Guard your hustle: One click could cost millions in losses

Kenya’s digital economy is expanding at unprecedented speed. Businesses are processing payments online, storing critical data in the cloud and relying on interconnected systems to serve customers in real time. But as organisations accelerate their digital transformation, they are also becoming more exposed to a rapidly evolving threat landscape.

The scale of that threat is becoming impossible to ignore. The Communications Authority of Kenya reported 11.12 billion detected cyber-threat events in the financial year ended June 2026, a 29% increase year-on-year, with system vulnerabilities accounting for 10.64 billion events and malware-related threats rising by nearly 65%. While these figures do not represent confirmed attacks, they underscore the financial, operational and reputational risks cyber threats pose to businesses.

Cybersecurity Awareness Month, observed in October, carries the timely theme, “Don’t make it easy for them.” It is an important reminder that reducing vulnerabilities requires constant vigilance.

As organisations become more dependent on digital infrastructure, the question is no longer whether cyber threats exist. It is whether businesses are prepared to withstand them.

A cyber incident rarely remains a technical problem. A ransomware attack can halt operations, prevent access to essential records and disrupt customer service. A data breach can expose sensitive information, trigger regulatory obligations and erode trust that may have taken years to build. Even where systems are restored quickly, the financial and reputational impact can persist long after the immediate disruption ends.

According to PwC’s recently published Cyber Digest, titled AI-Driven Defence in the Age of AI-Driven Threats, artificial intelligence is enabling more sophisticated cyberattacks, including automated exploitation of system vulnerabilities, deepfakes and voice cloning to impersonate trusted individuals. These techniques can make fraud harder to detect, increasing the pressure on businesses to strengthen their cybersecurity measures.

For businesses, the impact of a cyber incident extends beyond the attack itself to operational disruptions, recovery costs, legal expenses and reputational damage, with SMEs particularly vulnerable to cash-flow pressures and business continuity challenges.

Cyber resilience is therefore not simply about preventing attacks. It is about ensuring an organisation can identify an incident, contain its effects, recover operations quickly and absorb the associated costs.

Kenya’s regulatory environment reinforces the need for preparedness. Under the Data Protection Act, 2019, organisations that experience a personal data breach involving a real risk of harm must notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of the incident. Data processors are required to notify data controllers without delay and, where reasonably practicable, within 48 hours.

Meeting these obligations requires more than a policy document sitting on a shelf. Businesses must have clear reporting structures, response procedures and decision-making protocols that can be activated immediately when an incident occurs.

Without these safeguards, organizations may find themselves struggling not only to understand the scope of an incident but also to comply with regulatory timelines.

Effective cyber risk management requires leaders to protect critical systems and data, strengthen access controls and backups, train employees to identify threats, verify unusual payment requests and assess the security of external providers.

Most importantly, leadership teams should be able to answer a simple question: if a major cyber incident occurred tomorrow, would the organization know what to do?

Who would coordinate the response? How would critical services be restored? How long could operations continue if systems became unavailable? Could the business absorb the resulting financial impact? These are strategic questions, not technical ones.

Even the most robust security controls cannot eliminate cyber risk entirely. This is why businesses need to consider both prevention and financial protection.Cyber liability insurance can provide cover for specified financial losses arising from covered cyber incidents.

For businesses, cyber incidents can disrupt revenue while increasing operational, investigation and recovery costs, placing significant pressure on cash flow, particularly for small and medium-sized enterprises without adequate financial protection.

Cyber insurance complements security measures by covering specified financial losses. Understanding policy exclusions, limits and conditions is essential when assessing protection needs.

For many businesses, the ability to recover financially after a cyber incident may determine whether they resume operations quickly or face prolonged disruption. Cyber insurance should consequently form part of broader risk-management and business-continuity planning, rather than being considered only after a loss has occurred.

The writer is the Managing Director & Principal Officer, Equity General Insurance (Kenya) Limited.