No Time to Lose: Why Military Strategy Holds the Key to Africa's AI Cyber Defence

Military strategists have long understood a simple truth: victory belongs to the side that can observe, orient, decide, and act faster than its adversary. Developed by US Air Force Colonel John Boyd, the Observe Orient, Decide, Act or OODA Loop transformed military thinking by demonstrating that speed of decision-making, rather than sheer force, determines success in fast-moving conflicts.

Today, that same principle has become one of the most valuable frameworks for cyber security.

Across Africa, organisations are confronting a new generation of AI-powered cyber threats that move at machine speed. From digital banking and telecommunications to government services and education, businesses are embracing artificial intelligence to accelerate innovation and improve efficiency. Unfortunately, cyber criminals are doing exactly the same. AI is enabling attackers to automate reconnaissance, launch highly convincing phishing campaigns, exploit vulnerabilities within hours of disclosure, and scale attacks at a pace that traditional security operations simply cannot match.

In this environment, cyber security is no longer just a technology challenge—it is an operational race. The organisations that can complete the OODA Loop faster than their adversaries will be the ones that successfully prevent attacks rather than respond to them.

The urgency of this challenge is particularly evident across Africa. Check Point Software's African Perspectives on Cyber Security Report 2025 found that organisations across the continent experience an average of 3,153 cyber attacks every week—approximately 60% higher than the global average of 1,963 attacks per organisation. Nigeria experiences more than 4,200 attacks per organisation each week, while South Africa, Kenya, and Morocco continue to see increasingly sophisticated attacks targeting critical infrastructure, financial services, telecommunications, and government systems. Traditional ransomware has evolved into data-leak extortion, identity has become the new security perimeter, and AI-generated deception is becoming commonplace across virtually every sector.

For Chief Information Security Officers (CISOs), this fundamentally changes the rules of engagement. Traditional security architectures built around static defences, fragmented point products, and lengthy response cycles were designed for an era when attackers moved more slowly. Against AI-driven adversaries, those approaches increasingly leave defenders reacting instead of anticipating.

This is where the OODA Loop provides a practical blueprint for modern cyber resilience.

Observe begins with comprehensive visibility across the entire digital estate. Security teams must understand what exists across networks, endpoints, cloud platforms, SaaS applications, identities and increasingly AI systems themselves. Visibility remains one of the greatest challenges facing African organisations as digital transformation expands the attack surface. The principle is straightforward: organisations cannot defend assets they cannot see. Only unified security architectures can deliver the consistent visibility required in today's hybrid, multi-cloud and AI-enabled environments.

Orient focuses on converting data into intelligence. Rather than drowning in alerts, security teams must understand which vulnerabilities represent genuine business risk and which require immediate attention. Artificial intelligence becomes an advantage here, helping defenders analyse enormous volumes of telemetry while prioritising the exposures that matter most. Continuous exposure management further strengthens this capability by making risk reduction an ongoing discipline rather than an occasional exercise.

Decide is increasingly a leadership responsibility. Modern CISOs have evolved beyond managing security technologies to managing enterprise risk. As organisations adopt AI assistants, large language models and autonomous agents, governance becomes just as important as technology. Security-by-design must become the default operating model, ensuring AI tools are deployed, monitored and governed from the outset rather than secured retrospectively.

Act is where preparation delivers results. Whether isolating compromised systems, patching vulnerabilities or blocking malicious activity, speed determines whether a threat becomes a security incident. Automation and AI-powered response capabilities now enable defenders to match the pace of AI-enabled attackers, transforming security operations from reactive response to proactive prevention.

This prevention-first approach is becoming increasingly important as AI introduces entirely new categories of enterprise risk. Many organisations are deploying AI applications faster than governance frameworks can keep pace. Shadow AI—the unauthorised use of AI tools by employees—has emerged as a significant concern. Check Point Research has found that approximately one in every 41 prompts submitted to generative AI tools carries a high risk of exposing sensitive information. Without appropriate governance, AI can quietly create new attack surfaces while increasing organisational risk.

However, AI should not be viewed solely as a threat. Used responsibly, it becomes one of the strongest defensive capabilities available. The most resilient organisations are already using AI to anticipate attacks, identify emerging risks and prevent threats before they can disrupt operations.

Africa's digital economy continues to accelerate rapidly. Mobile connectivity is expanding, governments are digitising public services and organisations across every industry are investing heavily in cloud computing and AI. These developments create enormous economic opportunities, but they also raise the stakes for cyber security.

For African CISOs, the lesson from military strategy has never been more relevant. Success in the AI era will not be determined by who acquires the most security technologies, but by who can observe, orient, decide and act faster than increasingly intelligent adversaries. Organisations that master this cycle will be best positioned to protect their customers, critical infrastructure and long-term growth. Those that continue relying on yesterday's security models risk falling behind in a threat landscape that reinvents itself every day. There is no time to lose.

By Fred Streefland, Global Field CISO, Check Point Software Technologies