Kenya's digital economy is growing at an unprecedented rate, with businesses increasingly processing payments online, storing critical data in the cloud, and relying on interconnected systems to serve customers in real-time. However, this expansion also brings a rapidly evolving threat landscape. The Communications Authority of Kenya reported a significant increase in detected cyber-threat events.
The Communications Authority of Kenya reported 11.12 billion detected cyber-threat events in the financial year ended June 2026, a 29% increase year-on-year. System vulnerabilities accounted for 10.64 billion events, while malware-related threats rose by nearly 65%. These figures highlight the financial, operational, and reputational risks that cyber threats pose to businesses.
Cybersecurity Awareness Month, observed in October, emphasizes the importance of constant vigilance in reducing vulnerabilities. As organizations become more dependent on digital infrastructure, the question is no longer whether cyber threats exist, but whether businesses are prepared to withstand them. A cyber incident can have severe consequences, including halting operations, preventing access to essential records, and disrupting customer service.
According to PwC's recently published Cyber Digest, artificial intelligence is enabling more sophisticated cyberattacks, including automated exploitation of system vulnerabilities, deepfakes, and voice cloning to impersonate trusted individuals. These techniques can make fraud harder to detect, increasing the pressure on businesses to strengthen their cybersecurity measures.
The impact of a cyber incident extends beyond the attack itself to operational disruptions, recovery costs, legal expenses, and reputational damage. Small and medium-sized enterprises (SMEs) are particularly vulnerable to cash-flow pressures and business continuity challenges. Cyber resilience is therefore not simply about preventing attacks, but also about ensuring an organization can identify an incident, contain its effects, recover operations quickly, and absorb the associated costs.
Kenya's regulatory environment reinforces the need for preparedness, with the Data Protection Act, 2019, requiring organizations that experience a personal data breach to notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of the incident. Meeting these obligations requires clear reporting structures, response procedures, and decision-making protocols that can be activated immediately when an incident occurs.
Effective cyber risk management requires leaders to protect critical systems and data, strengthen access controls and backups, train employees to identify threats, verify unusual payment requests, and assess the security of external providers. Cyber liability insurance can provide cover for specified financial losses arising from covered cyber incidents, complementing security measures and supporting business continuity planning.
Key points
- Kenya's digital economy is expanding rapidly, but with it comes a growing threat of cyber attacks.
- The Communications Authority of Kenya reported 11.12 billion detected cyber-threat events in the financial year ended June 2026.
- Cyber liability insurance can provide cover for specified financial losses arising from covered cyber incidents.
