Training African cyberstrategists: an imperative!

In a context of global hyper-connectivity, Africa's digital transformation is accelerating, opening up unprecedented economic and social prospects. However, this growing digitalisation of the continent still takes place following an approach that does not integrate security from the design stage (the so-called security-by-design model), an approach now considered outdated. This is not without consequences. It comes with a rapid increase in the attack surface, and therefore with rampant cybercrime in response to a spectacular rise in structural vulnerabilities. Although awareness of the importance of cybersecurity is growing strongly among various actors in Africa, one major challenge persists: the alarming shortage of qualified professionals able to ensure effective protection and defence of the continent's information systems.

According to a 2023 study by the organisation ISC2, the shortage of trained and skilled cybersecurity workers in Africa was estimated at around 112,000 professionals. Exacerbated by a set of aggravating factors, this skills gap takes on a particular dimension on the continent. These include the low level of awareness among populations (including decision-makers, despite recent progress), the lack of financial resources for SMEs to properly train their staff, the inadequacy of some existing training programmes that are often modelled on external templates and fail to effectively address local challenges, and a poor understanding of the full range of cybersecurity professions.

To address this, the African continent is seeing a flourishing of cybersecurity training initiatives (master's programmes, certifying courses, etc.), mainly focused on the skills and roles of technical experts. While this effort to develop the missing human capital is commendable, it reflects an outdated view of the threat, still centred on cybercrime [in the sense of ordinary crime extending into cyberspace]. Yet the evolving cyber landscape is marked by a strong rise in state-sponsored attacks, requiring profiles with not only technical, but also geopolitical and strategic skills.

I. The emergence of the Cyberstrategist

In an international context marked by cyber-conflict (influence operations, threats to the vital interests of states through digital tools), new profiles have emerged in the protection and defence of a state's cyber space. Among these new profiles are the cyber-combatant[1], the cyber-strategist, and finally the cyberstrategist, the central figure of cyberdefence on which we intend to focus.

Imposed by the emergence of cyberspace as a strategic environment and military theatre of operations, this new profile—extremely demanding in terms of foundational knowledge, aptitudes and skills—goes far beyond the traditional technical expertise we are used to.

Indeed, the cyberstrategist must first of all…

[1] The cyber-combatant is a cybersecurity specialist serving the armed forces, the Gendarmerie or other public services, in charge of offensive cyber operations (mandated by the political authority to attack an adversary's computer systems) or defensive ones (defending the computer systems of the armed forces and of companies in sensitive sectors).