AI and Automation Are the Future of Cybersecurity – But Who Gets to Shape It in Kenya?

We are living in a time when the rapid pace of digital transformation, while unlocking immense opportunity, is also dramatically expanding the cyber threat surface. The digital age has become both a blessing and a battleground. And as Kenya races towards a digital-first economy, it’s clear that cybersecurity is no longer a peripheral issue—it is a core strategic imperative.

In Q2 2025 alone, Kenya experienced a staggering 840.9 million cyber threat events, a 27.2% increase from the previous quarter, according to the Communications Authority of Kenya and corroborated by SOC Radar’s Kenya Threat Landscape Report 2025. The top attack vectors? AI-powered phishing campaigns, ransomware-as-a-service, and highly targeted social engineering attacks. The targets? Government systems, financial institutions, healthcare providers, and worryingly, universities and public utilities, with outdated infrastructure and under-trained personnel.

This is no longer just about viruses or malicious spam. Cybercriminals are now leveraging generative AI to deceive, infiltrate, and automate at scale. Firewalls and passwords alone are insufficient in this era. We are entering a new paradigm—where AI and automation are not optional enhancements but foundational to our digital defence. But here’s the deeper question: Who controls these technologies, and are they fit for our local realities?

Let’s take Microsoft as a practical case study in what AI-enabled cybersecurity might look like when done at scale.

Today, Microsoft processes over 78 trillion cybersecurity signals daily. That level of signal processing is beyond the capacity of any human team. Through machine learning and automated threat analysis, anomalies can be flagged and threats contained in milliseconds. Their generative AI solution—Copilot for Security—offers security teams real-time suggestions, automated threat summaries, and incident response capabilities. Early metrics show marked improvements in speed and accuracy for both novice and seasoned professionals.

In regions like Kenya, where the cybersecurity talent shortage is acute, such tools could be transformative. According to Kenya’s Cyber Security Strategy 2025 – 2029, building a robust cybersecurity workforce is a top national priority. Yet, most universities still lack cybersecurity-specific degree programmes, and many SMEs operate without even basic threat monitoring.

In that context, tools like Copilot are not just useful—they could be game-changers. But they are not enough.

Africa—and Kenya in particular—needs cybersecurity ecosystems, not just cybersecurity vendors. This means building more than just a toolkit of software and services; it requires a holistic foundation that brings together skilled human capital (arguably our greatest asset), resilient infrastructure, such as secure and locally hosted data centres, and regulatory frameworks that are shaped by and for our unique context. It also calls for deeper collaboration on threat intelligence across industries and sectors, as well as a commitment to digital sovereignty and ethical governance of AI. Only then can we create a cybersecurity environment that’s not just reactive, but resilient, inclusive, and future-ready.

A cybersecurity ecosystem is a harmonious interplay of policy, people, platforms, and partnerships. And this is where the Kenyan and African context must lead the conversation.

“As we navigate Kenya’s unique cybersecurity landscape, local and sustainable innovation must lead the charge,” says Phyllis Migwi, Country General Manager of Microsoft Kenya. “Our progress must align with the complexity of challenges that define our nation’s digital resilience. Artificial intelligence offers transformative potential, but its true impact lies in engaging deeply with Kenya’s realities, prioritising solutions that address critical gaps while maintaining cultural relevance.”

The growing deployment of AI in cybersecurity must not mask our underlying weaknesses. These include outdated IT infrastructure in critical institutions, low public awareness (evidenced by high phishing success rates), fragmented policies and weak enforcement and over-reliance on imported solutions with little local customisation.

We cannot outsource our digital resilience.