Jumia is a leading e-commerce platform in Africa. It operates across several countries, connecting millions of customers with local and international vendors.
That scale runs on critical technology infrastructure. Public storefronts, vendor-facing systems, internal networks. Every one of them is exposed, and every one of them is a door an attacker can try.
For Jumia, security isn't a support function. It's a condition for doing business.
The Snapshot Problem
Like most enterprises, Jumia used to test its defenses on a calendar. Pentests were bought on demand, once or twice a year, mostly to meet compliance requirements.
Our offensive security practices were punctual, hired on demand, one or two times a year, to comply with certain requirements or standards. A snapshot of the environment at that moment.
A snapshot was never going to hold. Three gaps kept growing between tests:
- Visibility. Jumia's attack surface was expanding faster than any yearly test could map. Today Ethiack tests more than 2,600 of its assets.
- Validation. A pentest report shows what was exploitable on the day it was written. It says nothing about what is exploitable now.
- Velocity. AI is speeding up how code gets written, and how vulnerabilities get introduced. Attackers don't wait for the next testing window.
The last gap is what forced the change.
"We needed continuous and more effective testing, 24 hours a day, due to the increasingly common occurrence of AI-generated vulnerabilities."
The Turning Point: Testing That Never Stops
Jumia went looking for a partner that could test non-stop, 24/7. It chose Ethiack, and has been a client for several years.
The Ethiack platform works as one system:
- Continuous attack surface mapping. Every new asset, domain and service is discovered and brought into testing as soon as it appears.
- Hackian, the agentic AI pentester. 24/7 autonomous pentesting across Jumia's external attack surface. Hackian chains vulnerabilities and exploits them to prove what an attacker could actually use.
- Beacon for internal networks. Continuous testing extended inside Jumia's subnet environments.
- On-Demand Pentesting. Human and AI testers go deep on business logic and exploit chains that automated testing alone doesn't replicate.
Jumia adopted the Beacon from its first version. The two teams have shaped it together since.
Since then we've seen a lot of progress, mainly on the deployment and management of the Beacon, which allows us to secure our subnet environments much faster and more effectively. Many of our inputs, from what we've identified and suggested, were considered.
Together, these capabilities moved Jumia toward Continuous Threat Exposure Management. Periodic snapshots gave way to continuous, validated coverage.
The Win: Eyes on the Environment, All the Time
Coverage that keeps pace
Jumia's tested attack surface now covers more than 2,600 assets. Every new one enters continuous testing as soon as it appears. None waits for next year's pentest.
Risk that gets fixed, with a return to prove it
Every vulnerability Jumia receives comes with proof of exploitability. So its teams spend their time on remediation, not on triage.
Ethiack also puts a number on that remediation, using annualized loss exposure (ALE) across Jumia's public-facing assets.
In 2026, the exposure Jumia eliminated delivered a 16,485% return on its annual investment.
Depth where automation stops
Continuous testing covers breadth. On-Demand pentests cover depth. Ethiack's testers go after business logic flaws and exploit chains that automated testing alone doesn't replicate.
Ethiack is a way of keeping our eyes on our environment, in order to always detect vulnerabilities and act upon them as soon as possible, mitigating any window of opportunity for exploitation.
What's Next
Jumia and Ethiack keep building together. Next on the list: third-party asset testing with risk scores per supplier, ALE and ROI tracked directly in the dashboard, and per-asset compliance reporting.
The annual snapshot is gone. Jumia now knows what is exploitable across its attack surface, every day, and fixes it before attackers get there.
That has resulted in true value for the company.
About Jumia
Jumia is a leading e-commerce platform in Africa, connecting millions of customers with local and international vendors across multiple countries.
About Ethiack
Ethiack delivers continuous, autonomous cybersecurity through agentic AI - AI pentesting agents that think, act, and learn. Operating 24/7, these agents discover, exploit, and validate vulnerabilities across your entire attack surface with near-zero false positives. Ethiack provides continuous visibility, high-speed testing, and actionable, validated risks, keeping organisations one step ahead of cybersecurity threats.
Want to see what's actually exploitable across your attack surface? Try it now.