Africa is now the most-attacked region in the world: between 3,000 and 3,400 cyberattacks per organization per week, according to Check Point — for less than 1%of global data-center capacity and roughly 0.5% of the global cloud market. That is the equation of the century: maximal exposure, minimal control.
Within this landscape, Morocco occupies a singular position. The only Maghreb country ranked Tier 1 “Role-modelling” in the ITU’s Global Cybersecurity Index 2024 (97.5/100), alongside six other African nations, the Kingdom demonstrates that a long-term strategy, anchored in the forward-looking vision of King Mohammed VI, delivers measurable results. But that lead is a responsibility as much as an honor: Morocco is not an island of sovereignty; it is living proof that the continent can build it.
The true metric: reversibility, not compliance
The question policymakers ask is often the wrong one. Compliance asks: are we in good order? Sovereignty asks: can we keep operating if our suppliers walk away, squeeze us, or abandon us? A country can be perfectly compliant and wholly captive.
Morocco’s legal architecture — Law 05-20, Decree 2-21-406, the National Cybersecurity Strategy 2030, and the cloud decree 2-24-921 adopted pursuant to Royal Directives — is exemplary. Yet the law has moved faster than dependence has retreated: 60%of Moroccan companies report medium to high dependence on cloud providers, and 38% have no reversibility strategy at all.
What is needed is a simple, demanding metric: a reversibility index, measuring the tested — not declared — capacity to repatriate data, operations and skills within 30, 60 or 90 days without service interruption. We audit firewalls; we should audit exit doors. For sovereignty is not isolation: it is the capacity to choose one’s dependencies. A dependency chosen is a partnership; a dependency endured is a vulnerability.
The weakest link is not technical; it is human
Tier 1 status honors the remarkable work of the General Directorate for Information Systems Security (DGSSI), under the National Defense Administration, and the coherence of a strategy carried at the highest level of the state. But that index measures law and organization — not the sinew of the system.
Africa counts fewer than 300,000 cybersecurity professionals against some 68,000 unfilled posts; Morocco faces a shortfall of around 3,800 specialists by 2026, even as brain drain pulls the very profiles it trains towards Europe and the Gulf. The attack on Morocco’s social security fund (CNSS) in April 2025, and the 879 cyber incidents handled by the DGSSI that same year, are reminders that the threat does not wait for graduation ceremonies.
A parliament can legislate in a single session; it takes five years to train an offensive security expert. That is precisely the root addressed by Morocco Digital 2030 — MAD 11 billion, 100,000 young people trained annually — and the “AI Made in Morocco” roadmap, with its Al-Jazari institutes, its 200,000-talent ambition and its partnership with Mistral AI. The nation’s youth — the generation embodied and inspired by Crown Prince Moulay El Hassan — are the reserve force. Converting regulatory excellence into operational power, and equipping that generation with doctrine, tooling and confidence, is the highest form of service one can render to tomorrow’s Morocco. A Tier 1 wall manned by vacant posts is merely a well-graded façade.
Local industry exists: it must be turned into champions
Nothing about dependence is inevitable. Morocco proves it: Moroccan SOCs earning 70% of their revenue from export; Casablanca-based firms qualified by the DGSSI as PASSI audit providers, building proprietary platforms consolidated by national capital; a new generation of wholly Moroccan-owned engineering companies.
The challenge is not buying world-class technology; it is never building the capacity to do without it. The lever is known: public procurement, the sovereign’s first venture capitalist. Morocco’s two-tier cloud qualification scheme under Decree 2-24-921 — open to any operator, domestic or foreign, accepting data-territoriality and supervision rules — points the way: sovereign rules, an open market, no protectionism. The task now is to extend that doctrine to SOCs and incident response, reserving a share for local SMEs: their first reference must be Moroccan, so that their first conquest can be African.
The continental horizon: an African ‘cyber Article 5’
Sovereignty is built nation by nation — a weak link compromises the whole chain — then consolidated continentally, for no African state, however well endowed, can fund detection at scale alone against adversaries who recognize no borders. The architecture already exists: the Malabo Convention, in force since June 2023; Africa’s network of cybersecurity authorities, whose operational roadmap was adopted in February 2025; AfricaCERT, federating incident-response teams since 2011; and the AfCFTA protocol on digital commerce, first ratified by Nigeria in November 2025.
The proposal I carry is a continental mechanism for pooling detection and response: a network of interconnected regional CERTs bound by a mutual-assistance protocol — a true African “cyber Article 5”, under which a major attack on one member state triggers operational support from the others. The seven African Tier 1 nations — Mauritius, Egypt, Ghana, Tanzania, Kenya, Rwanda and Morocco — would form the first circles of mutual trust. True to the South–South cooperation championed by King Mohammed VI, Morocco — which has committed to hosting a regional CERT serving Africa’s cybersecurity authorities — is naturally positioned to anchor the Maghreb node. The 2Africa cable, its 45,000-km backbone complete, provides the infrastructure; political will must supply the doctrine.
In cybersecurity, as in strategy, a continent that watches over itself is no longer watched by anyone else.
Cybersecurity is not a cost; it is an investment in sovereignty. For Morocco, it has become a component of strategic soft power — in service of the royal vision, of the youth embodied by the Crown Prince, and of Africa as a whole. The window is open. It will not remain so indefinitely.
