Kenya is moving to operationalise its National Cybersecurity Agency and strengthen coordination among national security institutions after detecting approximately 2.6 billion cyber threat events in the three months to September 2026, highlighting growing pressure on the country’s digital infrastructure.
The Communications Authority of Kenya (CA) detected the threats between July and September, representing a 14.45 per cent increase from the previous quarter, according to Director General David Mugonyi, who spoke during the opening of the 7th Africa Cyber Defense Forum (ACDF 2026) in Nairobi on Wednesday.
During the period, the Authority issued more than 20 million cyber threat advisories through the National Kenya Computer Incident Response Team Coordination Centre (National KE-CIRT/CC), warning organisations and other stakeholders about emerging risks and recommending measures to strengthen their cyber defences.
Mugonyi said Kenya’s expanding digital economy was creating new security challenges, with cybercriminals increasingly deploying Advanced Persistent Threats (APTs), ransomware, data extortion, supply chain attacks and zero-day vulnerabilities. He also warned about the growing misuse of artificial intelligence to automate cyberattacks and facilitate deepfake fraud and impersonation.
The threats are targeting critical information infrastructure across e-government, telecommunications, banking and finance, information and communications technology, and academia. Attacks on these systems could disrupt essential services, compromise business operations and undermine public confidence in digital platforms.
Kenya’s digital footprint has expanded significantly, with mobile data subscriptions reaching 64.3 million and active mobile subscriptions standing at 88 million, equivalent to a penetration rate of 165 per cent.
Speaking at the same event, Information, Communications and the Digital Economy Cabinet Secretary William Kabogo said the government would prioritise strengthening national cybersecurity institutions, protecting critical infrastructure and expanding the country’s technical capabilities.
A key priority is operationalising the National Cybersecurity Agency, established this year to lead national cybersecurity efforts and operate the National Cybersecurity Operations Centre.
The government also intends to strengthen coordination between the agency and existing institutions, including the National Computer and Cybercrimes Coordination Committee (NC4), National KE-CIRT/CC and the Office of the Data Protection Commissioner.
Other priorities include working with providers of Critical Information Infrastructure (CII) across various sectors to improve their security, expanding cybersecurity training through universities and technical institutions, and ensuring security is incorporated into government digital programmes.
AI-driven cybercrime and skills shortage
Kabogo warned that artificial intelligence was adding another dimension to Africa’s cybersecurity challenges, with criminals increasingly using the technology for deepfake impersonation, fraud and automated phishing.
Citing INTERPOL’s African Cyberthreat Assessment Report 2026, he said more than half of the cybercrimes reported across the continent now involved artificial intelligence.
He said Kenya would address these risks through its National Artificial Intelligence Strategy 2025–2030, treating security and trust as essential conditions for AI adoption while developing the skills needed to identify and counter AI-enabled threats.
The Cabinet Secretary also highlighted Africa’s shortage of cybersecurity professionals, estimating that the continent has approximately 400,000 cybersecurity practitioners, fewer than a third of whom are formally certified.
He called for increased investment in cybersecurity education and professional development, particularly through universities, technical training institutions and regional centres such as the African Advanced Level Telecommunications Institute (AFRALTI).
Kabogo said Africa needed to expand its pool of skilled professionals to match the growing complexity of threats facing governments, businesses and digital infrastructure.
Cybersecurity investment also remains uneven across the continent. Citing Serianu’s Africa Cybersecurity Report 2024/2025, he said African countries spent an estimated $15.3 billion on cybersecurity, equivalent to approximately 0.55 per cent of GDP, but still lost about $5 billion, or 0.18 per cent of GDP, to cybercrime.
He noted that much of the continent’s cybersecurity spending was concentrated in a few markets, including Kenya and Nigeria, calling for more strategic investment to protect critical sectors and ensure that the benefits of digital transformation were not undermined by cybercrime.
Kenya among Africa’s top cybersecurity performers
Kabogo said Kenya’s inclusion in Tier 1, the highest category of the International Telecommunication Union’s Global Cybersecurity Index 2024, reflected sustained efforts to strengthen the country’s cybersecurity framework.
The category comprised 46 countries globally, including seven African nations: Kenya, Egypt, Ghana, Mauritius, Morocco, Rwanda and Tanzania.
The ITU index assesses national cybersecurity commitments across five pillars: legal measures, technical measures, organisational measures, capacity development and cooperation.
However, Kabogo warned that countries were performing better in developing legal frameworks than in building technical capabilities and developing cybersecurity talent.
He said governments needed to move beyond policy and legislation and invest in technical expertise, resilient infrastructure, incident detection and response systems, and continuous public awareness.
Africa’s cyber sovereignty agenda
The 7th Africa Cyber Defense Forum was held under the theme, “Africa’s Cyber Sovereignty: From Vision to Action in a Fragmented World,” reflecting growing concerns about the security of digital infrastructure, data governance and Africa’s position in an increasingly fragmented global technology landscape.
Kabogo said cyber sovereignty should not mean isolating African countries from the global digital economy. Instead, it should give them the capacity to secure critical systems, develop local talent, govern their data in accordance with national laws and values, and cooperate internationally on terms that serve their citizens.
He said geopolitical rivalry, competing technology standards and divergent rules governing data and digital trade made it increasingly important for African countries to strengthen their ability to make independent decisions about their digital futures.
Kenya will continue working with regional and international partners, including the African Telecommunications Union and the Africa Cyber Defense Forum, to advance cybersecurity cooperation, information sharing and technical capacity development.
Mugonyi called on participants to translate the discussions into practical commitments, stronger partnerships and measurable improvements in cybersecurity capabilities.
He also emphasised that cybersecurity could not be achieved through institutional and technical measures alone, urging businesses, public institutions and individual users to take responsibility for protecting the digital environment.
The Communications Authority will continue strengthening national incident coordination through the National KE-CIRT/CC and other stakeholders, while promoting a communications environment that is secure, reliable, affordable and inclusive.
The forum was co-hosted by the Communications Authority of Kenya and the Africa Cyber Defense Forum, bringing together government officials, regulators, cybersecurity professionals, development partners and industry representatives to discuss Africa’s digital security priorities.