Why national cyber threat statistics differ from actual business security breaches

Kenya cyber threat statistics provide a useful view of the pressure facing the country’s digital infrastructure, but the figures need context before they can be used to assess the risk to a particular business.

The Communications Authority of Kenya reported 11,124,632,684 cyber threat events detected by the National KE-CIRT/CC during the 2025/26 financial year, up from approximately 8.62 billion in the previous year. The increase was about 29%, according to reporting on the Authority’s sector statistics.

The scale is striking, particularly as more financial transactions, public services and business operations move online. Yet the figure is a count of detected cyber threat events, not a tally of 11.12 billion successful intrusions or confirmed data breaches. To understand what the numbers mean, businesses need to look beyond the headline total and consider the type of activity detected, the period covered and the consequences for systems and users.

Kenya’s cyber threat numbers are rising

The annual total reported for the 2025/26 financial year was higher than the approximately 8.62 billion events recorded in 2024/25. The Authority’s cyber monitoring function tracks activity across several categories, including attempts to exploit system vulnerabilities and other forms of malicious network activity. Those categories can differ substantially in scale and operational significance, which makes the breakdown more informative than the total alone.

Quarterly data also show why reporting periods matter. In its report for April to June 2025, the National KE-CIRT/CC said it had detected more than 4.5 billion cyber threat events, an increase of more than 80% compared with January to March 2025. That quarterly figure belongs to a specific reporting window and should not be treated as a direct measure of the annual total or compared with other periods without checking the underlying categories and definitions.

Why a threat event is not the same as a successful attack

A cyber threat event can refer to activity detected by monitoring systems, such as traffic associated with an attempt to exploit a vulnerability or a pattern that matches a known threat. One campaign can generate many events, while a single confirmed incident can involve multiple systems, accounts and detection alerts. The relationship between event counts and real-world harm is therefore not one-to-one.

Detection systems also observe activity at different stages. A firewall may identify and block suspicious traffic before it reaches an application. An endpoint security tool may detect a malicious file that is prevented from running, while an investigation may later confirm that an attacker gained access to a system. Each outcome matters, but they describe different levels of exposure and impact.

The distinction is important when figures are used in public discussion. A large volume of detected activity can reflect heavy attack traffic, broad scanning, repeated attempts against exposed services or improvements in monitoring coverage. It can also coexist with serious incidents that generate relatively few alerts. Without the relevant definitions and supporting data, a higher event count alone cannot establish that successful compromises have risen at the same rate.

Businesses should also distinguish between attempted attacks, blocked attacks, confirmed incidents and verified losses. These measures answer different questions: how much hostile activity is being observed, how well controls are stopping it, how often systems are being compromised, and what the resulting damage has been. A useful cybersecurity assessment needs more than one of them.

What the figures can tell businesses

National data can help organisations understand the broader threat environment and decide where to investigate their own exposure. If vulnerability exploitation features prominently in reported activity, for example, companies have a reason to review how quickly they patch internet-facing systems, whether outdated software remains exposed and whether critical applications are being monitored. The appropriate response still depends on the company’s technology and risk profile.

The Communications Authority’s quarterly cyber security report has identified ransomware, data breaches, distributed denial-of-service activity and social engineering among the threats observed in Kenya’s digital environment. Each category creates different operational requirements. Ransomware readiness depends on containment, recoverable backups and incident response; phishing defence involves identity controls and staff awareness; DDoS resilience requires planning for traffic floods that can disrupt service availability.

The same applies to small and medium-sized enterprises. A company does not need to match the scale of national cyber monitoring to face a serious incident. One compromised business email account, an exposed customer database or a successful ransomware attack can have a major effect on a smaller organisation, even when it represents a negligible fraction of the country’s total detected events.

How organisations should use threat data

A practical response starts with measuring the security outcomes that matter to the business. Organisations should track whether critical systems are patched, how many accounts use multi-factor authentication, how quickly suspicious activity is investigated, whether backups can be restored and how long it takes to contain an incident. These indicators connect security activity to the organisation’s ability to keep operating.

Incident records should separate alerts from confirmed incidents and record the impact of each case. A useful report distinguishes blocked attempts from successful access, identifies which systems were affected, notes whether data was exposed and records the time required to recover. Consistent definitions allow security teams and senior management to compare performance across reporting periods without treating every alert as equivalent.

External threat data can then help inform those decisions. Security teams can compare the categories observed nationally with the technologies they use, the vulnerabilities affecting their own systems and the tactics relevant to their industry. They can also use threat advisories to prioritise patching and detection work, while recognising that a national trend does not prove a particular organisation has been targeted.

Better measurement can improve cyber defence

Kenya’s cyber threat statistics show that national monitoring systems are detecting activity on a very large scale. Their value lies in helping authorities, security teams and businesses understand the kinds of threats being observed and decide where further investigation is needed. The headline total is a useful indicator of volume, but it cannot stand in for a count of successful attacks or the financial and operational damage caused by cybercrime.

For business leaders, the practical question is whether their own controls can prevent, detect and contain incidents that matter to their operations. Reliable internal metrics, clear incident classifications and tested recovery plans provide a stronger basis for that decision than a national event count alone. Read alongside the category breakdowns and the reporting period, the statistics can help organisations turn a broad picture of cyber activity into specific security priorities.

Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.

Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke