Kenya’s digital economy is expanding rapidly, with businesses processing payments online, storing data in the cloud and relying on interconnected systems. However, as organisations accelerate digital transformation, they are becoming increasingly exposed to cyber threats.
The scale of the risk is evident.
The Communications Authority of Kenya reported 11.12 billion detected cyber-threat events in the financial year ended June 2026, a 29 per cent increase year-on-year. System vulnerabilities accounted for 10.64 billion events, while malware-related threats rose by nearly 65 per cent. Although these figures do not represent confirmed attacks, they high-light the growing risks facing businesses.
Cybersecurity Awareness Month, observed in October under the theme “Don’t Make It Easy for Them”, is a timely reminder that protecting digital infrastructure requires constant vigilance.
A cyber incident is rarely just a technical problem. Ransomware can halt operations, disrupt customer services and lock organisations out of essential records. Data breaches can expose sensitive information, trigger regulatory obligations and undermine customer trust.
According to PwC’s Cyber Digest, titled AI-Driven Defence in the Age of AI-Driven Threats, artificial intelligence is enabling increasingly sophisticated attacks, including automated exploitation of system vulnerabilities, deepfakes and voice cloning to impersonate trusted individuals.
Kenya’s Data Protection Act, 2019, requires organisations experiencing personal data breaches that pose a real risk of harm to notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of an incident. Data processors must notify controllers without delay and, where reasonably practicable, within 48 hours.
Compliance requires clear reporting structures, response procedures and decision-making protocols. Businesses must also strengthen access controls, maintain secure backups, train employees to identify threats and assess third-party security risks.
However, prevention alone cannot eliminate cyber risk. Organisations must also prepare for financial recovery. Cyber liability insurance can cover specified losses arising from covered incidents, including business interruption, data recovery, incident response and legal expenses, depending on policy terms.
Such insurance does not replace security controls or cover every loss. Rather, it complements broader risk-management and business-continuity measures.
Ultimately, cyber resilience is a leadership responsibility. Businesses must be prepared to detect threats, contain incidents, restore operations and manage financial consequences. Their ability to recover may determine whether a cyber incident becomes a temporary disruption or an existential threat.