Every financial institution in Africa now runs on the public internet. The app, the customer portal, the API, the login page: all of it is reachable from anywhere on earth, by anyone, at any time. That is what made the fintech boom possible. It is also what makes a simple, uncomfortable exercise possible: looking at an institution the way an attacker does, from the outside, before any login, and seeing what it reveals.
We did that exercise. This is what we found.
What we did
We passively scanned 618 public applications belonging to 347 African financial institutions, banks, fintechs, payment companies, crypto exchanges and insurers, across 21 African countries. One ordinary browser-style request each. No logins. No probing. No exploitation of anything. Nothing an attacker had to do that a normal visitor does not already do when they open the page.
We named no institution, and we never will. The point of this report is the pattern across the market, not the exposure of any single name. Everything here is drawn only from what the open internet already shows to everyone.
What we found
The headline is uncomfortable. On basic external security posture, roughly half of the financial apps we scanned graded C or below. The full spread: 29% at A, 21% at B, 26% at C, 20% at D, and the remainder at F.
Underneath the grades, the specific findings:
- 83% carry cross-site-scripting exposure, either no Content-Security-Policy at all, or one defeated by unsafe-inline. This is the single most common weakness on the money layer.
- 188 apps, nearly one in three, carry three or more distinct exposures at once. These are not one-off oversights. They are stacks of them.
- 39% have no clickjacking protection on the page a customer logs in through, the exact page where it matters most.
- 79 financial apps are running on WordPress, a general-purpose content platform, and its plugin ecosystem, sitting under a bank or fintech brand.
- 37 answer any website on earth through a wildcard CORS policy, a few of them on login pages.
- 14 are serving on invalid or expired certificates right now.
- And 34% already expose a public API, before open banking has even fully gone live.
What it means
Three things stand out to me.
The first is that this is not exotic. None of these are zero-days or nation-state tradecraft. They are configuration and hygiene, the boring layer, on the most sensitive apps in the economy. The attacker does not need to be sophisticated to notice a login page with no clickjacking protection or an API that answers everyone. The reconnaissance is being handed to them for free.
The second is the inversion. Across the market, the pattern we see is that larger institutions tend to over-invest at the network edge and under-invest at the application itself, while many fintechs do the reverse. In both cases the exposure sits where the money logic actually lives, in the app and the API, which is the layer a signature-based firewall was never built to protect. A traditional WAF matches known-bad patterns. Most of what we found produces perfectly well-formed requests. There is no signature to match, so the firewall waves them through and the app answers.
The third is timing. That 34% figure, the share already exposing a public API, is the one I would sit with. Open banking is arriving in Nigeria in 2026, Africa's first such rail, and it multiplies exactly this surface: more APIs, more data sharing, more consent to abuse. A third of these institutions are already carrying that risk before the rail is live. Open banking will reward the ones that treated API security as day-one design, and punish the ones that did not.
Why this matters now
None of this is happening in a vacuum. Nigeria came off the FATF grey list on the strength of effectiveness, not paperwork. The CBN spent 2026 mandating automated AML, real-time fraud response and a new cybersecurity framework. The NDPC has moved into full enforcement, fining a bank ₦555.8 million for a data breach. In that environment, a weak external posture is no longer just a technical debt. It is a fraud risk, a compliance risk and a regulatory-fine risk at the same time.
What we would do about it
Vendor-neutral, in order:
- Look at your own institution from the outside first. Most teams have never once seen what their front door reveals. It is a sobering exercise, and a free one.
- Add a layer that learns your app's normal and blocks the rest, at the application and the money layers, not just the edge. Positive security catches the well-formed request a signature WAF misses.
- Make security a go-live gate for open banking, not a fast-follow. The API you expose in a hurry is the one you regret.
This is the problem we work on at Autogon. We built a free scanner so any institution can see its own outside-in posture in a couple of minutes, and a positive-security layer that protects the app and the money once you have seen the gaps. The full research, and the scanner, are at autogon.ai.
A closing note on ethics. This report is passive, aggregate and anonymous by design. We believe the honest way to raise a market's security is to show the pattern without exposing any single institution, and to hand every one of them the tool to check itself privately. The internet already knows what your bank looks like from the outside. The only question is whether you have looked.
Autogon Research will publish one data-driven read on the state of risk in African finance each month. To suggest the next question, reach us at autogon.ai.
Sources