifier to an operational one, with the first publicly documented AI-orchestrated espionage campaign disrupted in 2025. Workforce data show that skills, rather than headcount alone, are now the binding constraint. For Africa and Nigeria, the gap is sharper still: cybercrime accounts for more than 30% of reported crime in West and East Africa, and Nigeria remains in Tier 3 of the ITU Global Cybersecurity Index. The paper argues that security should be understood not as a state but as a dynamic, socio-technical capability whose adequacy is relative to adversary speed, systemic interdependence and institutional capacity. It proposes a five-dimension assessment lens (exposure, detection, resilience, governance and capacity) and offers recommendations for organisations, governments and researchers, with specific attention to the Nigerian context. The answer to the title question is therefore conditional: we are more capable than ever, but less secure than we need to be.

Keywords

Cybersecurity; cyber resilience; ransomware; supply chain risk; artificial intelligence; post-quantum cryptography; zero trust; Nigeria; Africa; security economics

Citation of this Article

Dimie Nwankwe, & Boye Aziboledia Frederick. (2026). How Secure Are We? A Critical Assessment of the Global Cybersecurity Posture in an Era of Artificial Intelligence, Cloud Dependence and Interconnected Critical Infrastructure. International Current Journal of Engineering and Science (ICJES), 5(10), 13-32. Article DOI: https://doi.org/10.47001/ICJES/2026.510003 

Licence Copyright (c) 2026 International Current Journal of Engineering and Science. This work is licensed under a Creative Commons Attribution Non Commercial 4.0 International Licence.

References

  1. Adams, A., & Sasse, M. A. (1999). Users are not the enemy. Communications of the ACM, 42(12), 40–46. https://doi.org/10.1145/322796.322806
  2. Anderson, R. (2001). Why information security is hard: An economic perspective. In Proceedings of the 17th Annual Computer Security Applications Conference (pp. 358–365). IEEE. https://doi.org/10.1109/ACSAC.2001.991552
  3. Anderson, R. (2020). Security engineering: A guide to building dependable distributed systems (3rd ed.). Wiley.
  4. Anderson, R., & Moore, T. (2006). The economics of information security. Science, 314(5799), 610–613. https://doi.org/10.1126/science.1130992
  5. Anthropic. (2025, November 13). Disrupting the first reported AI-orchestrated cyber espionage campaign. https://www.anthropic.com/news/disrupting-AI-espionage
  6. Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J. A., Invernizzi, L., Kallitsis, M., Kumar, D., Lever, C., Ma, Z., Mason, J., Menscher, D., Seaman, C., Sullivan, N., Thomas, K., & Zhou, Y. (2017). Understanding the Mirai botnet. In Proceedings of the 26th USENIX Security Symposium (pp. 1093–1110). USENIX Association.
  7. Bada, M., Sasse, A. M., & Nurse, J. R. C. (2015). Cyber security awareness campaigns: Why do they fail to change behaviour? International Conference on Cyber Security for Sustainable Society. https://doi.org/10.48550/arXiv.1901.02672
  8. Baker Donelson. (2026). Ten takeaways from IBM’s 2026 Cost of a Data Breach Report. https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report
  9. Bernstein, D. J., & Lange, T. (2017). Post-quantum cryptography. Nature, 549(7671), 188–194. https://doi.org/10.1038/nature23461
  10. Blount, J. (2021, June 8). Testimony of Joseph Blount, President and Chief Executive Officer, Colonial Pipeline Company, before the United States Senate Committee on Homeland Security and Governmental Affairs. https://www.hsgac.senate.gov/imo/media/doc/Testimony-Blount-2021-06-08.pdf
  11. Boye Aziboledia Frederick, Onate Egerton Taylor. Analysis on Cybersecurity Control and Monitoring Techniques in Industrial IoT: Industrial Control Systems. Internet of Things and Cloud Computing. Vol. 11, No. 1, 2023, pp. 1-17. doi: 10.11648/j.iotcc.20231101.11
  12. Carlini, N., Tramèr, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, Ú., Oprea, A., & Raffel, C. (2021). Extracting training data from large language models. In Proceedings of the 30th USENIX Security Symposium (pp. 2633–2650). USENIX Association.
  13. Cybersecurity and Infrastructure Security Agency. (2020, December 13). Emergency Directive 21-01: Mitigate Solar Winds Orion code compromise. https://www.cisa.gov/news-events/directives/ed-21-01-mitigate-solarwinds-orion-code-compromise
  14. Cybersecurity and Infrastructure Security Agency. (2024, July 19). Widespread IT outage due to CrowdStrike update. https://www.cisa.gov/news-events/alerts/2024/07/19/widespread-it-outage-due-crowdstrike-update
  15. Cybersecurity and Infrastructure Security Agency & Federal Bureau of Investigation. (2023). #StopRansomware: CL0P ransomware gang exploits CVE-2023-34362 MOVEit vulnerability (Advisory AA23-158A). https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
  16. Fang, R., Bindu, R., Gupta, A., & Kang, D. (2024). LLM agents can autonomously exploit one-day vulnerabilities (arXiv:2404.08144). https://doi.org/10.48550/arXiv.2404.08144
  17. Federal Bureau of Investigation. (2025). Internet Crime Report 2024. Internet Crime Complaint Center. https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
  18. GitHub Advisory Database. (2024, March 29). CVE-2024-3094: Malicious code was discovered in the upstream tarballs of xz (GHSA-rxwq-x6h5-x525). https://github.com/advisories/GHSA-rxwq-x6h5-x525
  19. Goodfellow, I. J., Shlens, J., & Szegedy, C. (2015). Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR 2015). https://doi.org/10.48550/arXiv.1412.6572
  20. Gordon, L. A., & Loeb, M. P. (2002). The economics of information security investment. ACM Transactions on Information and System Security, 5(4), 438–457. https://doi.org/10.1145/581271.581274
  21. Greenberg, A. (2019). Sandworm: A new era of cyberwar and the hunt for the Kremlin’s most dangerous hackers. Doubleday.
  22. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023). Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec ’23) (pp. 79–90). https://doi.org/10.1145/3605764.3623985
  23. Help Net Security. (2026, March 24). Attackers are handing off access in 22 seconds, Mandiant finds. https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/
  24. Herley, C. (2009). So long, and no thanks for the externalities: The rational rejection of security advice by users. In Proceedings of the 2009 New Security Paradigms Workshop (pp. 133–144). ACM. https://doi.org/10.1145/1719030.1719050
  25. HIPAA Journal. (2025). Change Healthcare responding to cyberattack [Continuously updated report]. https://www.hipaajournal.com/change-healthcare-responding-to-cyberattack/
  26. HIPAA Journal. (2026). Global data breach cost rises 12% to almost $5 million. https://www.hipaajournal.com/2026-cost-data-breach-study-ibm/
  27. Hutchins, E. M., Cloppert, M. J., & Amin, R. M. (2011). Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains [White paper]. Lockheed Martin Corporation. https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf
  28. IEPL Corporate Communication, Indorama-Nigeria, Impact In-House Magazine, 2019, www.indorama.com
  29. IBM Security. (2023). Cost of a Data Breach Report 2023 (with the Ponemon Institute). IBM Corporation.
  30. IBM. (2025, July 30). IBM report: 13% of organizations reported breaches of AI models or applications, 97% of which reported lacking proper AI access controls [Press release; Cost of a Data Breach Report 2025]. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
  31. IBM. (2026a). Cost of a Data Breach Report 2026 (with the Ponemon Institute). https://www.ibm.com/reports/data-breach
  32. IBM. (2026b, July 29). IBM study: One in four malicious breaches are AI-enabled, costing companies $6 million on average [Press release]. https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
  33. International Telecommunication Union. (2024a). Global Cybersecurity Index 2024 (5th ed.). https://www.itu.int/en/ITU-D/Cybersecurity/Documents/GCIv5/2401416_1b_Global-Cybersecurity-Index-E.pdf
  34. International Telecommunication Union. (2024b, September 12). Countries strengthening cybersecurity efforts, but increased action still required [Press release]. https://www.itu.int/en/mediacentre/Pages/PR-2024-09-10-Global-Cybersecurity-Index.aspx
  35. INTERPOL. (2025a). Africa Cyberthreat Assessment Report 2025 (4th ed.). https://www.interpol.int/content/download/23094/file/INTERPOL_Africa_Cyberthreat_Assessment_Report_2025.pdf
  36. INTERPOL. (2025b, December 19). 574 arrests and USD 3 million recovered in coordinated cybercrime operation across Africa. https://www.interpol.int/en/News-and-Events/News/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa
  37. INTERPOL. (2026, August 3). INTERPOL report finds AI linked to more than half of cybercrime in Africa. https://www.interpol.int/en/News-and-Events/News/2026/INTERPOL-report-finds-AI-linked-to-more-than-half-of-cybercrime-in-Africa
  38. ISC2. (2024, September 11). Growth of cybersecurity workforce slows in 2024 as economic uncertainty persists [2024 ISC2 Cybersecurity Workforce Study]. https://www.isc2.org/Insights/2024/09/ISC2-Publishes-2024-Cybersecurity-Workforce-Study-First-Look
  39. ISC2. (2025). 2025 ISC2 Cybersecurity Workforce Study. https://www.isc2.org/Insights/2025/12/2025-ISC2-Cybersecurity-Workforce-Study
  40. KPMG Nigeria. (2023). The Nigeria Data Protection Act 2023. https://kpmg.com/ng/en/home/insights/2023/09/the-nigeria-data-protection-act–2023.html
  41. Kshetri, N. (2019). Cybercrime and cybersecurity in Africa. Journal of Global Information Technology Management, 22(2), 77–81. https://doi.org/10.1080/1097198X.2019.1603527
  42. Langner, R. (2011). Stuxnet: Dissecting a cyberwarfare weapon. IEEE Security & Privacy, 9(3), 49–51. https://doi.org/10.1109/MSP.2011.67
  43. Mandiant. (2025). M-Trends 2025. Google Cloud. https://services.google.com/fh/files/misc/m-trends-2025-en.pdf
  44. Mandiant. (2026). M-Trends 2026: Executive edition. Google Cloud. https://services.google.com/fh/files/misc/m-trends-2026-executive-edition-en.pdf
  45. Microsoft. (2024, July 20). Helping our customers through the CrowdStrike outage. https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/
  46. Ministry of Communications and Digitalisation, Ghana. (2024, September 16). Ghana ranked Tier 1 status in latest ITU Global Cybersecurity Index. https://moc.gov.gh/2024/09/16/ghana-ranked-tier-1-status-in-latest-itu-global-cybersecurity-index/
  47. Mondaq. (2024). The National Assembly amends the Cybercrimes (Prohibition, Prevention, etc.) Act. https://www.mondaq.com/nigeria/security/1466724/the-national-assembly-amends-the-cybercrimes-prohibition-prevention-etc-act
  48. Moore, T., Clayton, R., & Anderson, R. (2009). The economics of online crime. Journal of Economic Perspectives, 23(3), 3–20. https://doi.org/10.1257/jep.23.3.3
  49. Mosca, M. (2018). Cybersecurity in an era with quantum computers: Will we be ready? IEEE Security & Privacy, 16(5), 38–41. https://doi.org/10.1109/MSP.2018.3761723
  50. Nairametrics. (2024a, May 8). Explainer: Is CBN’s cybersecurity levy 0.5% or 0.005%? https://nairametrics.com/2024/05/08/is-cbns-cybersecurity-levy-0-5-or-0-005/
  51. Nairametrics. (2024b, September 13). ITU lists Nigeria among tier-3 countries in Global Cybersecurity Index 2024. https://nairametrics.com/2024/09/13/itu-lists-nigeria-among-tier-3-countries-in-global-cybersecurity-index-2024/
  52. Nairametrics. (2024c, May 14). Federal Executive Council suspends cyber security levy, to undergo “some form of review”. https://nairametrics.com/2024/05/14/federal-executive-council-suspends-cyber-security-levy/
  53. National Audit Office. (2017, October 27). Investigation: WannaCry cyber attack and the NHS.https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/
  54. National Institute of Standards and Technology. (2024a). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29
  55. National Institute of Standards and Technology. (2024b). Module-lattice-based key-encapsulation mechanism standard (FIPS 203). https://doi.org/10.6028/NIST.FIPS.203
  56. National Institute of Standards and Technology. (2024c). Module-lattice-based digital signature standard (FIPS 204). https://doi.org/10.6028/NIST.FIPS.204
  57. National Institute of Standards and Technology. (2024d). Stateless hash-based digital signature standard (FIPS 205). https://doi.org/10.6028/NIST.FIPS.205
  58. National Vulnerability Database. (2021). CVE-2021-44228. NIST. https://nvd.nist.gov/vuln/detail/CVE-2021-44228
  59. Nigeria Data Protection Commission. (n.d.). About us. https://ndpc.gov.ng/about-us/
  60. Perrow, C. (1999). Normal accidents: Living with high-risk technologies (Updated ed.). Princeton University Press.
  61. Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special Publication 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207
  62. Saltzer, J. H., & Schroeder, M. D. (1975). The protection of information in computer systems. Proceedings of the IEEE, 63(9), 1278–1308. https://doi.org/10.1109/PROC.1975.9939
  63. Security Boulevard. (2026, August). How much does a data breach cost? IBM’s 2026 report puts the US average at $11.5 million. https://securityboulevard.com/2026/08/how-much-does-a-data-breach-cost-ibms-2026-report-puts-the-us-average-at-11-5-million/
  64. Shor, P. W. (1997). Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Journal on Computing, 26(5), 1484–1509. https://doi.org/10.1137/S0097539795293172
  65. Slayton, R. (2017). What is the cyber offense-defense balance? Conceptions, causes, and assessment. International Security, 41(3), 72–109. https://doi.org/10.1162/ISEC_a_00267
  66. Snyder, H. (2019). Literature review as a research methodology: An overview and guidelines. Journal of Business Research, 104, 333–339. https://doi.org/10.1016/j.jbusres.2019.07.039
  67. SolarWinds Corporation. (2020, December 14). Form 8-K: Current report. U.S. Securities and Exchange Commission. https://www.sec.gov/Archives/edgar/data/1739942/000162828020017451/swi-20201214.htm
  68. Sommer, R., & Paxson, V. (2010). Outside the closed world: On using machine learning for network intrusion detection. In 2010 IEEE Symposium on Security and Privacy (pp. 305–316). IEEE. https://doi.org/10.1109/SP.2010.25
  69. Strom, B. E., Applebaum, A., Miller, D. P., Nickels, K. C., Pennington, A. G., & Thomas, C. B. (2020). MITRE ATT&CK: Design and philosophy (Revised ed.). The MITRE Corporation. https://www.mitre.org/news-insights/publication/mitre-attck-design-and-philosophy
  70. TechHive Advisory. (2024). Nigeria Cybercrimes (Prohibition, Prevention, etc.) Act amendment: Charting future direction. https://www.techhiveadvisory.africa/insights/nigeria-cybercrimes-prohibition-prevention-etc-act-amendment-charting-future-direction
  71. Torraco, R. J. (2005). Writing integrative literature reviews: Guidelines and examples. Human Resource Development Review, 4(3), 356–367. https://doi.org/10.1177/1534484305278283
  72. United States Department of Justice. (2021, June 7). Department of Justice seizes $2.3 million in cryptocurrency paid to the ransomware extortionists Darkside. https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside
  73. Verizon. (2025). 2025 Data Breach Investigations Report: Executive summary. https://www.verizon.com/business/resources/reports/2025-dbir-executive-summary.pdf
  74. Verizon. (2026). 2026 Data Breach Investigations Report. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
  75. World Economic Forum. (2026, January 12). Global Cybersecurity Outlook 2026 (in collaboration with Accenture). https://www.weforum.org/publications/global-cybersecurity-outlook-2026/