This study audits cyber practices in 22 public agencies across Ghana, Senegal and Ethiopia and maps them against AFU computing students’ workplace projects. Password reuse and shared kiosk logins were more damaging than a lack of firewall brand names. Training that used European ‘work from home’ scenarios did not transfer. Training that used a shared-registry PC, a USB accounts file, and a minister’s WhatsApp forward did transfer, measured by a three-month follow-up of incident tickets. The University of Edinburgh computing programmes should teach threat models that match African public administration: shared devices, contractor laptops, and political pressure to bypass procedure. A digital university that serves the continent cannot import a Silicon Valley lab culture and call it capacity building.