Mastercard says cyber incidents across Africa rose sharply as digital activity expanded. Morocco is strengthening its national framework, but small firms and a shortage of trained specialists leave gaps that national preparedness cannot close on its own.
Data moving between North Africa and Europe could make Morocco a target for groups seeking to intercept it, Mastercard says. The country's position between African and European digital networks supports trade, but also creates a potential point of exposure. Mastercard describes sophisticated cross-border threats as regional digital activity grows, while warning that defences have not kept pace. Its findings do not measure the risk facing every Moroccan organisation.
The warning appears in the white paper Africa's Digital Defense Race, launched on Monday, 12 October, in Johannesburg. The report says cyber incidents across Africa rose 421% between 2016 and 2025. That figure reflects the report's defined scope and period. It is neither a Morocco-specific incident count nor a like-for-like measure of attacks across every African market.
Mastercard describes Morocco's risk environment as different from that of neighbouring markets, where attacks often target domestic banking fraud and mobile wallets. Its digital links with European markets could attract organised groups seeking to intercept data moving between North Africa and Europe. Shabir Ahmed, Mastercard's senior vice president and customer solutions centre lead for Africa, said public institutions had faced threats and high-profile breaches.
Ahmed argues that cyber resilience affects business continuity and confidence in international trade. He says it also shapes the ability to attract foreign investment. The report's regional findings put the concern in context, but do not establish that Morocco has a higher incident rate than other Maghreb countries.
Morocco's conventional defence procurement is a separate strand of its security agenda, covered in an earlier defence report. The Mastercard findings address the less visible resilience of data networks and the businesses that rely on them.
Africa's digital expansion has been rapid. Mastercard reports that between 2016 and 2025, e-commerce grew more than fivefold and mobile-money use nearly sixfold. It estimates that professional crime syndicates and advanced black-hat hackers now account for about 75% of regional cyberattacks. Incidents involving public institutions formed part of a combined 44% share that also included technology providers and financial services in the largest African economies covered by the report.
Small and medium-sized enterprises are a particular weak point. Across Africa, SMEs represent 95% of registered firms and generate half of GDP, according to the report. They spend an average of $23 per employee on cybersecurity, compared with $189 at large companies. In Morocco, SMEs make up 93% of active companies, according to figures cited in research on Moroccan SME digital transformation. These broad indicators show the potential scale of the challenge, not the security posture of every firm.
The funding imbalance shows up in the market as well. Mordor Intelligence's Morocco Cybersecurity Industry Report estimates that larger firms accounted for 71.8% of the country's cybersecurity-market revenue in 2025. SME investment is projected to grow by more than 15% annually. That forecast points to a possible catch-up effort; it does not show that smaller firms have closed the gap.
Money is only part of the constraint.
Mastercard estimates that Africa has 200,000 unfilled cybersecurity positions. Ahmed says practical operational training must take priority as the region confronts automated and AI-driven attacks. Academic qualifications alone will not fill the workforce gap.
Morocco has set out a national response. The General Directorate for Information Systems Security, or DGSSI, is organising National Cybersecurity Week in Rabat from 12 to 14 October 2026. Authorities have identified training specialists and supporting Moroccan cybersecurity companies as priorities. Their agenda also covers critical infrastructure protection. It includes managing risks where artificial intelligence and cybersecurity meet, as reported in coverage of the Rabat event.
At the event, Minister Delegate for National Defence Abdellatif Loudiyi stressed prevention. He also called for early detection and rapid response, rather than relying only on recovery after an attack. Loudiyi said responsibility extends beyond the DGSSI: every information-system owner must protect its systems and allocate the resources needed to do so. That puts implementation, as well as national policy, at the centre of the effort.
Morocco's framework includes Law No. 05-20 on cybersecurity. It covers information systems operated by government bodies and public institutions, along with entities classified as sensitive infrastructure. The DGSSI has announced work to update the legal and regulatory framework for new threats and technologies. It also plans stronger threat monitoring, plus oversight and audits of public bodies and vital infrastructure. A mechanism to track implementation of audit recommendations is intended to make those reviews more actionable.
Morocco was placed in Tier 1 of the International Telecommunication Union's 2024 Global Cybersecurity Index, scoring 97.5 out of 100. That result signals strong formal national preparedness, but does not show that every sector or organisation is free of vulnerabilities. DGSSI Director-General Brigadier General Abdellah Boutrig has called cybersecurity a key component of digital sovereignty. He said the directorate plans to broaden support for small and medium-sized enterprises.
Mastercard has launched its Africa Cybersecurity Centre of Excellence to support public-private collaboration. The centre also backs cross-border threat-intelligence sharing and live security simulations. Such cooperation complements national measures, while individual organisations remain responsible for putting protections in place. Morocco's digital links remain an economic advantage only if the networks and businesses behind them can withstand professional attacks. Closing SME funding and skills gaps is central to protecting trade confidence and business continuity between African and European markets.
