Kenya's digital economy is growing rapidly, with businesses processing online payments, storing data in the cloud, and relying on interconnected systems. This expansion has increased exposure to cyber threats. The Communications Authority of Kenya reported 11.12 billion detected cyber-threat events in the financial year ended June 2026, a 29% increase year-on-year. System vulnerabilities and malware-related threats are significant concerns.
The Communications Authority of Kenya's data shows that system vulnerabilities accounted for 10.64 billion events, while malware-related threats rose by nearly 65%. Although these figures do not represent confirmed attacks, they highlight the growing risks facing businesses. Cybersecurity Awareness Month, observed in October, emphasizes the need for constant vigilance in protecting digital infrastructure.
A cyber incident can have severe consequences, including halting operations, disrupting customer services, and locking organisations out of essential records. Data breaches can expose sensitive information, trigger regulatory obligations, and undermine customer trust. According to PwC's Cyber Digest, artificial intelligence is enabling increasingly sophisticated attacks, including automated exploitation of system vulnerabilities and deepfakes.
Kenya's Data Protection Act, 2019, requires organisations to notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of a personal data breach that poses a real risk of harm. Data processors must notify controllers without delay and, where reasonably practicable, within 48 hours. Compliance requires clear reporting structures, response procedures, and decision-making protocols.
To mitigate cyber risks, businesses must strengthen access controls, maintain secure backups, train employees to identify threats, and assess third-party security risks. However, prevention alone cannot eliminate cyber risk. Organisations must also prepare for financial recovery by considering cyber liability insurance, which can cover specified losses arising from covered incidents.
Cyber liability insurance can cover business interruption, data recovery, incident response, and legal expenses, depending on policy terms. Such insurance complements broader risk-management and business-continuity measures but does not replace security controls or cover every loss. Leadership plays a crucial role in cyber resilience, with businesses needing to detect threats, contain incidents, restore operations, and manage financial consequences.
Ultimately, a business's ability to recover from a cyber incident may determine whether it becomes a temporary disruption or an existential threat. As Kenya's digital economy continues to grow, organisations must prioritise cyber resilience and take proactive steps to protect themselves against increasingly sophisticated cyber threats. By doing so, they can minimise the financial and reputational impact of a cyber incident.
Key points
- Kenya's digital economy expansion brings rising cyber threats
- Cyber liability insurance can help organisations recover from cyber incidents
- Leadership plays a crucial role in cyber resilience
