Safaricom is stepping up its push to provide cybersecurity services to businesses as Kenya’s digital economy faces a rising volume of cyber threats, with the country detecting 11.12 billion threat events in the last financial year.
The telco is positioning its enterprise technology services as a way for businesses, particularly micro, small and medium-sized enterprises (MSMEs), to strengthen their digital defences without having to build and maintain complex security operations internally.
The opportunity comes as companies adopt artificial intelligence, cloud services, digital payments and connected business systems, creating new avenues for cybercriminals to exploit. AI is also making it easier to produce deepfakes, impersonate trusted individuals, automate scams and develop more sophisticated attacks.
Data from the Communications Authority of Kenya shows that the National Kenya Computer Incident Response Team–Coordination Centre detected 11.12 billion cyber threat events in the last financial year, a 29% increase from 8.62 billion in the previous year.
The figures highlight the scale of cyber activity confronting organisations as more economic activity moves online. They represent detected threat events, however, and should not be interpreted as 11.12 billion successful attacks or confirmed security breaches.
Safaricom addressed the growing risks on Wednesday at its fourth annual Cybersecurity Summit in Nairobi, held under the theme “Harnessing AI, Strengthening Security”. The event brought together participants from across Kenya’s digital ecosystem to discuss responsible AI adoption and ways to strengthen the country’s cyber resilience.
“AI is expanding what is possible for businesses and society, but that opportunity must be built on trust,” Safaricom Group Chief Executive Officer Peter Ndegwa said.
“Cybersecurity can no longer be treated as a technical safeguard added after a service is developed. It must be embedded from the start and strengthened through shared standards, responsible innovation and collaboration across sectors. That is how we ensure digital progress remains safe, inclusive and worthy of our customers’ confidence.”
Ndegwa’s remarks reflect a broader shift in how companies approach cybersecurity, with protection increasingly expected to form part of the design and operation of digital services rather than being added after systems are deployed.
Safaricom targets businesses without in-house security teams
Safaricom is focusing on MSMEs, which it says account for about 70% of Kenya’s gross domestic product. Many smaller businesses lack the financial resources and specialist personnel needed to operate their own security monitoring and incident response teams.
The company offers two services aimed at helping businesses address those requirements: its Software-Defined Wide Area Network (SD-WAN) and Managed Security Operations Centre (MSOC).
SD-WAN provides secure, reliable and centrally managed connectivity across multiple business locations. The service allows organisations to manage their network connections centrally, an important capability for companies operating branches, offices and other distributed facilities.
The MSOC provides continuous threat monitoring, expert analysis and coordinated incident response. It is designed to help organisations identify suspicious activity and respond to security incidents without having to establish all the necessary capabilities internally.
Together, the services give smaller businesses access to security and network management capabilities typically associated with larger enterprises.
For Safaricom, the proposition extends its role beyond telecommunications connectivity into the technology infrastructure businesses need to operate, protect customer information and manage digital transactions.
For customers, the commercial consideration is whether outsourcing some of these functions offers a more practical and affordable alternative to recruiting specialist staff, purchasing security tools and maintaining round-the-clock monitoring.
Safaricom has not disclosed in the summit announcement how many businesses currently use its managed security services, the revenue they generate or the number of incidents its solutions have detected or prevented. Those figures would help establish the scale and commercial performance of the cybersecurity business.
AI creates opportunities for defenders and attackers
The summit examined artificial intelligence’s dual role in cybersecurity. Organisations can use AI-enabled tools to identify suspicious activity and strengthen threat detection, but attackers can also use the technology to make fraud and impersonation more convincing.
Deepfakes and AI-generated communications can make it harder for employees to distinguish genuine requests from fraudulent ones. Automated scams can be deployed at scale, while ransomware can disrupt operations and potentially expose sensitive business information.
Safaricom’s summit sessions covered AI-enabled threat detection, incident response, ransomware preparedness and the cybersecurity skills gap.
The discussions also emphasised that technology alone cannot guarantee resilience. Organisations need tested procedures, clear accountability and employees who can recognise unusual activity, verify high-risk requests and respond decisively when something goes wrong.
For example, a fraudulent request to change a supplier’s bank details can result in a financial loss if staff act without independently verifying the instruction. Security therefore also depends on internal controls, employee awareness and procedures for approving sensitive transactions.
The challenge is particularly significant for smaller companies, where limited resources can make it difficult to combine technology investment with specialist expertise and staff training.
Cybersecurity becomes part of digital business infrastructure
Safaricom’s cybersecurity push comes as it continues to expand its role as a technology provider across Kenya and Ethiopia. The company says it serves more than 71.6 million customers across the two markets and recorded annual revenue of KSh400 billion as of March 2026.
In Kenya, its network covers more than 99% of the population, according to the company. Its M-PESA platform enables 41 million customers to transact, save and borrow using their mobile phones.
Safaricom says M-PESA generated more than KSh182.7 billion in revenue in the financial year ended March 2026. The company also cites an increase in Kenya’s adult financial inclusion rate from 26.7% in 2006 to 84.8% in 2024, reflecting the role mobile financial services have played in expanding access.
As digital payments, communications and business applications become more embedded in daily operations, protecting the systems supporting those services becomes increasingly important to customers and companies alike.
The same shift creates a market for services that combine connectivity, monitoring and incident response. Businesses may be able to outsource some of these functions, but they still need internal controls, clear responsibility for security decisions and plans for recovering from disruptions.
Now in its fourth year, the Safaricom Cybersecurity Summit serves as a forum for industry dialogue, knowledge sharing and collaboration on digital security. This year’s discussions reinforced the need to match AI adoption with robust governance, responsible innovation and safeguards that preserve trust.
For Safaricom, the opportunity is to turn that growing need into wider adoption of its business technology services. For Kenya’s businesses, the test will be whether stronger cybersecurity can keep pace with the speed at which their operations are becoming digital.
