June 15, 2026 • Joseph Kyule

Introduction

I just finished reviewing the Q3 2025/2026 Cyber Security Report from the National KE-CIRT/CC, and I have to admit — I did a double-take at the headline statistic.

In that quarter alone (January to March 2026), the KE-CIRT team detected a staggering 3.37 billion security events across Kenyan networks. Yes, billion with a “B”. These weren’t minor pings — they represent the number of times malicious actors actively tried to breach, disrupt, or exploit systems nationwide.

Encouragingly, this figure marks a 26% drop compared to the previous quarter. Even more impressive, DDoS attacks fell by a massive 85.93%. While these numbers show clear progress, the sheer volume of attempts reminds us that the cyber threat landscape in Kenya remains intense and constantly evolving.

Top Threats Detected

Ransomware continues to lead the pack both globally and locally. The SOCRadar East Africa Threat Landscape Report 2026 highlights Qilin, LockBit, and The Gentlemen as the most active ransomware gangs targeting the region. These groups are known for their aggressive tactics, double extortion methods, and ability to adapt quickly.

Interestingly, while DDoS attacks dropped sharply, system misconfiguration exploits climbed to 4th place in the rankings. This suggests that many organizations may be prioritizing flashy perimeter defenses while leaving internal weaknesses exposed.

Additionally, AI-enabled attacks emerged as a major force multiplier, helping threat actors automate reconnaissance, craft convincing phishing emails, and even generate polymorphic malware that evades traditional detection.

No One Is Safe

The report makes one thing crystal clear: no sector or user is truly safe. Threat actors showed sustained interest in critical national infrastructure, with Government, Financial Services, Telecommunications, Energy, and Education sectors being prime targets. Attackers focused heavily on database servers, cloud environments, network infrastructure, and web applications. Motivations range from financial gain and data theft to espionage and disruption.

End users are equally attractive targets. Mobile devices, Android TVs, IoT gadgets, and everyday endpoints continue to be exploited through weak default settings, unpatched software, and social engineering tricks. In many cases, compromising a single user device provides the initial foothold attackers need to pivot deeper into organizational networks.

Recommended Remediation Measures

Here are practical, prioritized steps every Kenyan organization — from SMEs to large enterprises — should implement:

• Implement Multi-Factor Authentication (MFA) across all systems and services. MFA adds a vital second (or third) layer of defense that dramatically reduces the success rate of credential-based attacks like brute-force and phishing.

• Maintain secure, offline backups. Ransomware attacks are rising, and paying the ransom is never a reliable solution. Air-gapped backups ensure you can recover critical data and maintain business continuity when the worst happens.

• Enforce Zero Trust network segmentation. Assume breach. By verifying every access request and limiting lateral movement, you contain threats before they spread across your entire environment.

• Run regular patch management for operating systems, applications, and firmware. Many successful attacks still exploit vulnerabilities that were publicly disclosed months earlier. Consistent patching closes these known doors.

• Harden firewalls and security devices. Use established benchmarks from vendors, along with frameworks like CIS, NIST, and local KE-CIRT guidelines, to strengthen your perimeter and internal controls.

• Deploy appropriate endpoint protection. While advanced tools like XDR and SOAR are ideal, traditional antivirus and anti-DDoS solutions still deliver strong value for smaller teams or budget-conscious organizations.

Additional Best Practices

• SIEM/XDR for visibility: Prevention is important, but detection and response are equally critical. A centralized SIEM or XDR platform gives security teams real-time visibility into network activity, helping identify anomalies before they become full-blown incidents.

• Security awareness training: Humans remain the weakest link in most breaches. Regular, practical training programs that teach staff how to spot phishing attempts, suspicious behaviour, and social engineering tactics can significantly reduce risk.

• Regular security audits and testing: Building secure systems is only the beginning. Schedule periodic vulnerability assessments and penetration tests to uncover hidden weaknesses in both internal and external infrastructure before attackers find them.

Conclusion

While the National KE-CIRT/CC continues to work tirelessly on the frontlines — providing threat intelligence, coordination, and support to the nation — individual organizations cannot afford to remain passive. We must move away from the reactive “wait-and-see” approach and the dangerous “if it works, don’t touch it” mentality. The new standard should be: “It works, and it is secure.”

Technology is revolutionary, but only when paired with strong cyber resilience can it truly drive Kenya’s digital economy forward. The threats are not disappearing — they are simply changing tactics. The question is whether we’ll stay one step ahead.

You can download the full Q3 2025-2026 Cyber Security Report directly from the Communications Authority of Kenya website here: Download Report

What’s one security improvement your organization plans to make in the coming months? Feel free to share in the comments below.

 

Ready to assess your organization's security posture? Let us talk.

 

Telephone: +254 115 867 309 | +254 740 196 519
Email: cybersecurity@southendtech.co.ke | info@southendtech.co.ke | dataprotection@southendtech.co.ke

 

South-End Tech Limited — Helping East African businesses build secure AI-ready foundations.

---

Comments (0)