Safaricom Group CEO Peter Ndegwa told the summit that cyber risk sits at the top of the company’s risk register. “The top risk is cyber, and has been cyber for as long as I’ve been CEO,” he said.
He said AI helps protect M-Pesa, which processes 150 million transactions a day. “We can prevent in real time 94 per cent of any fraud that is about to happen,” Ndegwa said. The models learn customer behaviour and flag patterns before money moves.
On governance, Ndegwa said: “Cybersecurity can no longer be treated as a technical safeguard added after a service is developed. It must be embedded from the start and strengthened through shared standards, responsible innovation and collaboration across sectors.”
He cited the World Economic Forum finding that the share of organisations assessing the security of their AI tools rose from 37 per cent in 2025 to 64 per cent in 2026.
Government figures match the CA record
Cabinet Secretary for Information, Communications and the Digital Economy William Kabogo said the National KE-CIRT/CC detected more than 2.3 billion cyber threat events between April and June. The CA’s quarterly data puts that quarter at 2.36 billion.
Kabogo said most of the events exploited unpatched systems, weak configurations and stolen credentials. He said attacks on web applications, many aimed at government systems, rose 40 per cent on the previous quarter.
For the full year, the centre issued 83.1 million advisories to affected users, up 60.8 per cent from 51.7 million. Advisories on brute force attacks rose from 5.5 million to 25.5 million, although the attacks themselves grew 3.6 per cent. Advisories are warnings sent to organisations and users about threats the centre has detected.
Policy, a new agency and children
Kabogo said government set up a national cyber agency this year. He said the Ministry will work with the agency, the CA, the National Computer and Cybercrimes Coordination Committee and sector regulators so that “Kenya responds to cyber incidents as a country.”
He said sector cyber security operations centres are being set up in telecom, communication and energy. The CA’s report records that the Energy and Petroleum Regulatory Authority, designated as the energy sector centre, met the National KE-CIRT/CC on 26 March to learn how to run one.
Government is finalising the Kenya Artificial Intelligence and Emerging Technologies Policy. Kabogo asked industry and academia to keep contributing. “The policy will be stronger for your experience,” he said. Khusoko readers can follow the policy debate through KICTANet’s work on the AI strategy and policy.
Kabogo then turned to children. “A child can now receive a voice note that sounds exactly like their mother,” he said. He listed scams, cyberbullying, manipulated images, grooming and AI companions as risks. His ministry will convene a national conversation on child online safety with parents, schools, technology companies, telecom operators and children. He noted that Australia set a minimum age of 16 for social media accounts and said Kenya would learn from other countries while building its own approach.
He asked operators to share what they detect. “Operators such as Safaricom often detect an attack before anyone else does,” Kabogo said.
Kenya recorded 11.12 billion cyber threat events in a year as Safaricom opened its summit
The CA’s report shows how the sharing is organised: 85 people from 25 organisations took part in a five day training on information sharing in March, run with the UK Foreign, Commonwealth and Development Office. A second programme, on a threat intelligence sharing platform, was scheduled for April to June with Expertise France.
Next: Story 3, what the live demonstration showed.
