Cyber Week Africa 2026: AI-assisted threat intelligence needs verifiable cooperation

Nairobi puts threat intelligence at the centre

Cyber Week Africa 2026 ran from 27 to 30 October at Nairobi’s Kenyatta International Convention Centre. The fifth edition’s public theme, Cyber Threat Intelligence in the Age of AI, joined two promises: better information exchange between countries and faster analysis of alert volumes that human teams increasingly struggle to process alone.

At the opening, Kenya called on African countries to strengthen cross-border cooperation, links between national response teams and investment in digital skills. The direction reflects the growing interconnection of payment systems, telecommunications and public services. A compromise in a supplier, payment gateway or cloud platform can now affect several jurisdictions within hours.

The available sources confirm the event, its programme and the calls made by officials. They do not establish that a new continental agreement with binding duties, indicators and a timetable was adopted. The important editorial question is therefore what verifiable cooperation would require in practice.

AI cannot repair poor intelligence

AI tools can cluster alerts, summarise reports, extract indicators and suggest links between incidents. They can help a small team review thousands of events more quickly. But they also amplify weaknesses in the underlying data: uncertain attribution, expired indicators, incomplete telemetry and incompatible classification between organisations.

Automating the ingestion of feeds without governance may increase noise rather than understanding. A model can confidently propose a relationship that does not exist or obscure the origin of a claim. In incident response, a wrong recommendation can block legitimate infrastructure, interrupt a public service or trigger premature attribution.

Every generated result should retain provenance, confidence and the time of last observation. High-impact decisions — isolating a critical system, making a public notification, attributing an attack or referring a case to law enforcement — should remain subject to competent human validation. Models handling sensitive context must also be tested against data leakage, prompt injection and source manipulation.

Share less, but share better

Cross-border intelligence does not require every country to expose all of its data. It requires structured objects that partners can use, accompanied by understandable distribution rules. A CSIRT receiving an IP address without a time window, associated technique or confidence level cannot know whether to block, monitor or disregard it.

National and sector teams can begin with a limited scope: mobile-money fraud campaigns, business email compromise, abuse of exposed public infrastructure and actively exploited vulnerabilities in widely deployed products. For each case, they should agree on mandatory fields, classification, expected handling time and feedback channels.

Reciprocity matters. Private operators will disengage if they submit data but receive no regional context. Victims will remain silent if authorities cannot protect their identity. Trust grows from stable rules, named responsibilities and exercises in which mistakes can be corrected before a real emergency.

Kenya can be a regional node, not a universal model

Kenya has clear advantages: a dense technology ecosystem, large-scale digital finance, specialised public bodies and an ability to convene government, universities and business. Nairobi can host regional procedure tests. Solutions must nevertheless remain usable in countries with smaller teams, lower budgets and less reliable connectivity.

An expensive platform requiring permanent connectivity will not meet every CERT’s needs. Open formats, delayed exchange and locally hosted tools matter. Regional arrangements must also account for working languages and legal differences concerning evidence, incident notification and cross-border data transfers.

Africa does not need one central repository absorbing all intelligence. A federation of national and sector communities exchanging according to common rules would be more resilient and more compatible with sovereignty constraints.

Metrics that convert speeches into results

Organisers and participating institutions can publish a practical scorecard: organisations exchanging regularly, median dissemination time for a validated indicator, alerts enriched with African context, false-positive rate and completed cross-border exercises.

Public and private leaders should prioritise five actions:

• inventory the telemetry that is genuinely available;
• define which decisions AI may suggest and which it must never take alone;
• adopt interoperable formats and preserve provenance;
• exercise cooperation between CERTs, banks, telecom operators and investigators;
• measure the time from detection to qualification, sharing and action.

Cyber Week Africa asked the right question: how can AI support faster, more collective African intelligence? The answer will not come from a model in isolation. It depends on data quality, institutional trust and common procedures tested before the next major campaign.

— ◆ —