The latest quarterly cybersecurity report by the Communications Authority shows that 2,696,335,021 cyber threat events were detected in three months.

KENYA recorded nearly 2.7 billion cyber threat events between July and September, with attacks targeting web applications rising 57.62 per cent, exposing growing vulnerabilities in government systems, financial services and businesses.

The surge comes as criminals increasingly exploit outdated software, weak passwords, vulnerable online platforms and artificial intelligence (AI) to scale up attacks, raising concerns about the security of digital transactions, sensitive customer information and essential public services.

Web application attacks increased to 27.4 million, while malware threats rose 20.01 per cent to 70.8 million, signalling mounting pressure on organisations that depend on digital platforms to deliver services and conduct business.

Brute-force attacks, in which criminals repeatedly attempt to guess passwords or gain access to accounts, jumped 85.41 per cent to nearly 45 million during the quarter.

System attacks remained the largest category, accounting for approximately 2.55 billion detected events.

In his assessment of the threat landscape, CA director-general David Mugonyi warned that organisations faced increasingly sophisticated attacks, including ransomware, distributed denial-of-service attacks, phishing and the exploitation of system vulnerabilities.

“Further, the exploitation of system vulnerabilities by threat actors continued to pose considerable threats to the delivery of critical services and the continuity of business operations,” Mugonyi said in the report.

He said the developments highlighted the need to strengthen cyber hygiene, improve proactive threat detection and undertake continuous cybersecurity awareness and capacity-building programmes.

The figures underscore the risks facing Kenya as government agencies, banks, telecommunications companies and businesses expand their reliance on online systems.

A successful breach could expose customer information, disrupt service delivery, undermine consumer confidence and impose additional costs on businesses forced to restore compromised systems.

The report identifies government systems and internet service providers among the principal targets of web application attacks, with criminals exploiting weaknesses in software libraries, application programming interfaces and server configurations.

These vulnerabilities can allow unauthorised access, privilege escalation and the exposure of sensitive information.

The authority detected 27.4 million web application attack attempts during the quarter, a 57.62 per cent increase from the preceding three months.

The increase coincided with a sharp rise in brute-force attacks targeting cloud service providers and government systems, where weak authentication controls and poorly secured remote-access services provided opportunities for intruders.

The report also recorded 70.8 million malware threat attempts, up 20.01 per cent from the previous quarter.

Internet service providers, cloud service providers and government systems remained among the most affected, alongside financial-sector platforms, educational institutions and individual users.

The growing use of artificial intelligence is adding another dimension to the threat, enabling criminals to produce more convincing fraudulent messages, automate malicious activities and increase the scale of phishing campaigns.

The authority warned that AI-assisted attacks could make it harder for employees and customers to distinguish legitimate communications from scams.

Ransomware also remained a persistent threat, with criminals combining the disruption of computer systems with the theft of sensitive information and demands for payment.

Attackers typically seek access through phishing messages, compromised credentials and weaknesses in internet-facing systems before moving through networks and extracting information.

The report warned that critical information infrastructure supporting e-government, telecommunications, banking and finance, and academia remained a target.

For businesses, the exposure extends beyond direct financial losses to operational interruptions, reputational damage and potential breaches of customer confidentiality.

The authority issued 20.26 million cyber threat advisories during the quarter, although this was 2.36 per cent lower than in April-June.

The advisories provide technical guidance on emerging threats and measures organisations can take to protect their systems.

Businesses urged to strengthen defences

Mugonyi urged organisations to improve their preparedness through timely software updates, stronger authentication and better monitoring of networks and devices.

“Timely patching of operating systems, software applications and firmware” remains essential, alongside multi-factor authentication, password management, endpoint security and effective firewall controls, he said.

Multi-factor authentication requires users to verify their identities through an additional method beyond a password, making it harder for criminals to access accounts using stolen credentials.

The authority also recommends maintaining isolated backups and regularly testing recovery procedures to limit disruption from ransomware attacks.

Businesses should review access permissions, secure remote connections, assess vulnerabilities and train employees to identify suspicious messages and verify unusual payment requests independently.

The report highlights the need for stronger coordination among government agencies, regulators and private-sector organisations to share threat intelligence and improve response capabilities.

Kenya is developing a threat intelligence-sharing platform under the Kenya Cyber Resilience initiative to strengthen information exchange, situational awareness and coordinated detection of cyber threats.

The initiative is intended to improve collaboration among cybersecurity institutions and support a more coordinated national response.

However, the latest figures show that expanding digital services must go hand in hand with investment in security, staff training and resilient infrastructure.

For companies and public institutions alike, the cost of prevention may be lower than the financial and operational damage caused by a successful cyberattack.