Kenya’s digital transformation is creating opportunities at a scale few could have anticipated a decade ago. Mobile money, digital banking, e-commerce, cloud computing and connected public services have changed how people and businesses transact, communicate and operate.
Kenya sits at the centre of this transformation. Mobile money has become deeply embedded in the economy, while businesses and public institutions are rapidly digitizing their operations and services.
“But there is a less celebrated side to this progress. As Kenya and East Africa becomes more connected, it is also becoming a more attractive target for cybercriminals,” said Imran Chaudhrey, Country Manager – East Africa, Fortinet
He says Cybersecurity can no longer be treated as a technical issue left to IT departments. It is increasingly a business continuity, economic resilience and consumer trust issue. The ability to protect digital infrastructure will determine how confidently businesses and governments can continue investing in the region’s digital future.
The scale of the threat is becoming harder to ignore.
The INTERPOL African Cyberthreat Assessment Report 2026 recorded more than 46,000 distributed denial-of-service attacks against Kenya during the first half of 2025, with telecommunications infrastructure among the sectors most targeted.
Kenya also featured prominently in phishing detections, while government and ICT infrastructure faced hundreds of millions of intrusion attempts.
These figures matter because East Africa’s cyber risks are evolving alongside its digital economy.
“The region’s dependence on mobile payments, digital identities and connected infrastructure creates new opportunities for attackers to exploit. SIM-swap fraud provides a clear example,” said Chaudhrey.
Kenya’s experience with cybercriminals in 2025
According to the Interpol report, Kenya recorded a 327 per cent increase in SIM-swap fraud in 2025, involving more than 123,000 fraudulent SIMs and estimated losses of US$3.8 million.
A mobile number is no longer simply a means of communication.
For millions of people, it can be the gateway to banking, mobile payments, e-commerce and a growing range of digital services. Compromising that identity can therefore expose much more than a single device or account.
This makes digital identity protection an increasingly important part of financial inclusion. As more people enter the formal economy through digital channels, the security of those channels becomes central to maintaining confidence in the systems that support them.
Artificial intelligence is adding another dimension to the challenge. It is already improving productivity, supporting innovation and creating new business models. The same technology, however, is giving cybercriminals new tools to make attacks more convincing and easier to scale.
AI-enabled phishing, personalised scams, fraudulent communications and deepfakes can make it increasingly difficult for individuals and organisations to distinguish genuine interactions from malicious ones. Traditional warning signs are becoming less reliable when attackers can generate convincing content at speed.
The risk extends beyond financial crime.
Critical infrastructure is becoming increasingly digitised, connecting essential services to networks that must be protected against disruption. The cyber incident that affected Uganda’s electricity utility last year demonstrated the potential consequences when digital systems supporting essential services are compromised.
“As the region’s economies modernize their energy, telecommunications, transport and public-service infrastructure, cybersecurity needs to be incorporated into those investments from the outset,” said Chaudhrey
There are encouraging signs.
Countries across the East African region are strengthening national cybersecurity strategies, regulatory frameworks and digital resilience programmes.
Kenya has also taken steps to address emerging threats, including SIM-swap fraud and scam calls, while greater cooperation among Computer Emergency Response Teams is improving information sharing and coordinated responses.
But legislation and regulation alone will not secure Kenya and the region’s digital economy.
Kenyan businesses have an equally important role to play. Cybersecurity needs to be considered alongside other core business priorities such as financial management, operational resilience and customer experience.
Organizations adopting cloud platforms, artificial intelligence, digital payment systems or connected technologies should build security into those investments from the beginning rather than attempt to retrofit it later.
Collaboration is equally important. Cybercriminals do not respect corporate boundaries or national borders, and organisations cannot effectively respond to every emerging threat in isolation.
Greater sharing of threat intelligence across industries, governments and cybersecurity communities can strengthen collective resilience. Technology, however, is only part of the equation. People remain one of the most important lines of defence.
Leave a comment