As Artificial Intelligence (AI) rapidly transforms workplaces worldwide, Nigerian businesses are being urged to embrace the technology with robust governance, cybersecurity and data protection measures to avoid exposing their organisations to new security, privacy and regulatory risks.

The advisory came from 3Consulting Limited, an information technology services and cybersecurity firm headquartered in Nigeria and licensed by the Nigeria Data Protection Commission (NDPC) as a Data Protection Compliance Organisation (DPCO), during a webinar held Tuesday titled “AI in the Workplace: How to Harness the Benefits Without Creating Security and Privacy Risks.”

Speaking during the session, Ayomide Ayodele, AI Governance Implementation Lead at 3Consulting, said AI is becoming an indispensable business tool across industries but warned that organisations rushing to deploy AI solutions without appropriate governance frameworks could inadvertently create new avenues for cyberattacks, privacy breaches and regulatory violations.

“Using AI is interesting. Using AI is exciting,” Ayodele said. “When using AI in your organisation, there has to be governance in using AI. There has to be governance in even building your AI solution.”

Her presentation comes at a time when Nigerian organisations are increasingly integrating generative AI into customer service, software development, recruitment, finance, healthcare, compliance and other business functions, driven by the promise of improved productivity, automation and operational efficiency.

However, the 3Consulting exec cautioned that the same technology enabling businesses to innovate is also empowering cybercriminals with more sophisticated attack capabilities.

“Using AI is interesting. Using AI is exciting,” Ayodele said. “When using AI in your organisation, there has to be governance in using AI. There has to be governance in even building your AI solution.”

According to her, AI adoption should not simply focus on deploying the latest technology but on ensuring organisations understand and manage the risks accompanying intelligent systems.

“You don’t just sit down,” Ayodele added, “and build an AI solution and throw it out there and just say people should use this solution. Or you don’t just buy a solution because it looks fancy or because this is what you actually need. There are steps that you need to take to ensure that the solution aligns with your business and does not affect you negatively.”

AI is changing both business and cybercrime, 3Consulting says

One of the central messages from the webinar was that AI is transforming cybercrime just as rapidly as it is transforming legitimate business operations.

According to the 3Consulting exec, attackers are increasingly leveraging generative AI to automate fraud, improve phishing campaigns, generate malware and create convincing digital impersonations that are significantly more difficult to detect than traditional cyberattacks.

She explained that many of the warning signs users previously relied upon to identify phishing emails have largely disappeared because AI systems now produce grammatically correct, highly personalised communications.

“Before, when you got phishing emails, you could easily detect them if you were paying attention. You could notice wrong spellings or poor sentence construction,” she said.

“But now, because attackers have become smarter, they are using AI to create very realistic emails. You have to look at them very carefully before you know they are not genuine.”

She noted that publicly available information on professional networking platforms and social media has become an increasingly valuable resource for cybercriminals using AI.

“If I have my LinkedIn account with my full name, what I do and even my email address, someone can scrape that information and use it to create another email that looks legitimate before sending it to a client,” Ayodele added.

The consultant warned that AI-generated phishing emails increasingly exploit trust rather than technical vulnerabilities, making employee awareness one of the strongest lines of defence.

According to the 3Consulting exec, attackers are increasingly leveraging generative AI to automate fraud, improve phishing campaigns, generate malware and create convincing digital impersonations that are significantly more difficult to detect than traditional cyberattacks.

Deepfakes becoming a growing business threat

Beyond phishing, Ayodele highlighted the growing use of AI-generated deepfake technology to impersonate executives, employees and public figures.

According to her, advances in generative AI have enabled criminals to produce highly convincing fake videos and cloned voices capable of deceiving victims into authorising payments or disclosing confidential information.

“Now we see deepfake videos that look so legitimate because even the person whose image has been used would believe they are the one.”

She said cybercriminals have already begun exploiting AI-generated voice cloning to impersonate chief executives, finance directors and other senior executives.

“They have used AI to create voice calls that sound like the CEO of a company. It sounds like the finance manager. It sounds like somebody you trust.”

Such attacks, she warned, significantly increase business exposure to social engineering fraud because employees naturally respond more readily to familiar voices than anonymous emails.

AI also creating new cyberattack techniques

The presentation outlined several emerging AI-related cyber risks businesses should anticipate as adoption accelerates.

According to Ayodele, attackers now use AI to:

• generate malware;
• automate phishing campaigns at scale;
• identify vulnerabilities within corporate networks;
• crack passwords more efficiently;
• poison AI models;
• manipulate AI chatbots;
• steal sensitive organisational data.

She explained that one particularly concerning threat is prompt injection, where attackers manipulate AI models to produce inaccurate or harmful responses.

“Some malicious attackers have found a way to inject prompts into your AI model,” she said.

Using customer service chatbots as an example, she warned that compromised AI systems could undermine customer confidence by providing false or misleading information.

“For businesses that use chatbots, if you are not careful and do not secure your chatbot, somebody can get access to it and inject it, even chasing away your customers.”

She also warned of AI model poisoning, where criminals alter the behaviour of machine learning systems after deployment.

“When you use AI models for your business,” Ayodele said, “and train them on how to respond to vendors or clients, if somebody gets access to the model and poisons it, you are no longer getting the responses you are supposed to get.”

According to her, organisations deploying AI without continuous monitoring expose themselves to operational disruptions that may remain undetected until significant damage has occurred.

“When you use AI models for your business,” Ayodele said, “and train them on how to respond to vendors or clients, if somebody gets access to the model and poisons it, you are no longer getting the responses you are supposed to get.”

Businesses should also prepare for insider AI risks

Another growing concern highlighted during the webinar is AI-assisted insider threats.

While external hackers remain a significant concern, the 3Consulting exec said employees themselves may unintentionally expose confidential corporate information by entering sensitive business data into public AI platforms.

She warned that AI tools increasingly possess the capability to identify sensitive information within organisational databases if improperly integrated or secured.

“Some people have found a way to use AI to come into your database, identify sensitive data and steal sensitive data from your database.”

According to her, employee education is therefore becoming just as important as technical cybersecurity controls.

She argued that organisations must establish clear internal AI usage policies specifying what information employees may, and may not, share with generative AI platforms.

Unchecked AI can introduce bias into business decisions

Beyond cybersecurity, the webinar examined ethical and governance challenges surrounding AI deployment.

One of the key concerns discussed was algorithmic bias.

Ayodele explained that AI systems learn from the information used to train them, meaning incomplete or unbalanced datasets can unintentionally produce discriminatory outcomes.

She illustrated this using recruitment software.

If an organisation instructs an AI system to reject applicants below a certain age, without specific industry experience or outside predetermined criteria, qualified candidates may never be reviewed by a human recruiter.

“The AI has automatically deleted it,” she said.

“You might actually have lost a really good potential employee simply because of the standards you set.”

She stressed that while businesses can legitimately define recruitment requirements, excessive reliance on automated decision-making without human oversight may exclude suitable candidates and create fairness concerns.

Healthcare AI presents similar challenges

She noted that AI systems trained exclusively using foreign medical datasets may struggle to diagnose illnesses common in Nigeria and other African countries.

Similarly, lending algorithms may unintentionally discriminate against legitimate borrowers depending on how credit-scoring models are designed.

Customer service chatbots can also fail when organisations deploy simplistic AI systems incapable of understanding complex customer enquiries.

According to her, “if I want to actually complain about something and the chatbot simply says, ‘I don’t have a response for you,’ then it has not solved the customer service problem.”