Building Ethiopia’s Digital Resilience

Article 4: Ethiopia’s Biggest Cybersecurity Challenge May Not Be Technology: It Is Capacity

“A country can buy technology. Building the people and institutions capable of using, protecting and improving it takes much longer.”

In the previous article, we discussed why cybersecurity is everyone’s responsibility. INSA has a national leadership and oversight role. Critical infrastructure owners must protect the services they operate. Private companies provide expertise and innovation. Universities develop knowledge and future professionals. Professional associations help strengthen competence and ethics. Employees also have an important role in protecting the systems they use every day.

But defining these responsibilities raises another important question.

Do we have enough people with the right knowledge and experience to carry them out?

This may become one of the most important questions in implementing Ethiopia’s Critical Infrastructure Cybersecurity Proclamation No. 1426/2026.

Technology is certainly important. Organizations need secure networks, monitoring systems, identity management, backup solutions, security tools and many other technical capabilities. Critical infrastructure may also require highly specialized technologies.

However, technology alone cannot protect critical infrastructure.

• Someone must understand the risk.

• Someone must design the security architecture.

• Someone must configure the technology correctly.

• Someone must monitor what is happening.

• Someone must recognize unusual activity.

• Someone must respond when an incident occurs.

• Someone must investigate what happened.

• Someone must restore the service.

• Someone must audit whether the controls are working.

And someone at leadership level must understand the risk well enough to make the right decisions.

This is why Ethiopia’s cybersecurity challenge is not only a technology challenge. It is also a capacity challenge.

The proclamation itself recognizes that protecting critical infrastructure requires significant resources and national capability. Its foundation speaks about the need for reliable financial capacity, clear responsibilities and coordinated protection of critical infrastructure. The accompanying operational blueprint goes further by identifying areas such as competent cybersecurity professionals, training, awareness, audits, risk assessment and continuous capability development as important parts of implementation.

This is important because capacity is much broader than simply having cybersecurity specialists. A resilient country needs capability at several levels. It starts with leadership.

A senior manager does not need to know how to configure a firewall or investigate malware. But a senior manager responsible for critical infrastructure must understand what a major cyber incident could mean for the organization.

• Could operations stop?

• Could customers lose access to essential services?

• Could people's safety be affected?

• How quickly could the organization recover?

• What would happen if an important supplier became unavailable?

• What level of cyber risk is the organization accepting?

These are management questions, not only technical questions.

This is why cybersecurity awareness at board and executive level is so important. If leaders see cybersecurity only as an IT cost, investment will always compete unsuccessfully with other business priorities. If they understand that cybersecurity protects business continuity, public trust, financial stability and essential services, the discussion becomes very different.

The second level of capacity is professional expertise.

Critical infrastructure requires people with different cybersecurity skills. A security operations analyst needs different knowledge from a cybersecurity auditor. A cloud security architect needs different skills from someone protecting an industrial control system. An incident responder requires different experience from a governance and risk specialist.

Ethiopia therefore needs more than simply “cybersecurity professionals.” It needs different types of cybersecurity professionals. This includes people who understand security operations, network security, cloud security, identity and access management, secure software development, vulnerability management, digital forensics, incident response, risk management, business continuity and cybersecurity governance.

Critical infrastructure introduces another important area: operational technology and industrial control systems. Protecting a normal office environment is not necessarily the same as protecting electricity generation, industrial systems, transportation technology or other operational environments. In these areas, cybersecurity decisions can have physical consequences.

The country therefore needs specialists who understand both cybersecurity and the operational systems they are protecting. This expertise cannot be created overnight.

A person can complete a cybersecurity course and gain useful knowledge. But becoming an experienced security architect, auditor, incident responder or industrial cybersecurity specialist requires years of practical work.

That is why capacity building must be treated as a long-term national investment. Universities have an important role here. Cybersecurity education should not be separated from the real problems facing government and industry. Students need strong academic foundations, but they also need opportunities to understand real systems, real risks and real operational environments.

This creates an opportunity for stronger cooperation between universities, INSA, critical infrastructure organizations and the private sector. Universities can provide education and research. Industry can provide practical problems, internships, mentoring and real-world experience. Government can help identify national capability priorities. Professional associations can support continuous learning after formal education has ended.

This creates a path from education to experience, and from experience to professional capability. Professional certification can also support this development. Internationally recognized certifications can help professionals demonstrate knowledge in areas such as cybersecurity management, information systems auditing, security architecture, cloud security and technical security. But certification should not become the goal by itself.

A certificate can show that someone has studied and demonstrated certain knowledge. It does not automatically mean that the person has the experience needed to protect complex critical infrastructure. The strongest professionals combine education, certification, practical experience, professional judgement and continuous learning. That last part is particularly important. Cybersecurity knowledge becomes outdated quickly. New technologies appear. Organizations move services to cloud environments. Artificial intelligence changes both business operations and cyber threats. Attack methods change. Software supply chains become more complex. New vulnerabilities are discovered.

A professional who stops learning eventually becomes less effective. Capacity building therefore cannot be a one-time national training program. It must become a continuous process. The same principle applies to employees who are not cybersecurity professionals.

Most people working in a bank, hospital, government institution or telecommunications company will never become cybersecurity experts. They do not need to. But they need enough knowledge to understand the risks connected to their work.

• An employee should recognize suspicious communication.

• A manager should know how to report an incident.

• A software developer should understand secure development.

• A procurement professional should know that purchasing technology also creates cybersecurity risk.

• A project manager should understand that security requirements should be considered when a system is designed, not only after it has been built.

• Cybersecurity awareness therefore needs to become part of professional responsibility.

This is very different from asking employees to complete one online cybersecurity course every year and considering the problem solved.

Effective awareness should be connected to people's actual work. The cybersecurity training given to a hospital employee should reflect healthcare risks. Training for an energy engineer should reflect operational technology. Training for executives should focus on risk, accountability and continuity. Training for software developers should focus on secure development. Different responsibilities require different knowledge. The private sector can make a major contribution to building this capacity.

Ethiopia does not need every cybersecurity expert to work for government.

A healthy national cybersecurity ecosystem should include strong private cybersecurity companies capable of providing specialized services to government and critical infrastructure organizations.

This can also create an important economic opportunity. As Ethiopia invests in cybersecurity, demand will grow for auditors, consultants, security operations specialists, penetration testers, incident responders, cloud security specialists, trainers and many other professionals.

If this capability is developed locally, cybersecurity becomes not only a cost of protecting digital transformation but also an area for employment, entrepreneurship and professional development. However, growth must be accompanied by quality. Critical infrastructure cannot be the training ground for people who do not yet have the required competence.

This means Ethiopia will gradually need clear ways of determining who is qualified to perform sensitive cybersecurity work.

This is particularly important for cybersecurity audits and technical security assessments. An auditor or security assessor may receive access to network designs, vulnerabilities, security configurations, business processes and other highly sensitive information.

The question therefore cannot simply be:

• “Can this person perform the technical work?”

We must also ask:

• “Can this person be trusted?”

Competence and ethics must develop together.

This brings us to another important part of capacity building: institutions. Countries do not become cyber resilient simply because they have a few highly skilled individuals. People change jobs. Experts leave organizations. Technologies change. Knowledge therefore needs to become institutional. Organizations need documented processes, clear responsibilities, tested incident plans, professional development programs, knowledge sharing and succession planning. The objective should be to build organizations that remain capable even when individual people change.

The same principle applies nationally. INSA, universities, critical infrastructure owners, private companies and professional associations should gradually create an environment where cybersecurity knowledge is developed, shared and retained within the country.

This will take time. That should not be seen as failure.

No country developed a mature cybersecurity workforce in a few years. Ethiopia is building capability while its digital economy is also growing rapidly. The important issue is therefore not whether every capacity gap can be solved immediately.

The important issue is whether there is a clear and sustainable direction. We should continuously ask ourselves:

• Are we developing the skills that our critical infrastructure actually needs?

• Are universities and industry working closely enough?

• Are young professionals getting practical experience?

• Are experienced professionals continuously updating their knowledge?

• Do senior leaders understand cyber risk?

• Are we developing enough expertise outside the capital and across different sectors?

• Are we building local cybersecurity companies?

• Do we have enough specialists for areas such as cloud security, incident response and operational technology?

• And are the people performing sensitive security work technically competent, independent and ethically responsible?

These are capacity questions.

They are also national resilience questions. Ethiopia can purchase world-class cybersecurity technology. But technology will achieve very little if it is poorly configured, badly monitored, incorrectly audited or managed by leaders who do not understand the risks.

People make technology effective. Institutions make capability sustainable. And continuous learning keeps both relevant.

This is why capacity building should not be treated as a supporting activity of the Critical Infrastructure Cybersecurity Proclamation. It should be considered one of the foundations required for the proclamation to succeed.

As this capacity develops, however, Ethiopia will need a reliable way to answer another important question:

• How do we know that the security measures organizations put in place are actually working?

One of the main tools for answering that question is cybersecurity audit and independent assurance.

But audit itself carries significant responsibility. If it is performed without sufficient expertise, independence, confidentiality or professional ethics, it can become a compliance exercise or even create additional risk.

If it is done properly, it can become one of the strongest tools for building trust and continuously improving national resilience. That is where the next article will continue:

Article 5 — Cybersecurity Audit: Building Trust Rather Than Fear.