Kenya’s Computer Incident Response Team detected 2.36 billion cyber threats in the fourth quarter alone, though that’s actually a 30% drop from the previous quarter’s 3.37 billion.
Zoom out to the full financial year, though, and the number tells a worse story: 11.12 billion threats detected, up 29% from 8.62 billion the year before.
System vulnerabilities make up the overwhelming majority of detected threats, at 10.6 billion for the year, up 28.2%. However, the sharpest growth was in more targeted attack types.
Distributed denial-of-service (DDoS) attacks jumped 114.3% year on year to 72.2 million, even though they fell 90% within the fourth quarter alone, from 8.2 million to just 819,325. This suggests a wave of DDoS activity was concentrated earlier in the financial year.
Web application attacks nearly doubled year on year, up 99% to 51.5 million, and also rose 43.7% within the quarter. Malware detections rose 64.8% to 230.3 million over the year, while brute force attacks, repeated automated attempts to guess passwords or access credentials, grew a more modest 3.6% to 132.2 million.
| Threat Type | Annual Total | YoY Change | Q4 Figure | Quarterly Change |
|---|---|---|---|---|
| System Vulnerabilities | 10.6 billion | ↑ 28.2% | — | — |
| Malware | 230.3 million | ↑ 64.8% | — | — |
| Brute Force Attacks | 132.2 million | ↑ 3.6% | — | — |
| Web Application Attacks | 51.5 million | ↑ 99% | — | ↑ 43.7% |
| DDoS Attacks | 72.2 million | ↑ 114.3% | 819,325 | ↓ 90% (from 8.2 million) |
The Authority also issued far more warnings to affected users this year: 83.1 million cyber advisories, up 60.8% from 51.7 million the year before.
Brute force attack advisories alone rose more than fivefold, from 5.5 million to 25.5 million, even though actual brute force attacks barely grew, which may reflect the National KE-CIRT/CC casting a wider net in flagging suspicious login activity to users and organizations.
Web application attack advisories rose 110.5% to 40.5 million, tracking closely with the near-doubling of actual attacks in that category.
On the domain name side, Kenya’s .KE registrations grew 3.7% to 129,140 by June 2026. Commercial .CO.KE domains, used by companies, remain by far the largest category at 114,662, up 16% over the year.
Government .GO.KE domains rose 8.3% to 928, and mobile content domains under .MOBI.KE more than doubled, up 113.9% in a single quarter, though off a tiny base of just 77 registrations.
| Domain Category | Registrations | Change | Notes |
|---|---|---|---|
| .KE (Total) | 129,140 | ↑ 3.7% (annual) | Overall domain space |
| .CO.KE (Commercial) | 114,662 | ↑ 16% (annual) | Largest category; used by companies |
| .GO.KE (Government) | 928 | ↑ 8.3% (annual) | — |
| .MOBI.KE (Mobile content) | 77 | ↑ 113.9% (quarterly) | Off a small base |
| .SC.KE (Schools) | Not specified | ↓ 4.2% (annual) | Lower/middle-level educational institutions; one of few shrinking categories |
Meanwhile .SC.KE domains, used by lower and middle level educational institutions, were one of the few categories to shrink, down 4.2% over the year, hinting at a slow decline in interest in that particular registration category even as the broader domain space keeps expanding.
Comments
No comments yet. Be the first to share your thoughts.