Cyber Attacks in Kenya: 2025 and 2026 Statistics Explained
Kenya recorded 11.12 billion cyber threat events in FY2025/26, up 29%. What the Communications Authority figures show, what they do not, and what to do.
· Reviewed by Danstan Akwiri, CISSP, CISA
Kenya's National Computer Incident Response Team Coordination Centre (National KE-CIRT/CC), run by the Communications Authority of Kenya, detected 11,124,632,684 cyber threat events in the 2025/26 financial year (July 2025 to June 2026). That is a 29 per cent increase on the 8,622,876,858 events recorded in 2024/25, according to the Authority's sector statistics report published in September 2026.
This guide summarises what the official figures show, explains what they do and do not mean, and sets out the practical steps that address the causes the Authority itself identifies.
| Threat type | FY2025/26 events | Change vs FY2024/25 |
|---|---|---|
| System vulnerabilities | 10,637,635,755 | +28.2% |
| Malware | 230,307,810 | +64.8% |
| Brute force attacks | 132,225,836 | +3.6% |
| DDoS attacks | 72,164,664 | +114.3% |
| Web application attacks | 51,508,883 | +99% |
| Mobile application attacks | 789,826 | +54% |
| Total | 11,124,632,684 | +29% |
Quarter by quarter
Quarterly detections have swung widely. The National KE-CIRT/CC reported about 2.5 billion threat events in January to March 2025, about 4.6 billion in April to June 2025, 842.3 million in July to September 2025, 4.56 billion in October to December 2025, and 3.37 billion in January to March 2026.
In the January to March 2026 quarter, system attacks made up about 3.23 billion of the 3.37 billion events, followed by malware (68.7 million), brute force (46.4 million), web application attacks (12.1 million), DDoS (8.2 million) and mobile application attacks (219,549). The Authority issued 20.58 million cyber threat advisories in that quarter, and 83,096,015 across the 2025/26 financial year, up 60.8 per cent.
What the numbers do and do not mean
These are detected threat events: attempts and suspicious signals picked up by national monitoring, not confirmed breaches or losses. A single automated scanner can generate millions of events in a day. The Authority has also noted that some increases reflect improved monitoring capability rather than only more attackers, so a jump between quarters is not by itself proof that attacks doubled.
What the figures reliably show is the direction and the mix. Probing for unpatched systems dominates by volume, while the categories that most often turn into real incidents for businesses, web application attacks and DDoS, roughly doubled over the year.
The causes the Authority identifies
Across its recent quarterly reports, the Communications Authority has linked detected threats to three recurring causes: inadequate system patching, low user awareness of phishing and social engineering, and the growing use of artificial intelligence by attackers to scale and personalise their attacks. It recommends multi-factor authentication, better firewall configuration and regular system updates.
None of these are exotic. They describe the gap between security controls organisations know they should have and the ones they actually operate every day.
What Kenyan organisations should do
The official figures point to a short, unglamorous list that prevents most incidents.
- Patch internet-facing systems quickly, and know what you have exposed: you cannot patch what you have not inventoried.
- Turn on multi-factor authentication for email, VPN, cloud and admin accounts, prioritising finance and executives.
- Test your web applications and APIs, since web application attacks nearly doubled.
- Plan for DDoS if your services must stay online, with your hosting provider or a mitigation service.
- Train staff on phishing, business email compromise and mobile money fraud as they actually appear in Kenya.
- Monitor for intrusions around the clock, because detection within hours rather than weeks decides the size of an incident.
Sources
Figures in this guide are taken from official Communications Authority of Kenya publications and their reporting in the Kenyan press. Check the Authority's latest releases for updates.
- Communications Authority of Kenya, Sector Statistics Report, fourth quarter of FY2025/26 (published September 2026): annual totals and category figures.
- National KE-CIRT/CC Cybersecurity Report, third quarter of FY2025/26 (January to March 2026), ca.go.ke.
- National KE-CIRT/CC quarterly figures for 2025 as reported by Capital FM, TechAfrica News, Techweez and TechNext.
Key takeaways
- Kenya recorded 11.12 billion cyber threat events in FY2025/26, up 29% on the previous year.
- Web application attacks rose 99% and DDoS attacks 114% over the year.
- The figures are detected events and signals, not confirmed breaches.
- The Authority links threats to weak patching, low phishing awareness and attackers' use of AI.
- Patching, MFA, application testing, training and 24/7 monitoring address the stated causes.
Frequently asked questions
How many cyber attacks were there in Kenya in 2025/26?
The Communications Authority of Kenya's National KE-CIRT/CC detected 11,124,632,684 cyber threat events in the 2025/26 financial year, a 29% increase on the 8,622,876,858 recorded in 2024/25. These are detected events, not confirmed breaches.
What are the most common cyber threats in Kenya?
By volume, attempts to exploit system vulnerabilities dominate, at over 10.6 billion events in FY2025/26. Malware, brute force attacks, DDoS and web application attacks follow, with DDoS and web application attacks growing fastest.
Why are cyber attacks increasing in Kenya?
Growing digital adoption expands the attack surface, and the Authority links detected threats to inadequate patching, low awareness of phishing and social engineering, and attackers' growing use of AI. Improved national monitoring also detects more of what was already happening.
How can a business in Kenya protect itself from cyber attacks?
Patch exposed systems promptly, enforce multi-factor authentication, test web applications and APIs, prepare for DDoS, train staff on phishing and mobile money fraud, and monitor systems around the clock so intrusions are caught early.