Nigeria does not have a tooling problem so much as an architecture problem. SIEM, EDR, and a retainer with a well-known logo are frequently present. A named list of crown jewels, an identity model, and a night desk that knows which alerts matter — those are frequently not.
Preemptive cybersecurity is the unglamorous sequence: know what must not fall, shrink who can touch it, instrument the paths an adversary actually uses, and rehearse the response until it is boring. The SOC then has a job. Without that sequence, the SOC has a hobby.
The mailbox is still the front door
For a large number of startups and organisations, the incident will begin as email. Identity will be the blast radius. Flat networks will be the accelerant. If your programme does not start there, it is not a programme for this country in this decade — it is a product tour.
Evidence, not atmosphere
Boards and operators do not need a heat map of global threat actors. They need to know whether privileged accounts are inventoried, whether backups can be restored without the primary domain, and whether anyone has ever run the 2 a.m. playbook to completion.
We design programmes that produce those answers. Tools are purchased last, against use-cases, or not at all.
Related practices