Abdulkarim [7] defined cybercrime as the unauthorized use, access, modification and destruction of hardware, software, data, or network resources; unauthorized release of information; unauthorized copying of software; denying an end-user access to his/her hardware, software, data or network resources; using or conspiring to use computer resources to obtain information or tangible property illegally. Adesina[8] further defined cybercrimes as crimes committed using the internet through the medium of networked computers, telephones, and other Information and Communications Technology (ICT) equipment. It encourages all illegal activities perpetrated by one or more people referred to as scammers, hackers, internet fraudsters. Cybercrimes encompass a range of illegal activities that compromise the confidentiality, integrity, and availability of data and computer systems. These activities include unauthorized access to computer systems, illegal data interception, data interference (destroying, altering, deteriorating, or suppressing data), system interference (obstructing the proper operation of a computer or other device), fraud, identity theft, and forgery.

Additional categories of cybercrimes are content-related and include the creation, offering, distribution, acquisition, and possession of online content that is illegal by national laws. Examples of such content include online child sexual abuse, material supporting terrorist acts, extremist content (material encouraging hate, violence, or acts of terrorism), and cyberbullying (using technology to engage in offensive, menacing, or harassing behavior). To ensure internet safety and security, cybercrime is a component of a larger cybersecurity strategy [6].

Ribadu[10]identified the nature of cybercrime, which are Computer and internet fraud, mail scams, credit card fraud, Bank Verification Number (BVN) scams, Automated Teller Machine (ATM) scams, bankruptcy fraud, insurance fraud, government fraud, tax evasion, financial fraud, securities fraud, insider trading, bribery, copycat website, cyber plagiarism, kickbacks, counterfeiting, laundering, embezzlement, as well as economic and copyright/trade secret theft, websites cloning, financial fraud, identity theft, cyber-pornography, cyber-harassment, drug trafficking deals, fraudulent electronic mails, cyber laundering and virus/worms/trojans.

The term cyber security refers to the set of instruments, regulations, rules, risk management strategies, activities, training, best practices, guarantees, and technology that may be employed to safeguard an organization and the environment, as well as the assets of its users.

As a result of cybercrimes, organizational, legal, policy, and technological components are all included in cyber security governance measures[9]. Thousands of cyber-attacks are being made worldwide on internet users. Cyber-attacks are becoming incredibly common and costly for economies, enterprises, organizations, and other infrastructure-related institutions, in addition to individual individuals. 91% of the more than 430 million new malware samples that symantec[10] found in 2016 resulted from phishing attacks.

People are often acknowledged to be the weakest link in cyber security. The prevailing belief among most system security firms is that the human element represents the weakest link in cyber security. In actuality, people are becoming the primary target of cybercriminals rather than equipment. Internet users increased from 2 billion in 2015 to 3.8 billion in 2017 [11]. Cyber Security Ventures [12] projects that by 2022, there will be 6 billion internet users worldwide, and by 2030, there will be over 7.5 billion. With so many more people using the internet, there is cause for worry over the vulnerabilities and new risks that those with ideological motivations may use to damage people and further their political and social objectives.

Nonetheless, a dearth of empirical studies constrains our understanding of the variables influencing cyber-attackers' behavior. According to Sandeep [13], the relationship between humans and computers is characterized by a complex interplay of social, psychological, technological, and environmental elements that operate along an organizational internality and externality continuum rather than a straightforward process. Many theories have developed on the subject of criminology to explain why crimes happen, why some people act in deviant ways while others do not, and how to anticipate the behaviors and practices of future crimes[14]. Some selected theories on cybercrime will be explored in the next section.

This hypothesis, which Jaishankar [15] developed, contends that motivated offenders, appropriate targets, and the lack of qualified guardians are the three main factors that determine the likelihood of victimization, with most victims exhibiting recurrent and predictable behavio. The target is something that the motivated offender values (credit card information, for example), the competent guardian is someone or something that prevents the offender from obtaining the target, and the motivated offender is someone who is prepared to commit a crime if the proper chance arises.

This theory covers four main areas: imitation, definitions, differential reinforcement, and differential association. It is specifically used to explain a wide range of criminal behaviors. The hypothesis supports the notion that those who associate with criminals (deviant peers) get the motivation and abilities to commit crimes. Research suggests that this approach might assist in clarifying the problems associated with software piracy and cybercrime. people who hang out with peers who pirate software pick up on the illegal behavior and eventually adopt it themselves.

The social learning hypothesis explains software piracy and other cybercrimes because it may account for the justifications, abilities, and behaviors that cybercriminals reinforce through their interactions with and observing others[18]. Understanding the motivations of delinquent peers and their roles in the context of various cybercrimes is, thus, the central notion of this theory.

By altering the environment to raise the risk to the offender while lowering the possible benefit of committing the crime, the situational crime prevention theory aims to prevent certain types of crimes[17]. Unlike other criminology theories, this theory does not speculate why the criminal committed the crime. Instead, it usually focuses more on lowering the opportunity for crime. This idea is implemented by encrypting sensitive data, putting access control measures in place, protecting off-site data, running background checks on personnel, and prohibiting illegal computer installations. Applying Situational Crime Prevention Theory decreases cyberstalking and other online victimization crimes.

A combination of ideas is needed to compensate for the gaps in our understanding of criminal behavior, as no one explanation can fully explain it. However, whereas criminological theory in the physical world has a long history, marked by various contributions, paradigm changes, and progress, studies that explain digital and electronic crime, as well as the success of information security, remain comparatively underdeveloped. Cybercrime is rising throughout Africa, threatening nations' economic and social development efforts. While vicious cybercriminals like hackers utilize cyber vulnerabilities to enter and damage vital systems for financial gain or to hold people hostage, cybercrime, cyber espionage, cyber terrorism, and cyber warfare are all emerging forms of cybercrime that constitute a threat to African countries[16]. Many have attempted to hide this under various pretenses, such as ordinary system updates or glitches. Only when they begin to involve the legal system will cybercriminals come forward and the public stakeholders be made aware of the enterprise's breach of truth?

This is not unique to African Enterprise; in May 2021, for example, there was a ransomware assault in which an American oil corporation was kidnapped and forced to pay a hefty ransom. It was initially referred to as a "System Outage." Additionally, the the following offenses as cybercrimes as of a year ago:

I. Willful access to any computer system, in whole or in part, without authorization.

II. The deliberate, illegal eavesdropping of private computer data communications.

III. Among other things, purposeful destruction, erasure, degradation, change, or suppression of computer data without authorization.

IV. Willful and substantial interference with a computer system's ability to operate by the entry, transmission, destruction, deletion, deterioration, alteration, or suppression of computer data.

V. The creation, marketing, acquisition for use, importation, or distribution of equipment intended to carry out any of the aforementioned offenses or [i.e., obtaining] passwords or other such information needed to gain access to computer systems to carry out any of the aforementioned offenses.

To identify vulnerabilities and create mitigation methods that work, it is imperative to assess cyber security awareness in African businesses while also knowing the present status of cyber security awareness among African organizations. Many African businesses, especially smaller ones, may be underestimating the cyber hazards they face while being aware of the consequences of cybercrime. Studies indicate a deficiency in knowledge concerning the many types of cyber-attacks, including ransomware assaults, malware invasions, and phishing schemes[20]. This lack of knowledge frequently results in insufficient funding for cyber security and a delusion of security, leaving them vulnerable to security breaches. Determining vulnerabilities and creating efficient mitigation methods need an understanding of the present cyber security knowledge among African organizations. Different awareness levels in Africa are explored in detail below.

Internal vs. external threats Some businesses may exclusively focus on external dangers such as malware or hackers. On the other hand, insider threats from irate co-workers or unintentional human mistakes might be just as harmful[25]. Evaluating their awareness of internal vulnerabilities and implementing security procedures to fix them is essential.

The CyberSecurity Exposure Index (CEI) identifies the nations least and most impacted by cybercrime. It is a poll conducted regularly across 108 countries on all continents (Europe, America, Asia-Pacific, and Africa). Africa is the continent most vulnerable to cyber security attacks, whilst Europe is the least vulnerable [33]. The nations with the least exposure to cybercrime include Finland, Denmark, Luxembourg, Australia, and Estonia. In contrast, all African nations are extremely vulnerable to cybercrime, as no single nation on the continent is listed among the nations with the lowest cyber security exposure worldwide. The countries with the greatest cyber security risks include Afghanistan, Palestine, Ethiopia, Burma, and Venezuela. Ethiopia has Africa's greatest cyber security danger, followed by Tanzania, Zimbabwe, Algeria, and Cameroon. Namibia is the country in Africa with the least exposure to cyber security. This, as of late in 2024, is not implausible. A bank in Ethiopia lost $40 million due to a system glitch [22], [23]. Things are only worsening as Tanzanian commercial banks report an 84% rise in cybercrime in Q4 2023. And Nigeria is indeed not left out, as there is a 2024 revelation of diverted ₦40 billion ($29 million) unnoticed for almost 2 years [22], [23].

Mauritius leads the list of African nations most committed to cyber security, followed by South Africa, Egypt, Kenya, Nigeria, Tunisia, and Uganda. Tables 1-3 presented statistical data on the countries most vulnerable to cybercrime on a regional and global scale and the ranking of African nations. It's important to remember that this ranking was published before Flutterwave, which, as of March 2024, was the most valuable startup in Africa. Patricia, another significant operation in Nigeria, lost $2 million to cybercriminals in Africa's rapidly developing fintech capital [24]. While Flutterwave, with a major operation in Nigeria, lost ₦19 billion (about $24 million) in February 2024 and another ₦11 billion ($7 million) security breach in May 2024 [22], [23]. According to Table 3, the United States is rated first in the world, followed by Saudi Arabia and the United Kingdom, which are placed second [25].

In addition, Mauritius came in first in Africa but 17th globally. Ghana came in second in Africa, as Table 4 shows. Egypt came in second. Even though African enterprises are seeing enormous growth in innovation, technology, and market development, Table 3 review by Larnyohdemonstrates how less informed the region's enterprises are of changes and security measures needed to safeguard themselves [25]. Many African nations spend too little on cyber security because of a lack of trained labor, high unemployment rates, inequality and poverty, and high crime rates [26]. Businesses usually lack the funds to invest in cyber security protection, even though many emerging nations view it as essential. This restricts their capacity to put policies in place to stop and lessen sophisticated cyber threats [27].

The cyber security risks that African businesses must contend with are growing along with the continent's digital ecosystem. Despite the enormous potential for economic growth, several obstacles prevent the adoption of effective cybersecurity solutions. Key issues militating against effective cyber security measures in African businesses are:

While it's important to recognize the issues facing African businesses in cybersecurity, there are also certainties for development and innovation. Businesses may access a more secure digital environment and enjoy several advantages by removing these issues, and a small number of businesses around the continent are already seizing the certainties.

Cost of cyber-attacks on African businesses: It was estimated in Serianu's[27] report that a whooping sum of $10 billion was incurred in 2022 on cybercrime costs in Africa. In addition to the huge cost incurred, there are 20,000 certified cybersecurity professionals[27], which seems inadequate for the United States, which has over 1.3 million certified cybersecurity professionals[28].

This implies that if educational institutions and government agencies embark on processes to train and graduate cyber security experts, the huge cost incurred on cybercrime cost will be minimal.

Based on the literature, the following are the advantages of having improved cyber security:

I. Improved reputation and consumer trust: vigorous cyber security procedures help to safeguard client information, which fosters loyalty and trust. This enhances a significant competitive edge in the online market.

II. Business financial stability: effective cyber security measures help prevent expensive data breaches and cyber-attacks. This reduces the likelihood of financial loss.

III. Enhanced operational effectiveness: employee knowledge of cyber security and streamlined security procedures can result in fewer interruptions and higher operational effectiveness.