Before buying cybersecurity services, Kenyan businesses need to ask better questions
Choosing cybersecurity services for Kenyan businesses requires more than comparing monthly fees or counting the features listed in a proposal. A provider may offer network protection, endpoint security, monitoring, incident response or several services in one package, but the real value depends on what those services cover and how they work when something goes wrong. Businesses should understand which systems are protected, who responds to alerts, what assistance is available during an incident and what remains their own responsibility.
The decision matters for companies that depend on online payments, customer databases, cloud applications, business email or digital communication with suppliers. A small business may not have a dedicated security team, while a larger organisation may need external support to complement its internal staff. In both cases, the right service should address identifiable risks rather than offer a long list of tools without a clear plan for using them.
Start with the risks your business needs to manage
Before requesting proposals, businesses should identify the systems and information that would cause the greatest disruption if they were compromised or unavailable. These might include payment systems, customer records, payroll, business email, online stores, cloud storage or the software used to manage daily operations. The assessment should also cover the external providers and connected services on which those systems depend.
The next step is to consider the likely consequences of an incident. A stolen email account could expose sensitive correspondence or allow a criminal to impersonate an employee. Ransomware could make business files inaccessible, while an attack on a public-facing website could interrupt sales or prevent customers from accessing a service. Understanding these scenarios helps a company prioritise protection according to its operations and the damage an incident could cause.
This assessment gives a provider a more useful starting point than a general request for cybersecurity. It also helps the business distinguish between essential controls and optional features. A company with a small number of laptops and cloud applications may need a different service from one operating several branches, managing sensitive customer information or running systems that must remain available throughout the day.
Check what the service actually covers
Cybersecurity proposals often combine several technologies, and businesses should ask what each component does. Endpoint protection, for example, focuses on devices such as laptops and servers, while network security controls traffic entering or leaving a network. Email security can help identify malicious attachments, suspicious links and impersonation attempts, while identity controls reduce the risk of unauthorised account access.
Managed security services may add monitoring, alert investigation and support from a provider’s security operations team. However, monitoring does not automatically mean that every device, cloud account, application or network connection is covered. Businesses should request a written list of protected assets, the systems excluded from the service and any limits on the number of users, devices or locations.
The distinction between detection and response is particularly important. A service may notify a business that suspicious activity has occurred, but the customer could still be responsible for investigating the alert, isolating an affected device or restoring access. Another package may include hands-on response, subject to agreed conditions. The contract should make those responsibilities explicit so that the business knows what help it can expect.
Ask how incidents are detected and handled
A provider should be able to explain how it receives alerts, determines which ones require investigation and communicates with the customer. Businesses should ask whether monitoring operates continuously or only during specified hours, how urgent alerts are escalated and who can be contacted when an incident affects critical operations. These details matter because an alert that waits too long for review may allow an attacker more time to compromise accounts or systems.
Incident response should also be defined before a crisis occurs. The agreement should explain who can isolate a device, disable an account, block a connection or take another containment action, and whether the provider needs approval from the customer first. Businesses should understand how evidence is preserved, how updates are delivered and what support is available during recovery.
It is useful to ask providers to walk through a realistic scenario. For example, the business could ask what would happen if an employee’s email account were compromised and used to send fraudulent payment instructions. A clear answer should cover detection, containment, communication, account recovery and follow-up recommendations, with responsibilities assigned to named roles rather than left to assumptions.
Make sure backups and recovery are part of the plan
Preventing an attack is only one part of cybersecurity. Businesses also need a way to restore important systems and information if files are deleted, data becomes corrupted or ransomware disrupts operations. A provider’s proposal should explain whether backup and recovery services are included, offered separately or remain the customer’s responsibility.
Companies should check how frequently backups are made, how long they are retained and whether they are protected from unauthorised deletion. Backup copies that remain accessible through the same compromised administrator account may be exposed during an incident. Access restrictions and appropriately separated copies can reduce that risk, although the precise design should reflect the business’s systems and recovery requirements.
A backup arrangement should be tested rather than accepted on the basis of a dashboard showing successful jobs. Businesses need to know whether they can restore files, applications and essential services within a period that is acceptable for their operations. Providers should explain the recovery process and the customer’s responsibilities, including any additional charges or specialist support required after a serious incident.
Review access controls, reporting and accountability
Account security deserves attention because an attacker who obtains valid credentials may be able to use legitimate systems rather than relying on obvious malware. Businesses should check whether the proposed service supports multi-factor authentication, role-based permissions and the removal of access when employees or contractors leave. Administrative accounts should receive particular scrutiny because they can often make changes across multiple systems.
The provider’s own access should be controlled as well. Where a service provider manages devices, cloud environments or security settings remotely, the customer should understand which provider personnel can access those systems, how that access is authorised and how activity is recorded. Strong arrangements should allow the provider to do its job without giving every technician unrestricted access to the customer’s environment.
Reporting should help management understand the state of the service. Useful reports can distinguish between alerts and confirmed incidents, show recurring vulnerabilities, identify overdue remediation work and record response performance. Businesses should agree how often reports will be delivered, who will review them and how unresolved risks will be escalated. The objective is to make security decisions based on evidence rather than the number of alerts generated or the length of a monthly report.
Compare providers on outcomes, not just price
Price is important, particularly for smaller businesses managing tight budgets, but the cheapest proposal may exclude services that become necessary during an incident. Companies should compare the same scope across providers, including monitoring hours, device coverage, response assistance, backup services, reporting and support for recovery. They should also separate recurring fees from implementation charges, optional features and costs that may arise during a serious incident.
Service-level agreements deserve close review. Businesses should establish what response times apply to different levels of severity, when those times begin and what the provider commits to do. A commitment to acknowledge an alert is different from a commitment to investigate it, contain a threat or restore an affected service. These distinctions should be reflected in the agreement rather than left to marketing descriptions.
References and relevant experience can help a company assess whether a provider understands its operating environment. Businesses can ask how the provider supports organisations of a similar size, handles incidents involving cloud services or remote workers, and communicates when a security problem affects normal operations. Contract terms should also address data handling, confidentiality, service termination and the return or deletion of customer information when the relationship ends.
Build a service around the business’s actual exposure
Cybersecurity services are most useful when the scope matches the systems a business operates and the risks it needs to control. A company should be able to explain what the provider protects, how incidents are handled, how data and access are managed, and how the business will recover from disruption. If those points cannot be established from the proposal and contract, the business should resolve them before committing.
Kenyan businesses do not all need the same security package, and a larger bundle is not automatically the better choice. Some may need help with endpoint protection and account security, while others require continuous monitoring, managed incident response or more extensive recovery arrangements. The purchasing decision should begin with the business’s essential systems and operational risks, then match those needs to clearly defined services, responsibilities and costs.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke
