FEATURE unusual behaviour, enrich alerts with contextual information and accelerate incident investigations.
For organisations struggling with large volumes of security data, the most immediate benefit is the ability to distinguish genuine threats from routine activity.
Entonu says alert triage is among the most valuable applications.
“ For most security teams, the immediate value is triage. They already have enormous amounts of security data, and the challenge is deciding what deserves attention first. AI can help correlate information, spot unusual behaviour and prioritise alerts so analysts spend less time working through noise.”
The need for these capabilities is particularly acute in Africa. Entonu cites research from a strategic cybersecurity vendor partner indicating that organisations across the region experienced an average of 3,335 cyberattacks per week in August 2026.
For security teams handling such volumes, reducing unnecessary investigations can free up valuable time for more serious incidents.
Sasha Slankamenac, Architect in the Office of the CTO and Practice Lead: AI at Dariel, sees considerable potential for AI to automate the investigative work that occupies much of an analyst’ s day.
“ An analyst can spend most of an hour gathering information before making a judgement call,” said Slankamenac.“ An agent can do a lot of that gathering, correlate the endpoint and identity logs, say, and give the analyst a summary with the evidence attached. It helps with triage as well, because obvious false positives can be closed off with the reason recorded, and related alerts get grouped into one incident.”
Beyond investigation, AI can also accelerate containment. When malicious activity is clearly identified, automated systems can isolate affected endpoints or block suspicious domains before an attack spreads.
However, the effectiveness of these capabilities depends on the quality of the underlying data, the accuracy of detection models and the controls governing automated responses.
Addressing Africa’ s cybersecurity skills gap
Africa’ s shortage of experienced cybersecurity professionals adds another dimension to the AI security race.
Organisations often struggle to recruit and retain specialists with expertise in threat detection, incident response, cloud security and advanced security operations.
AI offers a way to increase the productivity of existing teams by automating repetitive tasks and helping less experienced analysts access relevant information.
Fischer believes AI can help organisations overcome both resource constraints and gaps in specialist knowledge.
“ I think sometimes it can bridge the gap of not having enough hands to do something. It could also bridge a skills gap, if people aren’ t available to do certain pieces of work, or when research is needed for more information on specific vulnerabilities, issues or security topics. I think that’ s where AI can definitely help.”
Slankamenac similarly sees AI as a means of allowing experienced professionals to concentrate on more demanding work rather than eliminating the need for human expertise.
“ You still need experienced people deciding what the agent may do and checking its work, and handling whatever it escalates. Without them, nobody can really review what it’ s doing.”
Entonu also cautions against viewing automation as a complete solution to the talent shortage.
“ It does not create experienced security people. What it can do is take repetitive work away from them, help prioritise alerts and give analysts better information to work with.”
He points to managed security models as another option, particularly for organisations unable to build comprehensive security operations capabilities internally.
Westcon-Comstor’ s OneSOC, for example, provides partners with a vendor-agnostic, whitelabel SOC capability, combining automation with specialist human expertise.
The emerging model is therefore one of humanmachine collaboration, with AI handling routine investigations while security professionals retain responsibility for complex decisions and strategic oversight. •
Sasha Slankamenac, Architect in the Office of the CTO and Practice Lead: AI at Dariel
www. intelligentcio. com
INTELLIGENT CIO AFRICA
27