Kenya experienced a dramatic increase in cyber threats during the first quarter of 2025, with over 2.5 billion incidents reported between January and March, marking a 201.7% rise from the 840.9 million threats recorded in the last quarter of 2024.

This is according to the latest Sector Statistics Report issued by the Communications Authority of Kenya (CA) on June 30.

The surge is attributed to growing digital exposure across the country, with system vulnerabilities emerging as the primary entry point for cybercriminals.

The report noted that 2.47 billion attacks targeted these weaknesses up 228.3% from 752.4 million in the previous reporting period.

"System vulnerabilities remain the most exploited area," CA reported, pointing to significant gaps in security frameworks within both government and private sector ICT systems.

Despite the overall increase in cyber threats, some types of attacks showed a decline. Malware dropped by 27.6%, brute force attacks fell by 2.8%, and Distributed Denial of Service (DDoS) attacks plummeted by 75.6%.

However, the rising total volume of threats highlights the growing complexity and sophistication of cyberattacks targeting Kenyan networks.

In response, the Kenya Computer Incident Response Team (KE-CIRT/CC) issued 13.2 million cybersecurity advisories during the quarter—a 14.2% increase from the 11.6 million alerts issued previously.

The most significant advisory spikes were for DDoS threats, which rose by 158.8%, and mobile app-related attacks, which increased by 61.2%.

The Authority linked this surge in activity to Kenya’s rapidly growing digital footprint, driven by expanded mobile and internet access, as well as increased adoption of smart technologies.

Alongside the rise in threats, the report highlighted positive growth in the ICT sector, citing gains in mobile subscriptions, data usage, and broadband connectivity. These indicators point to deepening digital integration across the country.

However, CA cautioned that Kenya’s expanding digital ecosystem must be matched with robust cybersecurity measures. Without adequate protection, the country could face even more severe and targeted cyber threats in the near future.