A striking 82 per cent of African organisations say they struggle to hire qualified cybersecurity professionals, the highest proportion globally. That shortfall is fast becoming a structural weakness for a region whose digital economy is expanding at remarkable speed.
A 2026 regional study on artificial intelligence and cybersecurity by SmartComply finds that cyber breaches are no longer abstract IT headaches. They are triggering tangible capital outflows. Kenya lost an estimated US$83 million to cybercrime in 2023, while Uganda recorded losses of US$419,487. Unsurprisingly, 74 per cent of businesses across the region now rank cyber risk among their top strategic concerns.
Yet preparedness lags behind awareness. Only 29 per cent of East African firms run routine tabletop simulations, leaving most executives untested against the scenarios they most dread. Tim Theuri, Chief Information Security Officer at M-PESA, notes that while leaders recognise cyber risk as a leading threat, few have rehearsed what a real system failure would entail. Without simulated crises, preparedness remains largely theoretical.
As digital finance penetration deepens across the continent, vulnerability is shifting. The riskiest moments are no longer at account registration but during access, recovery and authentication. Identity based attacks are increasingly central to the region’s cyber risk profile.
Artificial intelligence is accelerating the threat landscape. Sixty per cent of organisations report encountering AI enabled attacks, yet just 7 per cent have adopted AI driven defensive systems. Only 6 per cent have enterprise wide data controls robust enough to support secure AI deployment. In effect, many institutions are confronting algorithmic adversaries with limited technical muscle.
Mark Straub, Chief Executive of Smile ID, observes that the highest stakes arise when users attempt to log back into accounts that already hold value, such as during PIN changes or account recovery. Where once institutions battled human fraudsters, they now face autonomous systems operating at scale.
In East Africa’s mobile money ecosystem, where convenience and speed are prized, attackers exploit precisely those frictionless moments. With mobile money transactions accounting for 53 per cent of Kenya’s GDP, the domestic cybersecurity talent deficit could magnify even modest breaches into broader economic disturbances.
Also Read: EAC Edges Towards Regional Customs Bond Reform
Between July and September 2025 alone, the Communications Authority of Kenya logged more than 842 million cyber threat events, reflecting a sharp rise in automated attacks alongside growing digital uptake. Data from the Central Bank of Kenya show mobile banking fraud cases surged by 87 per cent, fuelled by social engineering, compromised credentials and SIM swap schemes. Healthcare ransomware incidents climbed 95 per cent, underlining that cyber vulnerabilities now threaten critical public services, not merely financial assets.
Uganda offers a cautionary example. Hackers deployed 2,000 SIM cards to siphon UGX 11 billion, roughly US$3 million, across MTN, Airtel and Stanbic Bank. The episode exposed a regulatory blind spot. While banks were subject to oversight, the middleware linking them to mobile wallets was not. A single weak point within an unregulated application programming interface could, in theory, ripple across the financial system, transforming a local breach into a regional emergency.
The report also criticises what it terms performative compliance, where organisations focus on ticking regulatory boxes rather than strengthening real defences. Emerging risks such as Shadow AI can slip through these superficial safeguards, enabling advanced persistent threats to embed themselves quietly. Although privacy and cybersecurity are inherently intertwined, many institutions continue to treat them as separate compliance domains, creating exploitable gaps.
Rather than measuring success by the absence of breaches, the study urges a shift towards systemic resilience. Economies that cultivate homegrown expertise, tighten API governance, run realistic attack simulations and harden identity verification frameworks will be better equipped to withstand digital shocks. In East Africa’s increasingly connected marketplace, cyber resilience may well prove decisive in determining which economies surge ahead and which stumble.
