The rules just changed
The game shifted the moment Anthropic's Claude Mythos Preview went live. We're now looking at AI that discovers thousands of unknown security flaws, connects them into full attack paths in minutes and exposes weaknesses that have sat undetected for years.
Anthropic's recently launched a public beta of enhanced security capabilities for Claude Security Public Beta (30 April 2026) with improved guardrails, audit logging and enterprise-grade access controls sends a clear signal that the same AI power being used offensively can and must be harnessed defensively.
Here's the reality. In 2018, the gap between discovering a vulnerability and seeing it exploited was 2 years. Today, it's under 24 hours. For African business leaders, this is not an abstract headline. It is a direct challenge to how systems, customers and economies are protected. The implication is simple, integrate AI-powered defence now or fall behind. Waiting is no longer a strategy.
This is already happening here
We don't need to speculate. Across the continent's three largest economies, attackers have already shown what's possible without AI.
What PwC's Global Threat Intelligence is tracking aligns closely with what's playing out publicly. It should concern all of us.
South Africa: Ransomware has hit critical services. Financially motivated intrusions continue targeting banking, insurance through legacy infrastructure and third-party access. Regulators have flagged cyber risk as systemic yet many organisations still patch in weeks, not hours.
West Africa: SWIFT environments and core banking applications have been compromised. Fintechs breached through weak Application Programming Interfaces (APIs). The Central Bank framework has improved postures, but compliance is not resilience and new products launch far faster than security reviews.
East Africa: Major digital platforms serving millions have gone offline. Financial institutions face persistent attacks on core systems and mobile lending apps. Our Threat Intelligence has observed actors mapping Kenyan financial APIs the kind of reconnaissance that Mythos-class AI compresses from weeks to hours.
Now imagine these same adversaries equipped with AI. That's not a warning about tomorrow. That's the reality we're already walking into.
Why Africa is uniquely exposed
The threat landscape here isn't just evolving, it's structurally exposed. Four realities make this urgent:
These four realities don't just add up. They multiply each other and AI-equipped adversaries will exploit every one of them.
The real question has changed
Here's where leadership turns into action:
Know what you're defending
Build real-time visibility of critical systems, data, identities and third parties. Focus first where a breach would be catastrophic.
Use the attacker's tools first
Deploy AI-powered vulnerability discovery against your own environment. For in-house development, embed security testiong across development lifecycle.
Automate your response
Automate containment. Isolate systems, tighten identity controls, increase detection sensitivity and containment before a human has to make the call.
Nail the fundamentals
Risk-based patching, universal MFA, Zero Trust, segmentation, egress filtering these are your blast-radius limiters. They're non-negotiable.
Plan for breach
Assume a significant breach within two years. Test your crisis response against AI-speed scenarios. If your tabletop assumes 72 hours, redesign it for 72 minutes.
Reframe the board conversation
The question for directors is no longer "Are we compliant?" It's "How fast can we contain damage and what level of disruption can we tolerate?"
What this means for boards and senior leadership
Cyber risk has quietly evolved beyond technology. It's now a business-wide concern requiring board-level visibility, ownership and strategic direction.
The priorities have shifted decisively: speed of remediation, operational resilience and recovery at scale.
Boards need to understand their organisation's true exposure particularly where it intersects critical operations. They need confidence their teams can patch quickly, contain effectively and recover from simultaneous zero-day incidents without losing the business.
Six questions every board must ask today:
- What is our 'Minimum Viable Company' and can we recover it during a major cyber incident?
- How quickly can we deploy critical patches when time is measured in hours, not weeks?
- How resilient are we if multiple zero-days are exploited simultaneously?
- Can we detect, isolate and recover quickly or does a single breach cascade into operational failure?
- How are we using AI to strengthen defence and accelerate response?
- Where do supplier or platform dependencies create concentration risk and what's our fallback?
PwC One Cyber, built for this moment
We created One Cyber because we saw this shift coming: AI-enabled threats, expanding attack surfaces and the urgent need to move from prevention to resilience.
One Cyber is a movement. We bring together PwC's expertise as one integrated team, operating shoulder-to-shoulder with you from the Boardroom to the Security Operations Centre. Together, we form a community of defenders, building cyber defences that safeguard not only your organisation, but the fabric of our society.
Across Africa, our One Cyber practice works with leadership teams to:
Quantify exposure
AI-accelerated assessments identifying exploitable vulnerabilities and unpatched zero-day risk
Close gaps at speed
Automated containment, agent-driven security and battle-tested crisis response.
Strengthen the base
Zero Trust, segmentation and IAM designed for hybrid African enterprise realities.
Govern the response
Alignment with frameworks and standards across continental regulatory landscapes.
Leverage Global Threat Intelligence
Continuous monitoring of threat actors targeting African markets, delivering real-time awareness to leadership.
The bottom line
This is no longer only about protection. It's about resilience: the ability to withstand, contain and recover in a world where advanced cyber capabilities grow faster, cheaper and more scalable by the day with power of AI. The machine sees everything now. The question is whether you see yourself clearly enough to act.
The firms that move now will outperform those that delay. We're ready when you are.
Sources: PwC Global Threat Intelligence; publicly reported incidents across South Africa, Nigeria and Kenya. PwC global perspective - "When Every Weakness Is Visible". Anthropic Claude Security Public Beta announcement. https://claude.com/blog/claude-security-public-beta (April 2026)
Contact us
Vikas Sharma
Africa Cyber Leader & Regional Consulting & Risk Services (C&RS) Leader, PwC Mauritius
Tel: +230 404 5015
