JOHANNESBURG – Zimbabwean companies face growing financial and operational risks from cybercrime as digital payments, cloud computing and remote working expand, prompting calls for corporate boards to take direct responsibility for cyber security rather than leaving it entirely to technology departments.
Lorreta Songola, Vice President and Chief Executive Officer of Liquid Intelligent Technologies Zimbabwe, said cyber resilience should receive the same level of boardroom scrutiny as financial performance, operational stability and reputational risk.
The warning comes as Zimbabwe’s economy becomes increasingly dependent on interconnected digital infrastructure, including mobile money services, electronic banking platforms and payment networks that support everyday commercial transactions.
Songola said the rapid adoption of digital technologies had increased the exposure of businesses to sophisticated attacks, including phishing, digital extortion and business email compromise.
“Cyber resilience, like financial or reputational resilience, is ultimately a governance responsibility,” Songola said in a commentary examining corporate cyber security preparedness.
She argued that company directors do not need specialist technical qualifications but must understand the potential financial consequences of security failures and ensure that appropriate safeguards are in place.
The issue has become particularly important as cybercriminals increasingly exploit weaknesses in corporate systems, employees and third-party service providers.
An African cyberthreat assessment published by Interpol identifies growing risks from online fraud, ransomware and other forms of cybercrime across the continent, reinforcing concerns about the vulnerability of businesses and public institutions.
For Zimbabwe, a major disruption affecting payment infrastructure could have consequences extending beyond individual companies.
Systems such as Zimswitch, mobile money networks and real-time gross settlement platforms have become integral to the movement of funds between businesses, financial institutions and consumers.
An extended interruption could affect payments, commercial activity and confidence in digital financial services.
Songola said compliance with Zimbabwe’s Cyber and Data Protection Act and relevant regulatory obligations should be regarded as a minimum requirement rather than sufficient protection against cyberattacks.
She urged corporate boards to establish clear cyber risk policies, regularly review security preparedness and ensure that management teams have procedures for responding to incidents.
The first 24 hours following a cyberattack can be particularly important in determining the extent of financial losses, operational disruption and reputational damage.
Companies should therefore conduct simulated cyber incidents, establish clear reporting channels and ensure that senior executives understand their responsibilities before an actual breach occurs.
Third-party relationships represent another area of concern.
Suppliers, contractors and technology providers frequently have access to sensitive corporate information and interconnected systems, creating potential vulnerabilities beyond an organisation’s direct control.
Songola said businesses should regularly assess the security standards of external partners and maintain appropriate safeguards over access to critical systems.
Human error also remains a significant weakness, particularly as criminals use increasingly convincing messages to impersonate executives, financial officers and trusted commercial partners.
She called for stronger employee awareness programmes and workplace cultures that encourage staff to report suspicious activity promptly.
Liquid Intelligent Technologies, part of Cassava Technologies, is positioning its cyber security services around growing corporate demand for continuous monitoring, threat intelligence and incident response capabilities.
Its Secure360 offering is designed to provide businesses with greater visibility over digital systems and improve their ability to detect and respond to threats.
However, technology investment alone cannot eliminate cyber risk. Effective protection also depends on management accountability, employee training, operational preparedness and independent oversight.
For Zimbabwean businesses already facing pressure from operating costs and limited access to capital, additional cyber security expenditure presents a financial challenge.
Yet the potential costs of a major breach, including lost revenue, disrupted services, recovery expenses and reputational damage, could outweigh the investment required to strengthen defences.
Songola said collaboration between businesses, regulators, technology providers and cyber security organisations would be essential as attacks increasingly cross national and institutional boundaries.
As Zimbabwe’s digital economy expands, cyber security is becoming more than an information technology concern.
For company directors, the ability to prevent, withstand and recover from digital attacks is emerging as an important measure of corporate governance and long-term business resilience.
