Introduction: Why This Report Matters to Every Kenyan
Much of daily life in Kenya now happens online. We send and receive money on our phones, apply for government services on eCitizen, keep medical records in hospital systems, learn on digital platforms and run businesses through apps and websites. The more of our lives that move online, the more attractive those systems become to criminals.
The National KE-CIRT/CC (Kenya’s national Computer Incident Response Team, under the Communications Authority of Kenya) watches for these threats and warns organisations about them. Its latest National Cybersecurity Report, covering April to June 2026, gives a clear picture of what is happening.
During those three months, the KE-CIRT/CC detected 2.36 billion cyber threat events and sent out more than 20.7 million cyber threat advisories (warnings to affected organisations). That is about 30% fewer threats than in the previous quarter. This is welcome news, but it is not a reason to relax.
The real value of the report is not the size of the numbers. It is what the attacks reveal about where Kenyan systems are weak, and how attackers are getting in.
Many Kinds of Attacks, All at Once
The report names three of the most common types of attack:
Ransomware: criminals lock up an organisation’s files and systems, then demand payment to unlock them.
Distributed Denial-of-Service (DDoS): attackers flood a website or online service with fake traffic until it slows down or crashes, so genuine customers cannot use it.
Social engineering: tricking people into handing over passwords, money or information.
The report also records continued data breaches, where personal, financial and business information is leaked or stolen.
In other words, Kenya no longer faces just one kind of threat. Organisations are dealing with a mix of weak technology, stolen passwords, poorly set-up systems, people being tricked, and attacks on websites and online services, all at the same time.
These threats also travel fast. The report notes that methods used by attackers around the world are being copied and adapted in Kenya. A scam that appears abroad today can reach Kenyan phones and inboxes tomorrow.
Old, Unpatched Systems Are Still the Biggest Problem
The largest category of threats in the report is system attacks: more than 2.25 billion events, the vast majority of everything detected during the quarter.
The report links these attacks mainly to:
outdated operating systems (the core software that runs computers and servers);
security updates, known as patches, that have not been installed;
old (“legacy”) equipment and software that is no longer properly supported;
weak controls over who can access what;
information leaking out of systems; and
· harmful links.
These are basic security tasks, yet many organisations are still getting them wrong. The problem is usually not a lack of security products. It is whether those products are kept up to date and used properly.
Think of a house with a strong gate but a broken back window. An organisation can have firewalls, antivirus software and monitoring in place and still be easy to break into if important systems are not updated, old equipment is left exposed, or access settings are careless.
The lesson is simple: good security depends not only on the tools you buy, but on how well you maintain and use them.
Websites and Online Services Are Under Growing Attack
Attacks on web applications, the websites, portals and apps we use to log in, pay and apply for services, are rising sharply. The KE-CIRT/CC detected 17.4 million web application attack attempts during the quarter, an increase of 43.68% over the previous quarter. Government systems and Internet Service Providers were among the main targets.
According to the report, attackers are taking advantage of:
weaknesses in ready-made building blocks that developers reuse, including third-party and open-source software;
poorly protected APIs (the connections that let different systems talk to each other, for example when an online shop connects to a mobile money service); and
badly configured cloud services.
The report also describes attacks that let outsiders run their own commands on a system without logging in, gain more access than they should have, or plant harmful code in web pages that then runs on visitors’ devices.
The wider point is that modern websites and apps are not built as single, closed systems. They are assembled from many parts supplied by different providers. A weakness in just one of those parts can put the whole service, and its users, at risk. That is why application security is now a matter for management and leadership, not only for software developers.
Stolen Passwords: Attackers Are Logging In, Not Breaking In
Another major trend in the report is the use of stolen login details. Around the world, criminals are increasingly logging in rather than breaking in, using stolen passwords, hijacked user accounts, and the trusted access that organisations give to their suppliers and partners.
Kenyan data supports this. The KE-CIRT/CC recorded more than 24.2 million brute-force attacks, in which computer programs guess passwords over and over until one works. Targets included login pages, databases, email servers, cloud services, and the remote-access systems and VPNs that staff use to work from outside the office. Weak passwords, poorly secured remote desktop tools (which allow a computer to be controlled from a distance) and stolen login details all made these attacks easier.
This changes how organisations should think about protection. Guarding the network is still important, but it is just as important to control who can log in and what each person is allowed to access. As more services move to the cloud and to remote working, someone with a valid username and password may be able to walk straight in without breaking anything at all.
Scams Are Getting Harder to Spot
People remain one of the main targets. The report highlights increasingly convincing scams, including emails written by artificial intelligence (AI), fake login pages, deepfake videos (fake videos that look like a real person) and voice cloning, where a caller sounds exactly like your boss, a colleague or a relative. The goal is to get people to reveal passwords or approve fake payments.
The old advice to “look out for bad spelling” is no longer enough. AI can make a scam message polished, personal and believable.
For organisations, this means security awareness cannot be a once-a-year training session. It must be ongoing, and it should be backed by technical safeguards and clear checks. For example, staff should confirm any unusual payment request by calling back on a known number before acting on it.
AI Is Helping Both Attackers and Defenders
The report shows that criminals are now using AI to:
· research their targets automatically;
· write convincing phishing (scam) messages;
· create malware (harmful software); and
· support deepfake fraud.
AI is also helping attackers find weaknesses faster, which shortens the time between a flaw being discovered and someone trying to exploit it.
At the same time, AI can help defenders spot threats and find weaknesses sooner. Organisations should therefore treat AI not only as an opportunity for innovation, but also as part of their cybersecurity risk.
The Common Thread: Weak Spots Nobody Is Watching
Looking at the report as a whole, a clear pattern appears:
· attacks on websites exploit weak software components and poorly protected APIs;
· system attacks take advantage of outdated equipment and missed updates;
· brute-force attacks take advantage of weak passwords;
· scams take advantage of human trust; and
· malware continues to target vulnerable systems and sensitive information.
These are different methods, but most of them lead back to one problem: weak spots that have not been found, are not being managed, or are not properly controlled.
Such a weak spot could be in an app, an API, a server, a user account, a supplier’s software, a remote-access service, or even in one person’s decision to click a link.
That is why organisations need to move beyond asking, “Do we have security tools?” and start asking a more useful question:
“Do we know where we are exposed, and are our protections actually reducing that risk?”
What This Means for Organisations in Kenya
The KE-CIRT/CC findings show that cybersecurity must be a continuous effort, guided by risk, rather than a one-off project.
Organisations should know what they have: their equipment, applications, users, weaknesses and suppliers. They need a way to find weaknesses, fix the most dangerous ones first, and then check that the fixes actually worked.
This is especially important for organisations that run critical or sensitive services, such as banks, hospitals, utilities and government agencies. A single weakness in a public website or app can take a service offline, expose customer data, disrupt payments and damage public trust. For ordinary Kenyans, that can mean a service you rely on suddenly becoming unavailable, or your personal information ending up in the wrong hands.
What This Means for You
Cybersecurity is not only a concern for organisations. The same weaknesses described in the report affect individuals too. A few simple habits go a long way:
Update your devices. Install updates on your phone and computer when prompted. Outdated software is the biggest weakness the report identifies.
Use strong, different passwords. Avoid using the same password everywhere, and switch on two-step verification (such as a one-time code) for email, social media and banking apps wherever it is offered.
Never share your PIN, password or one-time code. No genuine bank, mobile money provider or government office will ask you for them.
Pause before you act on urgent requests. Be suspicious of messages or calls that pressure you to send money or share details quickly, even if they are well written or sound like someone you know. Hang up and call back on a number you trust.
Avoid clicking on links in unexpected messages. Type the website address yourself or use the official app instead.
Report incidents quickly. If you think you have been scammed or hacked, contact your bank or service provider immediately, and report it to the National KE-CIRT/CC through the Communications Authority of Kenya.
Conclusion: More Connected, More Exposed
Kenya’s cybersecurity landscape in 2026 is not defined by any single threat. It is defined by systems that are more connected than ever, facing attackers who adapt quickly.
The drop in detected threats between April and June is encouraging, but it does not mean the danger has passed. The challenge for organisations is shifting from reacting to individual attacks towards continuously finding and closing weak spots before criminals can use them.
At South-End Tech, we see cybersecurity as an ongoing process: understanding risk, finding weaknesses and strengthening the protections that keep organisations running. Through security assessments, vulnerability testing, application security and risk management, we help organisations stop simply reacting to incidents and start reducing their risk before an incident happens.
The threats are changing. Our defences, as organisations and as individuals, must change with them.
Ready to understand your organisation’s cyber risk?
Let’s talk.
Tel: +254 728 223 333
cybersecurity@southendtech.co.ke
dataprotection@southendtech.co.ke
South-End Tech Limited — Helping businesses build visible and cyber-resilient enterprises.