Government opens AI-powered cybersecurity centre as businesses face growing digital risks
Kenya’s cybersecurity services market is gaining another provider as the government opens a shared Security Operations Centre (SOC) at Konza Technopolis, offering public institutions and private companies access to specialised network monitoring and incident response.
The facility introduces a subscription-based model under which businesses will pay annual fees according to the digital infrastructure they want monitored and protected. This includes servers, firewalls and routers, giving organisations access to centralised security operations without having to establish their own facilities and maintain dedicated teams of cybersecurity specialists.
The model addresses a challenge facing businesses that depend on digital systems but cannot justify the cost of operating a full security operations centre. Continuous network surveillance requires specialised technology, trained analysts and the capacity to investigate suspicious activity at any time. By sharing these capabilities across participating organisations, the Konza facility offers another route to enterprise cybersecurity services.
The centre will use artificial intelligence (AI) to monitor networks, detect suspicious activity and coordinate responses to cyber incidents. Its services will include continuous monitoring, threat intelligence, proactive threat hunting and incident response, covering threats such as hacking, ransomware and phishing.
Kenya’s managed cybersecurity market gets a new entrant
The Konza facility enters a market where telecommunications and technology companies already offer managed security services to businesses. Safaricom, for example, has introduced a Managed Security Operations Centre (MSOC) as part of its enterprise cybersecurity portfolio, providing continuous monitoring and security event analysis for organisations that need specialist protection.
Safaricom has also positioned managed cybersecurity services as an option for smaller businesses that lack the personnel and resources to operate dedicated security teams. Its cybersecurity proposition reflects a wider enterprise technology market in which organisations can outsource specialised functions rather than invest in all the required infrastructure internally.
The Konza model introduces a government-backed alternative, with government institutions enrolling in the service and private companies accessing it through annual subscriptions. The pricing structure is based on the scale of infrastructure supported, connecting the cost of the service to the number and type of assets requiring protection.
For businesses, the value of a managed SOC extends beyond receiving alerts when suspicious activity occurs. Security teams must investigate those alerts, distinguish genuine threats from routine network activity and coordinate responses when systems or accounts are compromised. Centralised monitoring brings these capabilities together, helping organisations manage security across multiple digital assets.
The facility will also provide threat intelligence and proactive threat hunting. These functions allow security teams to examine emerging attack methods, identify weaknesses and investigate unusual activity before it develops into a more serious incident.
Government expands its cybersecurity coordination infrastructure
The launch adds another facility to Kenya’s wider effort to organise cybersecurity protection across government institutions and critical infrastructure. Earlier plans reported by TechTrendsKE included the establishment of a National Cybersecurity Agency and a National Cybersecurity Operations Centre to coordinate national responses to cyber incidents.
The proposed agency was intended to bring together government ministries, regulators, security agencies, private companies and other institutions involved in protecting digital infrastructure. Its planned responsibilities included cybersecurity strategy, critical information infrastructure protection and coordination of incident responses.
The Konza facility adds an operational dimension to this broader institutional framework by providing monitoring and response capabilities that participating organisations can access through a central platform. Government institutions are among its initial users, placing public-sector systems within the scope of the shared cybersecurity service.
This is particularly relevant as government agencies move more administrative processes and public services onto digital platforms. Their websites, applications, databases and network infrastructure form part of the systems citizens and businesses rely on to interact with public institutions.
Konza Technopolis Development Authority chief executive John Paul Okwiri said the facility would strengthen Kenya’s ability to protect the infrastructure supporting its digital economy.
“As Kenya expands its digital economy and brings more public services online, the security of our digital infrastructure must remain a priority,” Okwiri said. “The security operations centre will strengthen our capacity to detect and respond to cyber threats while supporting a secure, resilient and trusted digital ecosystem.”
Rising cyber threats expose businesses and public institutions
The demand for centralised cybersecurity monitoring comes as Kenya records large volumes of malicious activity targeting digital infrastructure. The Communications Authority of Kenya’s latest cybersecurity report recorded 2.7 billion detected cyber threat incidents between July and September 2026, a 14.45% increase from the preceding quarter.
Brute-force activity accounted for another significant category of threats. The authority recorded more than 44.9 million attempts during the three-month period, representing an 85.41% increase. These attacks involve repeated attempts to guess passwords or access credentials, potentially allowing attackers to enter systems where authentication controls are weak.
Government institutions were among the sectors most affected, alongside internet service providers and cloud companies. Attackers targeted web applications, email systems, network devices and remote access infrastructure, all of which support the delivery of digital services and the management of organisational information.
The figures also reflect the challenges facing organisations that depend on connected systems. A single institution may operate several websites, internal applications, remote access services and network devices, creating multiple points that require monitoring and security management.
The Communications Authority’s figures represent detected threat events and attempted attacks, rather than confirmed intrusions or compromised government databases. They nevertheless illustrate the volume of malicious activity that cybersecurity teams must identify, investigate and manage.
The growing threat environment has also prompted practical security responses from government institutions. In October, Kenyan agencies were directed to address critical vulnerabilities affecting PHP-based websites and applications, including identifying affected systems, applying security updates and reviewing logs for suspicious activity. Such work highlights the importance of maintaining visibility across infrastructure rather than relying solely on periodic security assessments.
Banking fraud adds to the cost of digital insecurity
Financial institutions face another dimension of the cybersecurity challenge as fraud involving digital channels continues to affect banking operations and customers. The Central Bank of Kenya (CBK) reported that banking fraud losses increased to Sh1.9 billion in 2025 from Sh1.59 billion in 2024, while the number of reported cases rose from 353 to 385.
The amount exposed to fraud also increased to Sh2.03 billion from Sh1.96 billion. Card fraud losses more than doubled, reaching Sh645.2 million from Sh263.3 million, while internet scam losses climbed to Sh86.5 million from Sh6.1 million.
The changing pattern of fraud illustrates the different risks facing organisations operating digital financial services. Card-related fraud, online scams and compromised credentials can involve different attack methods, requiring institutions to combine transaction monitoring, identity protection and network security.
The banking figures also demonstrate why cybersecurity spending has become an operational concern for companies handling sensitive information and financial transactions. Detecting suspicious network behaviour and coordinating responses can help organisations investigate potential compromises before they cause wider disruption, although financial fraud also requires controls beyond network monitoring.
Konza builds out its national digital infrastructure role
The cybersecurity centre adds to Konza Technopolis’ role as a host of government technology infrastructure. The government has established a National Data Centre at the technopolis to host public-sector systems and provide cloud services, supporting the computing and storage requirements of digital government operations.
Konza has also been associated with the KRA Disaster Recovery Centre, which supports the continuity of critical tax administration systems. These facilities address different infrastructure requirements, from hosting government applications and data to maintaining access to essential systems when disruptions occur.
The new SOC extends that infrastructure portfolio into cybersecurity monitoring and incident response. While the data centre provides hosting and cloud capabilities, the security operations facility gives participating institutions access to services designed to identify threats and coordinate responses across their networks and devices.
For businesses, the annual subscription model also connects Konza’s infrastructure investments to the wider enterprise technology market. Organisations that need specialist monitoring can access the shared service while continuing to manage their own systems and operations, adding another option to Kenya’s managed cybersecurity sector.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke
