Joshua Anthony
Ask most executives where cybersecurity sits in their budget and the answer is some version of insurance: a cost you carry so that a bad thing hopefully does not happen. It is an understandable framing, and it quietly guarantees underinvestment, because insurance is something you minimise. After fifteen years of securing banks, fintechs, education organisations, telecoms, public sector systems, airports and everything in between, we would put it differently. Security posture has become a commercial capability. It decides which deals you can win, which markets you can enter, and how fast you can move when something goes wrong. Companies that understand this are not spending on security to avoid losses. They are spending because it makes them a business others can safely depend on.
Security is now part of how you get bought
The clearest change of the past few years is where security questions show up: not after an incident, but inside procurement. Enterprise customers, banks and public sector bodies now send security questionnaires before contracts are signed. They ask how you handle data, who can access it, whether you have been independently assessed, and what happens when something fails. Weak answers do not trigger a difficult conversation. They quietly remove you from the shortlist, and you rarely find out that this is why.
We see this from both sides. As an ISO 27001 certified firm, we answer these questionnaires ourselves, and we help clients who suddenly face them because a large customer or international partner asked. The pattern is consistent: organisations with a genuine security programme turn the questionnaire around in days and treat it as a sales asset. Organisations without one lose weeks scrambling, and sometimes lose the deal. If your growth plan involves bigger customers, regulated industries or cross-border partnerships, your security posture is already part of your sales function, whether you have staffed it that way or not.
Regulators have stopped accepting good intentions
Data protection law across the region has matured from principle to enforcement. Tanzania’s Personal Data Protection Act, and its counterparts across African markets, require demonstrable controls: registration, documented processing, breach notification within fixed windows, and evidence that safeguards actually exist. Financial regulators go further, with central banks imposing specific security and reporting requirements on institutions and the fintechs connected to them.
The practical consequence is that “we take security seriously” is no longer an answer to anything. When a regulator or auditor asks, the acceptable response is documentation: what data you hold, where it lives, who accessed it, how you detected the incident, and when you reported it. Organisations that build this discipline before they need it treat regulatory engagement as routine. Organisations that improvise it during a breach add legal exposure to an already bad week.
The real cost of an incident is operational, not technical
Public discussion of breaches fixates on stolen data, but for most businesses the deeper damage is downtime and trust. A ransomware event does not just encrypt files; it stops invoicing, halts payments, and freezes the systems your staff need to do anything at all. For a bank’s agency network or a telecom’s revenue platform, hours of outage are directly measurable in money and much harder to measure in customer confidence, which does not return on the same schedule the systems do.
This is why response capability matters as much as prevention. No control set reduces the probability of an incident to zero. What separates a contained event from a crisis is whether the organisation can detect quickly, isolate what is affected, keep core operations running, and communicate credibly with customers and regulators while doing so. That capability is built and rehearsed in advance or it does not exist.
What a real programme looks like
The organisations that get strong outcomes are rarely the ones with the most tools. They are the ones that treat security as a programme with an owner, a budget and a rhythm, rather than a series of purchases made in response to headlines. In practice that means a handful of unglamorous things done consistently: knowing what systems and data you actually have, controlling who can access what, patching on a schedule instead of a shock, monitoring for the signals that precede incidents, testing defences with real assessments rather than assumptions, training the people attackers actually target, and having an incident plan that named individuals have rehearsed.
None of this requires enterprise scale. It requires ownership and sequence. A mid-sized organisation with modest tooling and genuine discipline is consistently harder to breach, and far faster to recover, than a large one with an expensive stack nobody has integrated.
The strategic reading
Attackers are opportunistic, and the honest economics of cybercrime are that most victims are not chosen, they are found: scanned, phished and tested at scale until something gives. In that environment, security posture works like fitness. It does not make you invulnerable, but it moves you out of the population where incidents are easy, and it determines how quickly you get back up when one lands anyway.
Framed that way, the budget question changes. The organisations treating security as a strategic programme are not buying protection from a hypothetical. They are buying eligibility for bigger contracts, smoother regulatory standing, faster recovery, and the kind of trust that has become a precondition for doing serious business at all.
If you want an honest read on where your organisation stands today, from posture assessment to building the programme itself, get in touch.
