By 
Kenya's national cyber incident centre detected 11.12 billion threat events in the 2025/26 financial year, a 29% increase from the 8.62 billion recorded the year before, according to the Communications Authority of Kenya (CA). The figure counts detected activity on monitored networks. It is not a count of successful intrusions or confirmed data breaches, a distinction that matters for any business deciding how much of the headline applies to its own systems.
The data comes from the CA's fourth-quarter sector statistics report, which covers April to June 2026 and closes out the financial year. The National Kenya Computer Incident Response Team Coordination Centre (KE-CIRT/CC), which operates under the CA, compiles the detections. Reporting by Innovation Village puts the exact total at 11,124,632,684 events.
What the quarterly numbers show
The year was uneven. Detections peaked between October and December 2025 at 4.56 billion events, then fell to 3.37 billion in January to March 2026 and to 2.36 billion in April to June. That last quarter was down roughly 30% on the one before it, according to Capital FM's account of the CA report.
The decline in the final quarter does not reverse the annual trend. The full-year total still sits well above 2024/25, and Kenya's own officials have said the volume is likely to keep climbing. Interior Cabinet Secretary Kipchumba Murkomen told the National Assembly's Departmental Committee on Administration and Internal Security on April 21, 2026, that about 8.6 billion attacks are reported against ICT infrastructure annually and that the number is set to rise, the Nation reported.
Why system vulnerabilities dominate
Almost all of the volume sits in one category. The CA classifies about 10.6 billion of the year's events as system vulnerability attempts, an increase of 28.2% on the previous year. In the January to March quarter alone, system attacks accounted for more than 3.23 billion of 3.37 billion events, or about 96%, according to the CA's quarterly report as reported by Dawan Africa.
These events are largely automated. The CA's own quarterly reports describe threat actors scanning internet-facing systems for exposed services, default configurations and weak passwords. A scan that probes a server and finds nothing exploitable is still logged as a detection. That is why the headline total is better read as a measure of hostile traffic reaching Kenyan networks than as a measure of damage done.
The smaller categories show faster growth, even if their volumes are modest by comparison, according to summary of the CA data:
DDoS attacks rose 114.3% to 72.1 million, up from 33.7 million.
Web application attacks increased 99% to 51.5 million.
Malware attacks rose 64.8% to 230.3 million.
Mobile application attacks increased 54% to 789,826.
DDoS events, despite doubling, made up less than 1% of all detections, according to IT News Africa.
Advisories and the response side
The CA also tracks the warnings it sends to affected organisations. Cyber advisories issued to ICT users rose 60.8% to 83.1 million, from 51.7 million a year earlier. Advisories on brute-force attacks rose 365.5% to 25.5 million, while advisories on web application attacks increased 110.5% to 40.5 million.
The regulator has previously attributed the persistent threat environment to inadequate system patching, low cybersecurity awareness, phishing and social engineering, and the growing use of artificial intelligence and machine-learning tools by cybercriminals. It lists government agencies, educational institutions, financial institutions and telecommunications companies as the sectors most targeted, because they hold large volumes of sensitive data.
Where real losses show up
Detected events and actual harm are measured differently, and the available loss data points in a different direction from the headline. Murkomen told the committee that Kenya loses at least Sh29 billion a year to cybersecurity and related threats, according to the Nation. He cited the defacement of government websites in 2025 and a ransomware attack on the Kenya Highways Authority (Kenha) in May 2026 as examples of incidents that caused disruption. The Interior ministry asked the committee for Sh4 billion to fully operationalise the National Cybersecurity Agency, which would cover a security operations centre, policy development, capacity building and software subscriptions.
For ordinary users, the more common harm is fraud and impersonation rather than ransomware. INTERPOL's African cyber threat report, released in August, said SIM swap fraud investigations in Kenya rose 327% in 2025, Innovation Village reported. Kenya had 54 million mobile money subscriptions by June 2026, a base that gives fraudsters a large pool of targets.
What businesses should read from it
The figures support a few practical readings, none of which require treating 11.12 billion as a body count.
First, the period matters. A year-on-year comparison smooths out the sharp quarterly swings, and the October to December peak shows how quickly detection volumes can spike. Second, the type of activity matters. A business running exposed, unpatched services faces the category that makes up most of the total. A business whose main exposure is staff credentials faces the brute-force and phishing categories, where advisory growth was steepest. Third, the CA's detections come from monitored national infrastructure, so they do not substitute for a company's own logs.
Autonomous AI agents widen the question
The threat figures arrive as discussion at recent technology forums has turned to autonomous AI agents that connect directly to company email, enterprise databases and checkout systems. TechInKenya could not independently confirm the specific remarks made at those events, so this section relies on published research and Kenyan law rather than on forum statements.
AI agents differ from earlier automation because they can analyse data, make decisions and carry out multi-step tasks across business systems. A Cloudera report, summarised by Kiteworks, found that 96% of surveyed organisations plan to expand their use of AI agents over the next year, while more than half named data privacy as the main obstacle. Both Cloudera and Kiteworks are commercial parties, and the survey reflects global respondents rather than Kenyan firms. The same summary notes that giving agents more autonomy means giving them access to more organisational data, and that agents can potentially reach files, databases and communication threads without clear limits.
That access pattern intersects with what the CA says is already going wrong. The regulator's quarterly reporting describes weak authentication controls and misconfigured systems as leading causes of successful incidents in Kenya. An agent holding standing credentials to a mailbox or a payments system adds another identity that attackers can target through the same weaknesses. The CA has also said attackers are increasingly using AI themselves.
On the compliance side, Kenya's Data Protection Act, 2019, which came into force on November 25, 2019, applies to the processing of personal data by or for a data controller, whether the means used are automated or not, according to Securiti. A company that allows an agent to read customer emails or query a customer database is processing personal data in that sense, and the obligations that attach to controllers and processors do not change because software, rather than an employee, performs the task.
Security vendors recommend a common set of controls for this setup: inventory every agent in use, apply least-privilege access, minimise the data an agent can see, log its interactions and audit them regularly. Some enterprise deployments described in vendor case studies also tokenise or redact fields such as email addresses before data reaches an agent. These are vendor recommendations, not Kenyan regulatory requirements, and their effectiveness in local deployments has not been independently reported.
The CA data and the agent discussion point to the same operational issue: who and what has access to systems, and whether that access is logged. The 11.12 billion figure shows how much probing Kenyan networks absorb. How much of it turns into loss depends largely on the basics the regulator keeps listing, namely patching, authentication and staff awareness.
Comments