Building a national AI and cybersecurity strategy for Nigeria

By Njoku Queenette Nnena

There are encouraging foundations on which to build. In April 2026, the Federal Government signalled plans to work with industry and other stakeholders towards a collaborative Cybersecurity Coordination Council, with the aim of improving information sharing, coordination and national cyber resilience. Such efforts will matter most when they translate into practical cooperation, measurable improvements and stronger protection for citizens and institutions.

Nigeria’s digital transformation presents enormous opportunities, but it also exposes the country to risks that cannot be ignored. From mobile banking and electronic payments to government databases, online businesses and artificial intelligence, technology is becoming central to everyday life. Yet the more dependent society becomes on digital systems, the greater the consequences when those systems are compromised.

The challenge before Nigeria is not simply how to prevent cyberattacks. It is how to build a country capable of anticipating digital threats, responding effectively when attacks occur, recovering quickly from disruption and using artificial intelligence responsibly. This is the difference between digital vulnerability and digital resilience.

Artificial intelligence has made this challenge more urgent. While AI can improve healthcare, education, agriculture, business operations and public administration, it can also be misused to produce convincing scams, impersonate individuals, automate malicious activities and exploit weaknesses in digital infrastructure. As these capabilities develop, traditional approaches to cybersecurity may no longer be sufficient on their own.

Nigeria has already taken steps towards addressing these issues. The country has a National Cybersecurity Policy and Strategy, while its National Artificial Intelligence Strategy, published in 2025, provides a framework for developing and adopting AI. The National Cybersecurity Coordination Centre also has a mandate to coordinate national cybersecurity efforts and support the protection of critical digital infrastructure. These initiatives provide an important foundation, but their effectiveness will depend on implementation, collaboration and sustained investment.

One of the most important priorities should be better coordination between government agencies, financial institutions, telecommunications providers, technology companies and cybersecurity professionals. Cyber threats do not respect institutional boundaries. An attack on a private service provider can disrupt customers, businesses and public services far beyond the organisation initially targeted. Sharing timely information about threats and coordinating responses can help prevent one incident from becoming a much larger crisis.

Nigeria must also recognise that cybersecurity is an economic issue. Small businesses increasingly depend on digital payments, online marketing and electronic records, yet many lack the resources or technical expertise to protect themselves effectively. A cyberattack can interrupt operations, expose customer information, damage reputations and threaten livelihoods. Supporting small and medium-sized enterprises with affordable security guidance, training and practical tools should therefore form part of a national resilience strategy.

Another priority is the protection of essential services. Banking, healthcare, electricity, telecommunications, transport and public administration all depend on digital infrastructure to varying degrees. Disruption in these sectors can affect millions of people. Organisations responsible for critical services should regularly assess their vulnerabilities, maintain secure backups, restrict access to sensitive systems and establish clear procedures for responding to cyber incidents. Preparation must take place before an attack, not after public services have already been disrupted.

Artificial intelligence should be part of the solution as well as part of the discussion about risk. AI-enabled tools can help identify unusual activity, detect suspicious transactions, analyse security alerts and support faster incident response. However, these tools should not be treated as infallible. Poorly configured systems can generate false alarms, overlook genuine threats or create new vulnerabilities. Human supervision, independent testing and clear accountability must remain central to their deployment.

The development of a national AI and cybersecurity strategy should also prioritise people. Nigeria needs more trained cybersecurity professionals, AI researchers, digital forensics experts and technology policy specialists. Universities, technical institutions, professional organisations and private companies can contribute through practical training, research partnerships, internships and accessible professional development programmes. Young Nigerians should be equipped not only to use emerging technologies but also to design, secure and govern them.

Equally important is the protection of citizens’ personal information. AI systems often depend on large quantities of data, making responsible data management essential. Organisations should collect only what they need, protect sensitive records and explain how personal information is used. Citizens, in turn, need greater awareness of phishing, identity theft, fraudulent investment schemes and AI-generated impersonations. Public education must be continuous, practical and accessible in the languages people understand.

Policy and legislation must keep pace with technological change without discouraging beneficial innovation. Clear standards are needed for protecting sensitive data, reporting significant incidents, managing AI-related risks and establishing responsibility when security failures occur. Nigeria should also strengthen international cooperation because cybercriminal networks frequently operate across national borders. No country can adequately address every digital threat in isolation.

There are encouraging foundations on which to build. In April 2026, the Federal Government signalled plans to work with industry and other stakeholders towards a collaborative Cybersecurity Coordination Council, with the aim of improving information sharing, coordination and national cyber resilience. Such efforts will matter most when they translate into practical cooperation, measurable improvements and stronger protection for citizens and institutions.

Ultimately, digital resilience is not achieved through policies alone, nor can it be purchased through technology. It requires institutions that cooperate, businesses that take security seriously, professionals with the right skills, citizens who understand digital risks and leaders who recognise that prevention is less costly than recovery.

Nigeria’s digital future should not be defined by how frequently it experiences cyberattacks, but by how effectively it prevents them, limits their impact and recovers when they occur. Artificial intelligence will continue to create new opportunities and new threats. The national task is to ensure that innovation advances alongside security, accountability and public trust.

The transition from digital vulnerability to digital resilience is therefore more than a technological ambition. It is a national development priority. Nigeria must act now to build a digital environment in which citizens can transact confidently, businesses can grow securely and public institutions can deliver services reliably. The future will belong not simply to the countries that adopt the most advanced technologies, but to those that learn how to use and protect them responsibly.

Njoku Queenette Nnena is a Public Policy Analyst..

I