ITWeb Veeam Africa: Data Trust AI Survey Exposes Ransomware Gaps

• African executives show high confidence in ransomware recovery, with 52% very/extremely confident, yet 32% have not tested their systems adequately.
• Only 37% of surveyed organizations can produce a comprehensive data audit trail for the past seven days across all critical systems.
• AI adoption is fragmented across Africa, with 11% of organizations reporting employee use of unapproved public AI tools.
• Key barriers to data confidence include skills shortages (32%), inconsistent data classification (28%), and budget constraints (27%).
• The ITWeb and Veeam survey gathered insights from 140 senior leaders in medium and large organizations across 14 African countries.

Without regular, realistic testing, there is no guarantee that critical data can actually be restored when it matters, making demonstrable recovery capabilities essential for organizations facing sophisticated cyber threats.

A recent ITWeb and Veeam Africa data trust AI survey has uncovered a significant disparity between perceived readiness and actual capability among senior African executives regarding ransomware recovery. The study, conducted earlier this year, involved 140 senior IT, data, and cybersecurity leaders from medium and large organizations across 14 African countries, with just under 70% of respondents based in South Africa. It assessed organizational confidence in data quality, visibility, and traceability, alongside preparedness for enterprise-wide AI initiatives and investment in data protection technologies.

While a substantial 52% of senior African executives express being very or extremely confident in their ability to recover clean, usable data following a ransomware attack, and an additional 33% report moderate confidence, this optimism is challenged by practical realities. A concerning 32% of these organizations have either never performed a full technical recovery test, have not done so in over a year, or are unsure of their last test date. Furthermore, even among those that have conducted end-to-end recovery tests, 45% reported only partial success, significant gaps, or outright failure, highlighting a critical gap between belief and proven capability.

Tahir Latif, Veeam’s data trust and governance lead for EMEA East, emphasized this disconnect, stating that true data trust stems from validated systems and recovery strategies. He underscored that without regular, realistic testing, there is no guarantee that critical data can actually be restored when it matters, making demonstrable recovery capabilities essential for organizations facing sophisticated cyber threats.

Beyond data recovery, the ITWeb Veeam Africa data trust AI survey also revealed a fragmented landscape for artificial intelligence adoption across the continent. Only 14% of organizations have fully embedded AI into their core business operations or autonomous workflows. A larger proportion, 36%, are utilizing approved AI tools within selected functions, while 27% remain in the pilot or experimentation phase.

Compounding the challenge of structured AI integration is the prevalence of shadow IT: 11% of organizations reported that their employees are using unapproved public AI tools. This trend indicates that AI adoption is often occurring outside formal organizational oversight, creating potential data trust challenges. Latif warned that AI governance and data trust must evolve concurrently with adoption to prevent sensitive data, intellectual property, and business information from being exposed through uncontrolled tools.

The survey identified several core barriers undermining confidence in data integrity and governance across African enterprises. Skills shortages emerged as the leading concern for 32% of respondents, followed by inconsistent data classification (28%), budget constraints (27%), a lack of visibility into critical data (26%), and reliance on legacy infrastructure (25%). These systemic issues collectively impede robust data management and increase operational risk.

A critical finding related to data audit trail challenges Africa faces: only 37% of respondents confirmed they could produce an accurate audit trail across all critical systems for the preceding seven days. A majority, 55%, could only achieve this partially or across selected systems, while 8% either could not produce an audit trail at all or were unaware of their capability. Latif stressed the importance of reliable data traceability, noting that without the ability to trace data events, establishing data trust across an organization becomes difficult, thereby compromising the trustworthiness of outputs, decisions, and recommendations generated by AI systems.

The findings from the ITWeb and Veeam survey present a clear picture of the challenges facing African organizations in an increasingly digital and threat-laden environment. The disconnect between high confidence in ransomware recovery and the lack of rigorous testing, coupled with the unmonitored use of unapproved AI tools, points to significant vulnerabilities. These issues are further exacerbated by fundamental data trust deficiencies, including inadequate audit trails and persistent skills gaps.

Despite these hurdles, an encouraging aspect of the survey is the recognition among organizations of the scale of the challenges ahead. This awareness provides a foundation for addressing the critical need for enhanced data governance, robust cyber resilience strategies, and comprehensive AI frameworks. Proactive measures are essential to transform theoretical capabilities into demonstrable ones, ensuring data integrity and security in the face of evolving threats.

Lawyers and compliance officers should advise clients on the significant compliance and liability risks highlighted by this survey, particularly regarding untested ransomware recovery capabilities and the unmonitored use of unapproved AI tools. This necessitates a review of data protection policies, incident response plans, AI governance frameworks, and the ability to produce robust data audit trails to mitigate potential regulatory penalties and data breach exposures.

Source: Original reporting based on an ITWeb and Veeam survey.