Kenya is moving to strengthen the protection of its digital systems through a new artificial intelligence-powered cybersecurity centre at Konza Technopolis, as the country grapples with billions of detected cyber threats and growing losses from online fraud.
The facility will provide a central platform for tracking suspicious activities, identifying weaknesses in computer networks and coordinating responses to attacks targeting government agencies, businesses and other institutions.
The security operations centre is expected to tackle a range of digital crimes, including hacking, phishing and ransomware, by using AI technology to analyse network activity and identify potential threats before they cause serious damage.
Under the arrangement, private companies will be allowed to subscribe to the services at an annual cost determined by the amount and type of digital infrastructure they need protected. The assets covered will include servers, firewalls and routers.
The initiative comes at a time when Kenya's exposure to cyber threats is growing. Figures from the Communications Authority show that detected cyber threat incidents reached 2.7 billion between July and September, an increase of 14.45 per cent from the preceding three months.
Konza Technopolis Development Authority Chief Executive Officer John Paul Okwiri said the new facility would provide an important layer of protection as Kenya continues to expand its digital economy and increase the number of services offered online.
"As Kenya expands its digital economy and brings more public services online, the security of our digital infrastructure must remain a priority," said John Paul Okwiri, the Technopolis Development Authority CEO.
"The security operations centre will strengthen our capacity to detect and respond to cyber threats while supporting a secure, resilient and trusted digital ecosystem," he added.
The centre will operate on a shared-service model, giving organisations access to advanced cybersecurity services without having to establish and run their own monitoring facilities.
Its services will include round-the-clock network surveillance, intelligence on emerging threats, active searches for possible attacks and assistance in handling security incidents. This will enable participating institutions to spot vulnerabilities, investigate unusual activities and take action through a centralised system.
The need for stronger digital protection is also evident in the banking industry, where cyber-related fraud continues to expose financial institutions and their customers to substantial losses.
Reported cyber-fraud losses in the sector increased to Sh1.9 billion in 2025, compared with Sh1.59 billion in 2024, according to figures from the Central Bank of Kenya.
The number of reported cases also went up from 353 to 385, while the value of funds exposed to fraudulent activities rose to Sh2.03 billion from Sh1.96 billion.
Card-related fraud losses more than doubled during the period, climbing to Sh645.2 million from Sh263.3 million. Losses arising from internet scams also surged from Sh6.1 million to Sh86.5 million, despite a decline in fraud involving mobile banking.
The Communications Authority has identified government institutions as some of the major targets of cybercriminals, alongside internet service providers and cloud computing companies.
The attacks have been directed at several areas of digital infrastructure, including websites and online applications, email systems, network equipment and platforms that allow users to access systems remotely.
The authority further recorded more than 44.9 million attempts to breach systems through brute-force attacks during the three-month period. This represented an 85.41 per cent rise, with government networks and cloud service providers among the main targets.
Such attacks involve criminals making repeated attempts to gain access to protected systems by trying different passwords and login credentials.
Ransomware attacks present another danger, with criminals locking organisations out of their computer systems, taking sensitive information and demanding money in exchange for restoring access or preventing the disclosure of stolen data.
However, the reported figures relate to detected threats and attempted attacks. They do not establish that all the attempts succeeded, that government databases were compromised or that the reported incidents resulted in confirmed financial losses.
The Konza facility forms part of the government's wider plan to expand the technocity's digital infrastructure. The government has also established a national data centre at the site to accommodate public-sector systems and provide cloud computing services.
The growing use of shared digital platforms to store government records and run public applications has increased the importance of protecting these systems against unauthorised access, disruptions and data theft.
ICT Principal Secretary John Tanui said the new arrangement would address weaknesses among institutions that have installed basic security tools but lack the capacity to keep watch over their networks and manage cyber incidents throughout the day.
While some organisations have deployed firewalls and antivirus programmes, continuous surveillance, specialised threat analysis and coordinated responses remain beyond the reach of many institutions.
Kenya already has an established national framework for dealing with cyber incidents through the National KE Computer Incident Response Team Coordination Centre, which operates under the Communications Authority.
The centre is responsible for coordinating responses to cyber incidents and issuing technical alerts and warnings on emerging threats on a 24-hour basis.
Another institution, the National Computer and Cybercrimes Coordination Committee, was established under the Computer Misuse and Cybercrimes Act to oversee wider national efforts to address cybercrime.
Its mandate includes examining cybersecurity threats, coordinating responses to incidents and promoting collaboration among security agencies.
The new Konza centre will add to these existing efforts by providing institutions with access to specialised cybersecurity services through a common monitoring and response platform.