Q&A with Mustapha B. Mugisa on the State of Cybersecurity in Uganda
Cybersecurity isn’t just a technical issue-it’s a strategic one. Organizations are losing millions, reputations are being destroyed, and now, with the rise of AI, the stakes have never been higher. You’re already behind if you’re not thinking about cybersecurity as part of your overall strategy. Godfrey Ssenyonjo sat with Mustapha B Mugisa aka Mr Strategy to explain why organizations are so vulnerable, and more importantly, what needs to change. Enjoy the conversation:
Godfrey: How big is the problem with AI in cybercrime?
Mr Strategy: AI has flipped the script on cybercrime.
Hackers are no longer just people sitting behind keyboards- they’re deploying self-learning systems that can easily crack passwords, mimic human behavior, and even do it better, and create fake identities faster than your business can react. You know about the deepfakes. They are as good as the real thing!
For organizations, this is like playing chess against a machine that can think ten moves ahead while still deciding where to place your pawns. AI has made cybercrime “democratized” that is accessible even to the non-tech nerds, making it faster, smarter, and more scalable.
The strategy?
Don’t fight AI with spreadsheets- fight AI with better AI.
Use machine learning to predict attacks, identify patterns, and shut down vulnerabilities before exploiting them. It’s time to stop thinking of AI as a threat and start using it as your most powerful tool in the fight against cybercrime.
Here’s the strategic truth: AI isn’t the future of cybercrime-it’s already the present. If your cybersecurity strategy doesn’t include it, you’re planning for a world that no longer exists. Wake it. The coffee is already on the table. Smell it.
Q: What’s the current state of cybersecurity in Uganda?
Cybersecurity in Uganda is at a crossroads - caught between rapid digital growth and a dangerous lack of readiness. Every smartphone, every financial transaction, and every business system is a potential target.
Yet, the awareness and infrastructure to protect these assets remain underdeveloped.
The facts are sour: Cybercrime in Uganda cost us more than billions last year. Here is the thing, ACFE reports that an average organization loses about 5% of its annual revenue to fraud. Uganda’s national budget for FY2024/25 is UGX 72.1 trillion. Apply 5%, which gives about UGX 3.65 trillion. About 70% of all fraud involves cyber; giving a total of UGX 2.5 trillion lost due to Cybercrime. This money looks too much. Ok, our project frontline reported over UGX 65 billion was lost due to cybercrime directly and indirectly in 2024. Many victims of cybercrime never report, making the problem huge due to the reputational risk management.
It’s no longer about rogue hackers in dark rooms- it’s sophisticated networks targeting individuals, businesses, and even national institutions.
Our response? Fragmented at best, reactive at worst.
If we don’t act decisively now, Uganda and Africa at large risk of becoming a haven for cybercriminals and a case study of missed opportunities. We need immediate investment in cybersecurity education, robust laws, and coordinated enforcement. Because in the digital world, ignorance isn’t bliss- it’s a liability.”
Q: What are the key challenges and solutions you see?
A: Three big challenges stand out. First, awareness- most Ugandans still think cybersecurity is an IT problem, not their problem. Second, outdated policies- our legal and regulatory frameworks haven’t kept up with the speed of cyber threats. The laws lack regulations, making effective implementation difficult. Third, skills- we simply don’t have enough trained professionals to defend against sophisticated attacks.
The solutions are straightforward but require bold action.
Start with massive public awareness campaigns- let everyone know they are on the frontlines.
Second, update our laws to reflect modern threats, including stringent penalties for offenders.
And finally, invest in training programs to build a cybersecurity workforce that’s ready for today and tomorrow. As we say, “the only patch to human stupidity is practical training.” People need handson training not theory to master the skills they need.
Uganda’s digital future depends on how seriously we take cybersecurity today. The clock is ticking, and the threats aren’t waiting for us to catch up.
Qn. What’s the biggest vulnerability in Uganda’s cybersecurity landscape?
A: Us. The people.
We’re the weakest link.
You know Boda Boda’s don’t’ you?
Imagine giving everyone in Uganda a boda boda but no one knows how to ride it - all you will get is chaos, accidents, and eventually, disaster.
That’s what’s happening with technology. People have embraced automation, digitalization, smartphones, apps, and online banking, but no one is teaching the basics of digital safety in a way that is cordinated. The users must figure it out on their own.
Every poorly secured device is a gateway for criminals.
It’s not just hackers breaking into systems; it’s us handing them the keys with our weak passwords and blind trust in every ‘free Wi-Fi’ we see.”
Qn: Are Ugandan businesses prepared for cyber threats?
“Prepared? That’s a generous word. Most Ugandan businesses treat cybersecurity like a fire extinguisher- they only think about it when the flames are already tearing through the walls. I bet over 60% of all staff in any company don’t know how to use the fire extinguisher-they wait to learn how to use it when the office is in flames!
Even then, half of them don’t know where the extinguisher is, and the other half haven’t bothered to check if it works.
Cybercrime is a silent tax on our economy.
Businesses lose money, customers lose trust, and yet we act like this is someone else’s problem. It’s like running a matatu without brakes- sure, you can keep going for a while, but eventually, the crash is inevitable.
Which business will crash first?
Qn: What role should the government play in improving cybersecurity?
A: The way I look at is the government is like a traffic cop in the digital world.
Right now, it’s either asleep at the wheel or stuck writing outdated traffic rules. We have some regulations, but they’re more bark than bite - no real enforcement, no teeth. Hackers aren’t scared of fines or prison sentences because they know the system won’t catch them.
What we need is action, stricter laws, advanced enforcement, and investment in digital infrastructure.
Otherwise, the government is just putting potholes on a dirt road and calling it progress while criminals speed past us in SUVs.
Qn: What’s the future of cybersecurity in Uganda if nothing changes?
If nothing changes, Uganda’s digital future will be like a poorly maintained garden- overrun with weeds, pests, and decay. Businesses will fold because customers won’t trust them. Investors will take their money elsewhere, where systems are safer. And ordinary Ugandans will pay the price, one stolen shilling at a time.
Cybersecurity isn’t just about protecting data; it’s about protecting livelihoods. If we let the wolves run free, we’re not just losing today- we’re surrendering tomorrow. But with the right investment and awareness, Uganda can be the fortress it should be. The choice is ours: fortress or free-for-all.
