Kenya recorded 11.12 billion cyber threat events in the last financial year, a 29% increase from 8.62 billion a year earlier, as artificial intelligence gives cybercriminals new ways to automate scams, impersonate trusted individuals and target businesses operating online.
For Kenya’s small businesses, the surge presents a costly dilemma: they are becoming more dependent on digital payments, online platforms and customer data, yet many lack the security teams and budgets needed to defend themselves against increasingly sophisticated attacks.
A successful breach can mean more than lost information. It can interrupt sales, freeze business operations, expose customer records and leave owners paying to restore systems while trying to rebuild customer trust.
The figures, reported by the Communications Authority of Kenya, formed the backdrop to Safaricom’s fourth annual Cybersecurity Summit in Nairobi on Wednesday, where the telecommunications company highlighted the growing role of artificial intelligence in both cyberattacks and digital defence.
“Cybersecurity can no longer be treated as a technical safeguard added after a service is developed,” Safaricom Group Chief Executive Officer Peter Ndegwa said.
Ndegwa said security needed to be built into digital services from the outset, supported by shared standards and cooperation across sectors.
The summit examined threats including deepfakes, AI-generated impersonation, automated scams and ransomware, which can exploit human trust as well as weaknesses in technology.
AI raises the cost of doing business
Artificial intelligence is changing the economics of cybercrime. Attackers can use it to generate convincing messages, imitate executives and automate fraudulent requests, while security teams use similar technology to identify suspicious activity and respond to threats.
For a small business, the danger could arrive as an email from someone posing as a supplier and requesting a change to bank details, or a message impersonating a manager seeking an urgent payment. If employees cannot verify the request, a single deception can trigger a financial loss.
The financial consequences can extend beyond the initial fraud. Businesses may have to restore compromised systems, investigate what happened, notify affected customers and deal with interrupted operations. For smaller firms with limited cash reserves, even a short disruption can put pressure on their finances.
Small businesses lack enterprise-sized defences
Kenyan small and medium-sized enterprises account for about 98 percent of businesses and contribute over 30 percent to GDP, according to Kenya Bankers Association (PDF), making their ability to withstand cyber incidents important to the wider economy.
Yet maintaining specialists who monitor networks around the clock, investigate suspicious activity and coordinate responses can be beyond the reach of many smaller businesses.
Safaricom says its Managed Security Operations Centre provides continuous threat monitoring, expert analysis and coordinated incident response. Its recently launched Software-Defined Wide Area Network service offers centrally managed connectivity for businesses operating across multiple locations.
The services are designed to give companies access to security capabilities typically associated with larger enterprises without requiring them to build and maintain the same infrastructure themselves.
However, Safaricom has not disclosed the number of businesses using these services, their pricing or how many incidents they have helped prevent. Those figures would help businesses assess whether the offering is affordable and whether it delivers measurable protection.
The wider digital economy is exposed
Kenya’s growing dependence on digital services increases the amount of business and customer information that needs protection. Safaricom says its connectivity network covers more than 99% of the country’s population, while its M-PESA platform serves 41 million customers who can transact, save or borrow using their mobile phones.
As digital payments and online commerce become more embedded in everyday business, cybersecurity failures can affect customers, suppliers and the movement of money across the economy.
The 11.12 billion figure, however, should not be interpreted as 11.12 billion successful cyberattacks. Threat events can include detected activity that does not result in a breach. The reported figures do not establish how many incidents caused financial losses or how much money businesses lost.
That distinction matters because the number of threats detected does not, on its own, measure the financial damage suffered by businesses.
For small firms, the challenge is becoming twofold: finding affordable ways to defend against increasingly sophisticated attacks and ensuring that the money spent on cybersecurity translates into measurable protection. Kenya is not the only country affected, a recent report by Mastercard dubbed Africa’s Digital Defense Race found that Africa recorded a more than 421% increase in cyberattacks between 2016 and 2025, outpacing the 307% global increase over the same period, as rapid digital adoption creates new security challenges for businesses, governments and financial institutions.