More than half (52%) of senior African executives are very or extremely confident they could recover clean, usable data after a ransomware attack – yet nearly a third (32%) have never performed a full technical recovery test, have not tested in over a year, or do not know when they last did.
That is the confidence gap at the heart of a new ITWeb and Veeam survey on data trust and AI readiness. Conducted earlier this year, the survey assessed how confident organisations across Africa are in the quality, visibility and traceability of their data, and how prepared they are to adopt, govern and scale enterprise-wide AI initiatives. It also examined current and planned investment in data protection, cyber resilience and AI governance technologies.
The survey gathered insights from 140 senior IT, data and cyber security leaders at medium and large organisations across 14 African countries, with just under 70% of respondents based in SA.
Respondents represented a broad range of sectors, including financial services, retail, mining, telecommunications, media and the public sector. They included senior executives and decision-makers responsible for IT, data, AI and cyber security.
While 52% of executives say they are very or extremely confident they could recover clean, usable data following a ransomware attack, a further 33% are moderately confident.
However, 32% have either never performed a full technical recovery test, have not tested in more than a year or do not know when their last test took place. Even among organisations that have completed an end-to-end recovery test, 45% reported only partial success, significant gaps or outright failure.
Tahir Latif, data trust and governance lead for EMEA East at Veeam, says: “The survey reveals that confidence is high, but confidence is not the same as capability. True data trust comes from proving that systems, processes and recovery strategies work when organisations need them most. Without regular, realistic testing, there is no guarantee that critical data can actually be restored when it matters. For organisations facing increasingly sophisticated ransomware and other disruptive attacks, recovery needs to move beyond a theoretical capability and become a demonstrable one.”
AI adoption is also fragmented. About 36% of organisations are running approved AI tools in selected functions, while 27% remain at the pilot or experimentation stage. Just 14% have embedded AI into core business operations or autonomous workflows.
At the same time, 11% of organisations report that employees are using unapproved public AI tools, indicating that AI adoption is not always waiting for organisational approval.
Latif adds: "This creates a growing data trust challenge. AI governance and data trust cannot be treated as something that follows adoption. They must develop alongside it. Organisations need to enable employees to use AI productively while ensuring that sensitive data, intellectual property and business information are not being exposed through uncontrolled tools.”
The main barriers to maintaining confidence in data are skills shortages (32%), inconsistent data classification (28%), budget constraints (27%), lack of visibility into critical data (26%) and legacy infrastructure (25%).
Only 37% of respondents say they can produce an accurate audit trail across all critical systems covering the previous seven days. Just over half (55%) can do this only partially or across selected systems, while 8% cannot produce an audit trail or do not know whether they can.
"If organisations cannot reliably trace what happened to their data, it becomes difficult to establish data trust across the organisation. Without trust in the data, there can be no trust in the outputs, decisions and recommendations generated by AI systems," explains Latif.
The encouraging finding from the survey is that organisations appear to recognise the scale of the challenge. About 68% expect their budgets for data protection, cyber resilience and AI governance to increase over the next 12 months.
Backup and recovery (54%) top the investment priority list, followed by AI governance (42%), identity and access controls (41%), and data discovery and classification (36%).
Latif says this suggests organisations are beginning to move beyond simply acquiring new technology and are investing in the foundations required to build and maintain data trust at scale.
“As AI becomes embedded in more business processes, the quality, security and governance of the underlying data become increasingly important.”
The research also points to differences in maturity depending on how organisations operate.
Those operating across multiple African countries report higher levels of AI maturity than single-country organisations. According to the survey, 22% of multi-country organisations say AI is embedded in their operations, compared with just 4.5% of single-country organisations.
They are also more likely to describe themselves as advanced or fully ready to scale governed AI: 39% compared with 18%.
These findings suggest that scale, complexity and exposure across multiple markets may be encouraging organisations to develop more mature approaches to data and technology governance.
Throughout the survey, one theme emerged consistently: organisations with higher levels of data trust also demonstrated greater confidence in their ability to govern AI, recover from cyber incidents and satisfy regulatory requirements. Data trust is increasingly becoming the operational foundation on which digital resilience and AI readiness depend.
“To bridge the gap between perceived confidence and demonstrable capability, organisations must focus on building data trust through visibility, governance, resilience and accountability," Latif concludes. "Only when leaders can trust their data can they confidently scale AI across the enterprise."
View the full survey outcomes here.
Share
