JOHANNESBURG, South Africa, September 1, 2025/APO Group: Despite their growing popularity among employees, informal messaging platforms pose significant risks to organisations’ cybersecurity. According to the 2025 KnowBe4 Africa Annual Cybersecurity, 93 percent of African respondents resort to WhatsApp for work communications, surpassing email and Microsoft Teams. What can organisations do to protect themselves from data leakage and other threats?
For many organisations, platforms like WhatsApp and Telegram are intrinsic to workplace communication. Ease of use is what makes them so popular, explains the SVP Content Strategy and Evangelist at KnowBe4 Africa, Anna Collard. “Particularly on the continent, many people prefer to use WhatsApp because it’s fast, familiar,r and frictionless,” she asserts. “These apps are already on our phones and embedded in our daily routines.”
In terms of collaboration, these platforms also help employees to work together, especially in remote or hybrid work environments. “It feels natural to ping a colleague on WhatsApp, especially if you’re trying to get a quick answer,” she says. “But convenience often comes at the cost of control and compliance.
There have been recent cases underscoring the risks of using informal platforms for professional communication. Increasingly, WhatsApp messages are being used as evidence in employee tribunals and other legal cases. The British bank NatWest has gone so far as to ban WhatsApp messages among its staff.
Official communications ending up on personal devices and informal platforms is a problem very clearly not exclusive to the corporate sector.
“There are multiple layers of risk,” states Collard. “It’s important to remember that WhatsApp wasn’t built for internal corporate use, but as a consumer tool. Because of that, it doesn’t have the same business-level and privacy controls embedded in it that an enterprise communication tool, such as Microsoft Teams or Slack, would have.”
The biggest risk for organisations is data leakage. “Accidental or intentional sharing of confidential information, such as client details, financial figures, internal strategies, or login credentials, on informal groups can have disastrous consequences,” she says. “It’s also completely beyond the organisation’s control, creating a shadow IT problem.” This is a growing concern, as the 2025 KnowBe4 Africa Annual Cybersecurity survey noted that up to 80 percent of respondents use personal devices for work, many of which are unmanaged, creating significant blind spots for organisations.
Another major risk is the lack of auditability. “Informal platforms lack the audit trails necessary for compliance with regulations, particularly in industries like finance with strict data-handling requirements,” explains Collard.
Phishing and identity theft also constitute threats. “Attackers love platforms where identity verification is weak,” she says, adding that at least 10 people in her personal network have reported being victims of WhatsApp impersonation and takeover scams. “Once the scammer gains access to the account, in many cases via SIM swaps, the real user is locked out and they have access to all their previous communications, contacts, and files,” she comments. “They then impersonate the victim to deceive their contacts, often asking for money or even more personal information.”
For organisations wanting to mitigate these risks, it’s important to set up a clear communications strategy, Collard maintains. “First, provide secure alternatives,” she says. “Don’t just tell people what not to use. Make sure that tools like Teams or Slack are easy to access and clearly endorsed.”
The “confidence gap” is stressed upon in the new KnowBe4 Africa Human Risk Management Report 2025, where high perceived awareness of cybersecurity policies often doesn’t translate into employees feeling fully confident or supported in reporting incidents or questioning suspicious communications.
