Kenya's digital space faced increased pressure in the 2025/2026 financial year, with the Communications Authority of Kenya (CA) recording 11,124,632,684 cyber threats. This represents a 29% rise from the 8,622,876,858 incidents reported in the previous financial year. The CA attributes the increase to growing attempts by attackers to target systems, networks, and online services.
Distributed Denial-of-Service (DDoS) attacks saw a significant increase, more than doubling during the period. The CA recorded 72,164,664 DDoS attacks, up 114.3% from the 33,680,462 incidents reported in the 2024/2025 financial year. DDoS attacks involve sending huge amounts of traffic or requests to a system, network, or online service to disrupt its normal operation.
Despite the sharp decline in DDoS attacks in the final three months of the financial year, the annual figure exceeded that of the previous year. The regulator recorded 819,325 DDoS attacks between April and June 2026, down 90% from the 8,202,803 attacks reported between January and March. This decline was not enough to offset the higher numbers recorded during other periods.
Other forms of cyber threats also increased during the 12-month period. Malware attacks rose by 64.8% to 230,307,810, while web application attacks increased by 99% to 51,508,883. Mobile application attacks went up by 54% to 789,826. Brute force attacks, which involve repeated attempts to break into systems or accounts without authorization, increased by 3.6% to 132,225,836.
System vulnerabilities continued to make up the largest category recorded by the authority. The CA reported 10,637,635,755 incidents linked to system vulnerabilities during the financial year, an increase of 28.2% compared with the previous year. This rise was also reflected in the number of cyber advisories issued by the regulator.
A total of 83,096,015 cyber advisories were recorded during the financial year, compared with 51,663,024 advisories in 2024/2025, representing a 60.8% increase. Brute force advisories recorded the biggest growth, rising by 365.5%. Web application advisories followed with a 110.5% increase, while DDoS advisories rose by 3.1% to 2,673,948.
The figures point to a broad increase in cyber activity during the financial year, with Kenya recording higher numbers across several categories of attacks, vulnerabilities, and advisories. The CA's data highlights the growing need for robust cybersecurity measures to protect Kenya's digital infrastructure. The regulator's efforts to monitor and address cyber threats are crucial in mitigating the impact of these attacks.
Key points
- Kenya recorded 11.1 billion cyber threats in the 2025/2026 financial year.
- DDoS attacks increased by 114.3% to 72,164,664.
- System vulnerabilities made up the largest category of cyber threats, with 10,637,635,755 incidents recorded.
