Abstract
This study raises an important concern regarding African businesses that procure and own third-party security software. These businesses may be led to believe that they are safe from security threats while shifting the security concerns and responsibility to third-party service providers. The study used grounded theory (GT) to present rich insights and lived experiences from African business practitioners, highlighting that this may not be the case, and African businesses may be vulnerable. This gap is addressed and discussed. The study qualitatively examined the lived experiences of selected practitioners and, from the analysis, a theory that explains how risks can be managed when third-party security software owned by African businesses can be managed. Findings show that trust impacted strategies, information security, contractual obligations, and critical decision-making regarding the software solutions to procure. This work is intended to guide African businesses in establishing mutually beneficial, long-lasting relationships with third-party information security service providers.