Itua: Outdated Cybersecurity Myths Leaving Nigerian Businesses Vulnerable

Michael Olugbode in Abuja

Despite rising cyber threats across Nigeria, many businesses continue to operate under outdated assumptions that increase their vulnerability to attacks, Cybersecurity Analyst, Ruth Itua has observed.

Speaking from her experience with organisations across sectors, Itua noted that misconceptions about cybersecurity often shape investment, staff training, and risk assessment in ways that leave critical gaps for attackers to exploit. 

“Cybersecurity failures are rarely caused by a lack of technology. More often, they stem from beliefs that create a false sense of safety,” she said.

One widespread myth is that “We are too small to be a target.” Many small and medium-sized enterprises (SMEs) assume cybercriminals focus on large corporations with bigger revenues. In reality, attackers target ease of access rather than company size. Smaller organisations often lack robust controls and monitoring, making them particularly attractive to cybercriminals.

Another common misconception, she said, is that: “Our security tools will catch everything. while firewalls, antivirus programmes, and email filters are essential, they are not foolproof. Modern phishing attacks increasingly rely on social engineering and can bypass automated systems.”

Itua emphasised that human awareness is crucial in detecting suspicious emails or behaviour, noting that technology alone cannot secure an organisation.

“It is also a mistake to think cybersecurity is only an IT issue,” she added, while stating that: “Attackers target employees across an organisation — finance teams may receive fraudulent payment requests, HR teams get malicious CVs, and executives may be impersonated in urgent emails. Cybersecurity, therefore, is a business-wide responsibility.”

She noted that other persistent myths include the belief that “Compliance means we are secure” and “we would know if we were breached.” 

Itua said regulatory compliance sets minimum standards but does not guarantee protection against evolving attack techniques, insisting that breaches often go undetected for weeks or months as attackers quietly harvest credentials and monitor systems.

Itua, while arguing that addressing these misconceptions requires a human-centred approach to cybersecurity, said: “It is not just a product to be purchased or a task to delegate. Effective security combines technology, people and processes. Organisations that invest in staff awareness, encourage reporting without blame, and test both systems and human responses are far better positioned to withstand modern attacks.”

In an environment dominated by deception and manipulation, Itua noted that employees who are trained to question anomalies, detect suspicious behaviour, and respond swiftly are not just participants in cybersecurity; they are the first and most effective line of defence against evolving cyber threats.