By Simpson Global Media News Desk
DATE OF EVENT: 27–28 October 2026
TIME: Conference scheduled from 8:00 a.m. to 5:00 p.m. on 27 October; the exact time of the NCC warning was not confirmed
LOCATION/VENUE: Abuja Continental Hotel, Abuja, Federal Capital Territory, Nigeria
REPORT/PUBLICATION DATE: 28 October 2026
MONTH AND YEAR: October 2026
EVENT STATUS: The International Cybersecurity Conference was scheduled for 27–28 October 2026.
NCC Warns of Growing AI-Driven Cyber Threats
Nigeria’s telecommunications regulator has warned that artificial intelligence-powered cyberattacks pose growing risks to the country’s telecommunications networks, banking systems and national security, urging operators to strengthen their defences as digital services become increasingly interconnected.
The Nigerian Communications Commission (NCC) issued the warning through its Executive Vice-Chairman, Dr Aminu Maida, during the second International Cybersecurity Conference in Abuja on Tuesday, 27 October 2026. Maida was represented at the event by the commission’s Executive Commissioner for Technical Services, Sunday Abraham Oshadami.
According to the NCC, cybercriminals are increasingly using artificial intelligence to personalise phishing messages, automate attempts to steal login credentials, create convincing fake audio and video, and modify malicious software to evade conventional security tools.
The commission said telecommunications networks have become central to Nigeria’s digital economy because they support banking transactions, business operations, public services and everyday communications. A successful attack on a major network could therefore affect organisations and customers beyond the telecommunications industry.
The warning was delivered as government officials, cybersecurity specialists, technology companies and lawmakers gathered in Abuja to discuss how Nigeria can improve its ability to prevent, withstand and recover from cyber incidents.
The conference, held under the theme Cyber Resilience in the Age of AI: Defending Minds, Networks and Nations, also examined the need for stronger coordination between regulators, telecommunications operators, financial institutions and law-enforcement agencies.
The National Information Technology Development Agency (NITDA) said Nigeria was working to strengthen its cybersecurity framework and review its legal and institutional responses to emerging threats. The Federal Ministry of Justice also highlighted proposed legal reforms intended to improve cybercrime investigations and prosecutions while protecting fundamental rights.
The developments underline a growing challenge for Nigeria: protecting an expanding digital economy against attacks that can target both technology systems and the people who use them.
How Artificial Intelligence Is Changing Cybercrime
Artificial intelligence has legitimate uses across business, communications, research, public administration and cybersecurity. However, the same technology can also be misused to make fraudulent activity more convincing, scalable and difficult to detect.
One major concern is AI-assisted phishing. In conventional phishing attacks, criminals send deceptive messages designed to persuade recipients to disclose passwords, financial information or other sensitive data. AI tools can help attackers tailor these messages to a particular person, organisation or transaction.
A message that appears to refer accurately to a business relationship or an urgent financial request may be more likely to persuade its recipient to respond without checking its authenticity.
Another concern is the use of synthetic voices and videos. Criminals can use manipulated media to impersonate a company executive, public official, family member or other trusted person. Such material may be used to request money, obtain confidential information or encourage someone to approve an unauthorised transaction.
Automated credential attacks are also a concern. These involve repeated attempts to gain access to accounts using stolen, guessed or reused login details. Automation can increase the number of attempts criminals make, placing additional pressure on systems that rely on weak passwords or inadequate access controls.
The NCC also warned about malicious software capable of changing its behaviour to avoid detection. Such techniques can complicate security monitoring, although they do not make malware impossible to detect.
The regulator’s message was that conventional security measures may be insufficient if organisations fail to adapt their monitoring, authentication and incident-response systems to changing threats.
Why Telecommunications Networks Matter
Telecommunications infrastructure supports far more than telephone calls and internet browsing. It provides the connectivity required for digital payments, online banking, business communications, government services and many other activities.
When customers experience a network disruption, the effects can extend to businesses that depend on mobile connectivity to receive payments, communicate with suppliers or access online platforms.
Financial institutions also rely on telecommunications systems to connect customers with digital services. Although banks and payment providers operate their own security systems, their operations can be affected when supporting communications infrastructure experiences a major incident.
The same interdependence applies to public services, logistics, digital commerce and emergency communications.
The NCC has described telecommunications infrastructure as Critical National Information Infrastructure, reflecting its importance to the country’s economic activity and national security.
Protecting these networks requires more than preventing unauthorised access. Operators must also be able to identify suspicious activity, contain incidents, restore services and communicate effectively with relevant authorities when a disruption occurs.
The regulator warned that a cyberattack against one operator could have consequences for other sectors that depend on its services. The level of disruption would depend on the nature of the attack, the systems affected and the operator’s ability to respond.
The broader lesson is that cybersecurity cannot be treated as an isolated technical issue within an individual company. It is also a matter of business continuity, consumer protection and national resilience.
NCC Calls for Zero-Trust Security
Maida urged telecommunications operators to adopt stronger security architectures, including zero-trust systems, and to regularly assess the AI technologies incorporated into their networks.
Zero trust is a security approach that does not automatically treat a user, device or connection as trustworthy simply because it is already inside an organisation’s network. Access requests are assessed according to identity, permissions, context and other security requirements.
When properly implemented, this approach can help limit the damage caused by compromised accounts or devices.
For example, an employee’s login details should not automatically provide unrestricted access to every system within a telecommunications company. Access can instead be limited to the resources required for the employee’s role, with additional checks for sensitive operations.
Organisations can also use multi-factor authentication, network segmentation, privileged-access controls and continuous monitoring to reduce the risk of unauthorised access.
However, zero trust is not a single product that guarantees protection. It requires appropriate architecture, accurate identity management, reliable monitoring and consistent enforcement of access policies.
The NCC also called for regular audits of AI models used in network operations. Such reviews can help identify weaknesses, unauthorised changes and vulnerabilities that might allow attackers to manipulate system behaviour.
Operators will need to establish who can modify critical systems, how changes are approved and how suspicious activity is investigated.
NCC Cybersecurity Response Team and Resilience Framework
The commission said it had established a Computer Security Incident Response Team, known as NCC-CSIRT, to monitor threats, support intelligence sharing and strengthen incident reporting across the telecommunications sector.
An incident-response team helps organisations coordinate their reaction to cyber events. Its responsibilities may include assessing reports, sharing technical indicators of compromise, supporting investigations and helping affected organisations understand the scope of an incident.
Rapid information-sharing can be important because the same criminal group may target several organisations using similar methods. Information about a threat detected by one operator may help another identify suspicious activity before it causes damage.
The NCC also said it had introduced a Cyber Resilience Framework to establish common security expectations for licensed telecommunications operators.
A common framework can help organisations assess their preparedness and identify weaknesses that need attention. It can also make it easier for regulators to evaluate whether operators have appropriate security policies, incident-response arrangements and recovery plans.
The effectiveness of such a framework depends on implementation, monitoring and enforcement. Published standards must be translated into operational practices, and organisations need to demonstrate that their controls work under realistic conditions.
Operators should also test their recovery procedures rather than assume that written plans will be sufficient during a major incident.
The NCC’s initiatives indicate that the regulator wants the sector to move beyond prevention alone and strengthen its capacity to maintain or restore essential services during an attack.
NITDA Highlights Human Vulnerability
NITDA Director-General Kashifu Inuwa Abdullahi said cybercriminals were increasingly exploiting human weaknesses rather than relying exclusively on technical vulnerabilities.
His remarks highlighted the role of social engineering, in which attackers manipulate people into disclosing information, transferring money, approving access or taking other actions that compromise security.
AI-generated content can make social engineering more persuasive. A fake voice message or video may appear to come from a trusted individual, while a carefully tailored email can create the impression that a request is legitimate.
This makes public awareness and staff training important components of cybersecurity.
Employees should know how to verify unusual payment requests, confirm changes to bank details and report suspicious communications. Organisations should also establish procedures that require independent verification for high-risk transactions.
For individuals, a familiar name or recognisable voice should not be treated as conclusive proof of identity. Requests involving money, passwords, one-time verification codes or confidential information should be checked through a separate, trusted communication channel.
NITDA said the growing use of AI-generated voices, images and videos made it increasingly important to help citizens distinguish authentic information from manipulated material.
The agency’s position is that cybersecurity must protect people as well as networks. Technical defences may be weakened if attackers can persuade employees or customers to bypass them voluntarily.
Government Reviews Cybercrime Legislation
The conference also addressed the legal challenges created by emerging forms of cybercrime.
Abdullahi said NITDA was working with the Office of the National Security Adviser and the National Assembly on a review of Nigeria’s cybercrime legislation and on strengthening the country’s institutional capacity to respond to digital threats.
Attorney-General of the Federation Lateef Fagbemi, represented at the conference by the Director of Public Prosecutions, Rotimi Iseoluwa Oyedepo, said the Ministry of Justice was developing legislative reforms to address evolving cybercrime risks.
The proposed reforms are intended to improve the handling and preservation of electronic evidence, support investigations and prosecutions, and respond to offences involving digital technologies.
Electronic evidence can include transaction records, digital communications, access logs, system records and other information relevant to an investigation. Such evidence must be collected and preserved appropriately if it is to support a prosecution.
The government also faces the challenge of ensuring that stronger cybercrime laws protect legitimate rights and activities. Measures intended to improve security must operate within the rule of law and provide appropriate safeguards against misuse.
The announcement concerned work on proposed reforms. It should not be interpreted as confirmation that a new law has already been enacted.
Any legislative changes will need to follow the relevant lawmaking process, with the final provisions determining the powers and responsibilities of investigative and prosecuting authorities.
Proposal for a National Cyber Resilience Index
Senator Shuaib Afolabi Salisu, chairman of the Senate Committee on ICT and Cybersecurity, proposed developing a national cyber resilience index to assess the preparedness of organisations against cyber threats.
Such an index could provide a structured way to measure how well organisations protect their systems, detect incidents, respond to attacks and restore services.
A useful assessment could examine whether organisations have documented security policies, conduct regular testing, maintain backups, train staff, report incidents and review the effectiveness of their controls.
The value of an index would depend on the quality of its criteria and how consistently they are applied. Organisations in different sectors face different risks, so a framework would need to account for differences between telecommunications operators, financial institutions, government agencies and smaller businesses.
A national assessment could help identify gaps and direct resources towards areas where security improvements are most needed.
However, measurement alone does not improve security. Organisations would need clear expectations, practical guidance and appropriate incentives to address weaknesses identified by an assessment.
The proposal reflects a broader concern that Nigeria needs a more coordinated approach to cybersecurity across institutions rather than relying on separate efforts that may not share information effectively.
What the Warning Means for Nigerian Businesses
Businesses increasingly rely on digital platforms to communicate with customers, process transactions, manage staff and store records. This dependence makes cybersecurity relevant to organisations of every size.
Large companies may have dedicated security teams and specialised technology, but smaller businesses can also become targets because they may have limited resources for monitoring and incident response.
A basic security programme should begin with identifying critical systems and the information that would cause the greatest harm if compromised.
Businesses should then review who can access those systems, require strong authentication, install security updates and maintain backups that are protected from unauthorised alteration.
Staff training should cover common forms of fraud, including fake invoices, impersonation attempts and messages designed to create urgency.
Organisations should also prepare an incident-response plan that identifies who must be contacted, how affected systems will be isolated and how operations will be restored.
Where appropriate, businesses should work with qualified cybersecurity professionals to assess vulnerabilities and test their response arrangements.
The NCC’s warning is a reminder that cyber incidents can create financial and operational consequences even when they do not result in the permanent loss of data. Disruptions can affect customer confidence, delay transactions and interrupt essential services.
Practical Steps for Individuals
Members of the public can reduce some common cyber risks by adopting a few consistent habits.
Verify unusual requests for money or confidential information through a separate, trusted channel.
Avoid sharing passwords and one-time verification codes with anyone.
Use strong, unique passwords and a password manager where possible.
Enable multi-factor authentication on important accounts.
Keep phones, computers, applications and routers updated.
Be cautious about unexpected links, attachments and requests to install unfamiliar software.
Confirm the identity of callers who claim to represent banks, telecommunications companies or government agencies.
Contact the relevant institution through its official website or published customer-service channel if a message appears suspicious.
Report suspected fraud promptly to the appropriate institution and authorities.
These precautions cannot eliminate every risk, but they can reduce the likelihood that an attacker will gain access through deception or weak account security.
People should also be aware that AI-generated audio and video can be misleading. When a request appears unusual or urgent, independent verification is more reliable than judging authenticity from a voice or image alone.
What Happens Next?
The next stage will involve the implementation of the NCC’s Cyber Resilience Framework, continued operation of the commission’s incident-response team and further engagement between government agencies on cybercrime legislation.
Telecommunications operators will need to demonstrate that their security systems are being reviewed and that they can respond effectively to incidents. The regulator’s ability to monitor compliance and encourage timely reporting will be important to assessing progress.
The proposed legal reforms will also require further clarification through the relevant legislative process. Until the final provisions are published and enacted, the public should distinguish between proposals and existing legal requirements.
The proposed national cyber resilience index could provide another mechanism for measuring preparedness if the government and relevant institutions develop clear criteria and a transparent assessment process.
For consumers and businesses, the warning reinforces the importance of basic security practices, verification procedures and timely software updates.
The wider objective is to build a digital environment in which essential services can continue operating even when attacks occur, and where individuals and organisations know how to respond when suspicious activity is detected.
Conclusion
Nigeria’s warning about AI-powered cyberattacks reflects the increasing importance of protecting telecommunications networks and the digital services that depend on them.
The NCC has called on operators to adopt zero-trust security, audit AI systems and improve their ability to recover from attacks. NITDA has emphasised public awareness and the need to protect people from AI-enabled deception, while the Ministry of Justice has outlined work on proposed legislative reforms.
The establishment of an incident-response team and a sector-wide resilience framework provides a basis for improving coordination, but the effectiveness of these measures will depend on implementation, testing and accountability.
Cybersecurity is not solely a responsibility for technology companies or government agencies. Businesses must protect their systems, workers need to recognise suspicious requests, and individuals should verify unexpected communications before sharing sensitive information.
As AI tools become more widely used by both defenders and criminals, Nigeria’s challenge will be to strengthen its technical safeguards without weakening the legal protections that govern digital activity.
The ultimate measure of progress will be whether networks become more resilient, cyber incidents are handled more effectively and Nigerians can use digital services with greater confidence.
Comments
Post a Comment