October 29, 2025 • Patrick Meki

Introduction

Kenya's cyber threat landscape experienced a dramatic shift in the first quarter of the 2025/2026 financial year. According to the Communications Authority of Kenya’s (CA) latest Cybersecurity Report, detected threat events dropped by a significant 81.64%, from billions in the previous quarter to 842 million between July and September 2025.

However, this sharp decline does not mean the danger is gone. In fact, it signals a shift in tactics. Cyber threats are becoming more sophisticated, not less dangerous. In response, the National KE-CIRT/CC (Kenya Computer Incident Response Team - Coordination Centre) intensified its defensive operations, issuing over 19.9 million proactive advisories, representing a 15.53% increase from the previous quarter.

In this blog, I break down the key findings from the report, what they mean for Kenyans, and how we can collectively build stronger cyber resilience.

1. The Threat Landscape by the Numbers

Despite the overall reduction in threat volume, certain categories of attacks continued to dominate the digital landscape.

• System Attacks: Over 776 million detections, largely driven by the proliferation of Internet of Things (IoT) devices, many of which still lack robust security protocols.

• Malware: 31.6 million detections, reflecting persistent attempts to compromise systems and exfiltrate data.

• Brute Force Attacks: 18.8 million detections, showing continued interest in credential-based intrusions.

• Web Application Attacks: 10.4 million detections, targeting online platforms and cloud-based services.

The most targeted sectors include critical national infrastructure, ISPs, cloud providers, government systems, and the healthcare sector. These areas, if disrupted, could have far-reaching national impacts.

2. The New Wave of AI-Powered Attacks

The CA report highlights that quality now outweighs quantity. Cybercriminals are leveraging Artificial Intelligence to enhance attack sophistication and evade traditional detection systems.

Key emerging threats include:

• AI-Generated Deepfakes: Used to spread disinformation or impersonate trusted figures.

• Smarter Social Engineering: Attackers now deploy AI-generated phishing campaigns and voice deepfakes, making scams more convincing.

• AI-Augmented Ransomware: Ransomware-as-a-Service (RaaS) operations are evolving, using AI to optimize infection paths and negotiation tactics.

• Advanced Persistent Threats (APTs): State-sponsored groups continue to infiltrate Kenya’s digital infrastructure for espionage and long-term data theft.

This evolution marks a shift from random, high-volume attacks to targeted, intelligence-driven operations that demand stronger national and organizational defences.

3. Building a National Cyber Defence

Considering these emerging threats, Kenya is ramping up national cyber capacity through education, collaboration, and strategic partnerships.

• Training the Experts:
  A four-day Cyber Threat Intelligence (CTI) program trained 87 personnel from 25 critical organizations, supported by the UK’s Foreign, Commonwealth & Development Office (FCDO). Additionally, a two-week Huawei bootcamp upskilled 52 government technical officers.

• Engaging the Youth:
  The Cybersecurity Youth Forum, the first of its kind in Kenya was co-hosted by the CA to empower young people to combat misinformation and disinformation online.

• Sharing Knowledge:
  Kenya continues to strengthen its regional leadership in cybersecurity. The CA hosted Namibia’s Communications Regulatory Authority (CRAN) for benchmarking on National Public Key Infrastructure (NPKI) and is currently guiding the Insurance Regulatory Authority (IRA) in establishing a sector-specific Cyber Security Operations Centre (CSOC).

Conclusion

Kenya’s cyber landscape is changing fast, and threats are becoming smarter, stealthier, and more persistent. While the drop in detected attacks might seem like progress, it’s a signal to stay vigilant, not relaxed.

The National KE-CIRT/CC reminds all Kenyans that basic cyber hygiene remains the first line of defence:

• Patch your systems regularly.

• Use strong passwords and enable Multi-Factor Authentication (MFA).

• Stay alert to suspicious emails, calls, or messages.

• Report incidents immediately to incidents@ke-cirt.go.ke.

Cybersecurity is a shared responsibility, and by staying informed and proactive, Kenya can continue building a safer digital future.

 

Telephone: +254 115 867 309 | +254 740 196 519 
Email: cybersecurity@southendtech.co.ke| info@southendtech.co.ke |

 

---

Comments (0)