Small and medium-sized enterprises need cybersecurity that fits their budgets, technical capacity and day-to-day operations. Many cannot employ specialists to monitor networks around the clock, investigate suspicious activity and manage every security product. That leaves business owners looking for ways to reduce risk without diverting resources from sales, staff and customer service.
The challenge featured in a panel discussion at the Safaricom Cybersecurity Summit 2026 in Nairobi. Graham Turnbull, Cloudflare’s MSSP lead for sub-Saharan Africa, argued that smaller firms need security services delivered in accessible packages, while Safaricom’s Richard Muthua emphasised that protection should help businesses operate and grow. The discussion reflects a broader question for Kenya’s digital economy: how can businesses access useful security capabilities without having to build a large internal team?
Why smaller businesses face a different security challenge
A small business may depend on cloud accounting, online payments, customer databases and remote access to run its operations. These systems can make the business more efficient, but they also create risks when accounts are poorly secured, software is not maintained or staff cannot recognise suspicious messages.
Limited resources can make it difficult to manage these risks consistently. A business might buy a security product but lack the expertise to configure it, review alerts or respond when something goes wrong. The practical value of cybersecurity therefore depends on the people, processes and support surrounding the technology.
The scale of the wider problem is reflected in Mastercard’s October 2026 report, Africa’s Digital Defense Race. The report recorded 69,236 cyber events targeting African organisations in 2025, or roughly one every eight minutes, based on its observed data. These figures describe activity detected across the continent and should not be read as a count of attacks against SMEs alone.
What managed security services can offer
Managed security services allow businesses to obtain selected security capabilities from a provider rather than operate every system themselves. Depending on the service, that may include network protection, monitoring, threat filtering, technical support and assistance with incident response.
Safaricom’s relationship with Cloudflare is one example of this delivery model. The companies announced a partnership in 2024 that included managed cybersecurity services for micro, small and medium-sized businesses. The summit discussion brought the SME proposition back into focus, with emphasis on making security capabilities accessible through an established provider relationship rather than asking every business to assemble its own technical stack.
For a small company, the useful question is what a package actually covers. A service that filters malicious traffic may address one set of risks, while employee account security, endpoint protection, backups and incident recovery may require separate arrangements.
Why affordability is only part of the problem
A low monthly price can help a business begin improving its security, but it does not automatically provide comprehensive protection. Owners need to know which systems are covered, who monitors alerts, how quickly the provider responds and what happens if an incident interrupts trading.
Business continuity is particularly important. A company should know how it would restore critical records, communicate with customers and resume essential services after a disruption. Security providers can contribute to that preparation, but the business still needs to identify its most important systems and decide how much downtime it can tolerate.
What SMEs should ask before choosing a provider
Business owners should begin by listing their critical systems, the information they hold and the consequences of losing access. They can then ask prospective providers about service coverage, support hours, incident escalation, reporting, data handling and the responsibilities that remain with the customer.
They should also review basic protections such as multifactor authentication, software updates, restricted account permissions and reliable backups. These measures do not replace specialist security services, but they can reduce common sources of exposure.
Managed cybersecurity can make stronger protection more accessible to smaller firms, particularly where specialist skills are scarce. Its value depends on choosing a service that addresses the business’s actual risks and ensuring that staff know what to do when something goes wrong.
Real ESG impact doesn’t happen in panels alone, it happens in the rooms where financiers, operators, and policymakers actually align. Our GreenShift Forum 2026 cuts the noise, bringing together the people rewiring Africa’s sustainability and energy frameworks for one focused day in Nairobi. Secure your seat.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke
