This distinction – migration versus transformation – will help determine whether African businesses can keep pace with rapidly advancing markets such as the United States.<\/p>\n\n\n\n
Armand Kruger, Head of Cyber Security at NEC XON, says the prevailing approach treats AI as an add\u2011on rather than a catalyst for rethinking how cyber security should operate.<\/p>\n\n\n\n
\u201cWhile incremental improvements are possible through migration, they fall short of the full potential AI can unlock through fundamental redesign,\u201d he says. \u201cYou can add an AI capability to a legacy security architecture and gain efficiencies, but you will remain limited by the inherent capabilities of the systems you\u2019re bolting the AI onto. What organisations need is to redesign the model with AI as the foundation, not just another capability.\u201d<\/p>\n\n\n\n
From Retrofitting to Rebuilding<\/h2>\n\n\n\n
For decades, cyber security environments have been built as collections of specialised technologies, with SIEM platforms acting as central aggregation points for alerts and telemetry.<\/p>\n\n\n\n
AI is increasingly being layered onto these systems to improve detection, automate workflows and reduce alert volumes. <\/p>\n\n\n\n
But Kruger argues that this approach is inherently limited because it places AI at the top of a pyramid built on legacy assumptions.<\/p>\n\n\n\n
\u201cFlip the model upside down. Put AI at the foundation and build your capabilities above it. Suddenly you have a platform for a new era of cyber security.\u201d<\/p>\n\n\n\n
This shift – from retrofitting AI to rebuilding around it – is already underway in advanced markets.<\/p>\n\n\n\n
NEC XON has engaged with US organisations that are advising customers to construct entire cyber security strategies around AI-first architectures.<\/p>\n\n\n\n
African organisations must begin redesigning cyber security environments to avoid a widening innovation gap, in Kruger\u2019s view.<\/p>\n\n\n\n
A Strategic Risk for African Competitiveness<\/h2>\n\n\n\n
The implications extend beyond technology competitiveness.<\/p>\n\n\n\n
Cyber security is fundamentally tied to business resilience.<\/p>\n\n\n\n
Falling behind in the ability to detect, understand and respond to increasingly sophisticated attacks could leave organisations exposed as adversaries adopt AI-driven techniques.<\/p>\n\n\n\n
Kruger notes that attackers are already using AI to build graphs that map potential attack paths and identify weaknesses across interconnected systems.<\/p>\n\n\n\n
\u201cIf we don’t use AI to build these graphs and attackers start using AI, they’re going to be miles ahead of us.\u201d<\/p>\n\n\n\n An AI-first architecture also transforms the role of the security operations centre (SOC).<\/p>\n\n\n\n Traditional SOCs are overwhelmed by alert volumes, forcing analysts to spend most of their time triaging signals.<\/p>\n\n\n\n AI can analyse thousands of alerts, identify relationships between them and reduce the number of incidents requiring human investigation.<\/p>\n\n\n\n In one NEC XON customer\u2019s environment, approximately 1,000 alerts were processed by an AI engine and reduced to just 17 actionable incidents.<\/p>\n\n\n\n The value, Kruger emphasises, is not merely fewer alerts but the ability to redeploy cyber security expertise.<\/p>\n\n\n\n \u201cAI isn’t necessarily going to replace cyber security expertise. It changes how that expertise is applied.\u201d<\/p>\n\n\n\n Instead of spending 80-90% of their time on repetitive tasks, skilled professionals can focus on architectural analysis, business risk, proactive threat hunting and innovation.<\/p>\n\n\n\n This shifts the SOC\u2019s role from reactive alert management to strategic engagement with the business around resilience and future planning.<\/p>\n\n\n\n Kruger stresses that AI is not the end goal; cyber resilience is. \u201cCyber resilience needs to be the top of the pyramid. AI is the accelerator that gets you there.\u201d<\/p>\n\n\n\n Organisations should therefore stop asking which existing products can be enhanced with AI and instead ask what their architecture would look like if AI were the foundation.<\/p>\n\n\n\n Transformation does not require abandoning existing technology overnight.<\/p>\n\n\n\n Most organisations have complex environments and significant investments in current infrastructure.<\/p>\n\n\n\n The starting point is a new strategic vision: define the desired AI-first architecture, assess the current stack and determine where AI-driven capabilities can progressively replace or consolidate legacy technologies.<\/p>\n\n\n\n Kruger cites a leading financial services client\u2019s cloud strategy as an example of transformation versus migration.<\/p>\n\n\n\n Rather than lifting and shifting existing systems into the cloud, the company redesigned its architecture around cloud-native capabilities, achieving agility that would not have been possible through simple migration.<\/p>\n\n\n\n The same principle, he says, now applies to cyber security.<\/p>\n\n\n\n Ultimately, the issue extends beyond the cyber security function.<\/p>\n\n\n\n As AI becomes embedded in both offensive and defensive cyber capabilities, the ability to redesign security around AI will influence competitiveness and resilience across the business.<\/p>\n\n\n\n \u201cThe message is that AI is not the capability. AI is the foundation,\u201d Kruger says. Organisations that act early will build architectures designed around what AI makes possible, enabling higher-value work, more proactive security teams and stronger resilience against an increasingly sophisticated threat landscape.<\/p>\n\n\n\n![\"\"](\"https:\/\/businesstech.co.za\/news\/wp-content\/uploads\/2026\/09\/Armand-Kruger-Article-Image-1600x900-1-1024x576.jpg\")
Transforming the SOC: A Customer Example<\/h2>\n\n\n\n
Cyber Resilience as the Ultimate Goal<\/h2>\n\n\n\n
Lessons from Cloud Transformation<\/h2>\n\n\n\n