Safaricom Group Chief Executive Officer Peter Ndegwa has called for cybersecurity to become a fundamental part of digital innovation, warning that the growing adoption of artificial intelligence (AI) must be matched by stronger safeguards, responsible innovation and collaboration across industries.
Speaking at the fourth Safaricom Cybersecurity Summit in Nairobi on October 14, 2026, Ndegwa said businesses could not afford to treat cybersecurity as an afterthought as AI transformed how organisations operate, deliver services and interact with customers.
The summit, held under the theme “Harnessing AI, Strengthening Security,” brought together leaders from Kenya’s digital ecosystem to examine how organisations can harness the benefits of artificial intelligence while protecting businesses, customers and critical digital infrastructure against increasingly sophisticated cyber threats.
The summit was held at a time when Kenya’s digital economy is expanding rapidly, with mobile money, online services, digital banking and technology-driven business operations becoming increasingly important to everyday economic activity.
Ndegwa says trust must be built into digital services from the beginning, rather than introduced only after a product or platform has been developed.
“AI is expanding what is possible for businesses and society, but that opportunity must be built on trust,” said Ndegwa.
“Cybersecurity can no longer be treated as a technical safeguard added after a service is developed. It must be embedded from the start and strengthened through shared standards, responsible innovation and collaboration across sectors. That is how we ensure digital progress remains safe, inclusive and worthy of our customers’ confidence,” he added.
Ndegwa wants cybersecurity placed at the centre of Kenya’s digital transformation debate, with implications for telecommunications companies, financial institutions, government agencies, small businesses and other organisations that are increasingly dependent on digital platforms.
Safaricom CEO Calls for Cybersecurity Amid Growing Cost of Cyber Threats
The scale of Kenya’s cybersecurity challenge was a major backdrop to the summit. According to the Communications Authority of Kenya, the National Kenya Computer Incident Response Team–Coordination Centre detected 11.12 billion cyber threat events during the last financial year, a 29 per cent increase from 8.62 billion in the previous year.
The figures underscore the growing pressure on organisations to strengthen their digital defences as cyber threats evolve in scale and sophistication.
Threat events can include suspicious activities and other security signals identified by monitoring systems. The figures nevertheless point to the importance of continuous surveillance, effective incident response and stronger security controls.
For businesses, the risks extend beyond the immediate costs of responding to an incident. A successful attack can disrupt operations, expose customer information, undermine consumer confidence and damage a company’s reputation.
For organisations that handle financial transactions or sensitive personal data, the consequences can be particularly serious. Customers need confidence that the digital platforms they use to transfer money, make payments, access services and conduct business are adequately protected.
Ndegwa’s emphasis on trust reflects a wider business challenge: digital growth depends not only on the availability and convenience of technology, but also on the confidence people have in the systems supporting it.
AI Is Creating New Opportunities and More Sophisticated Cyber Threats
Artificial intelligence is changing the cybersecurity landscape by giving organisations new tools to identify suspicious behaviour, analyse large volumes of security data and respond to potential threats more quickly.
However, the same technology can also help criminals produce convincing fraudulent messages, imitate legitimate individuals or organisations, automate scams and develop more sophisticated social-engineering attacks.
Safaricom’s cybersecurity summit specifically examined the growing risks associated with deepfakes, AI-generated impersonation, automated scams and ransomware.
Deepfake technology can be used to create manipulated audio or video that appears to show a real person saying or doing something they never did. AI-generated impersonation can also make fraudulent communications more convincing, increasing the risk that employees or customers will trust instructions that appear to come from a legitimate source.
These developments make traditional security awareness measures increasingly important, but they also require organizations to reconsider how they verify identities and authorize sensitive transactions.
A convincing voice message or video call, for example, should not automatically be treated as proof of identity when a request involves transferring money, changing account details or disclosing confidential information.
Businesses need reliable verification procedures, clear approval processes and systems for reporting suspicious activity. Employees must also understand that urgency, familiarity and apparent authority can be used to manipulate them into making costly mistakes.
Organizations that incorporate security into the design of their digital services can identify vulnerabilities earlier and establish safeguards before systems are deployed at scale.
Why Cybersecurity Must Become a Boardroom Priority
While technical teams remain essential, the security of an organization also depends on decisions made by senior management, operational teams, employees, suppliers and business partners.
Cybersecurity risks can affect revenue, business continuity, regulatory compliance and customer relationships. Consequently, organisations need leadership oversight, clear accountability and sufficient investment in preventive measures.
The discussions at the Safaricom Cybersecurity Summit highlighted the importance of tested processes, clearly assigned responsibilities and a security-aware culture. Organisations must be able to recognise unusual activity, verify high-risk requests and respond decisively when incidents occur.
Preparing for an attack is as important as trying to prevent one. Businesses need incident response plans that identify who makes decisions, who communicates with customers and regulators where required, and how essential services will be restored.
Regular testing can help expose weaknesses in these plans before a real incident occurs. Organisations should also review their access controls, software updates, data protection practices, backup arrangements and procedures for managing third-party technology providers. A weakness in one supplier or service provider can expose other businesses connected to the same systems.
Cooperation between telecommunications operators, financial institutions, technology companies, government agencies and other stakeholders is therefore important to improving the resilience of Kenya’s digital economy.
Safaricom Targets Cybersecurity Support for Small Businesses
A significant part of Safaricom’s cybersecurity strategy is helping micro, small and medium enterprises (MSMEs) strengthen their digital defences.
MSMEs account for about 70 per cent of Kenya’s gross domestic product, making their ability to operate securely an important consideration for the wider economy.
Smaller businesses are increasingly adopting digital payments, cloud-based services, online sales platforms and connected business systems. These tools can improve efficiency and expand market access, but they can also introduce security risks if businesses lack the expertise and resources needed to manage them.
Unlike large corporations, smaller enterprises may not have dedicated cybersecurity teams or the financial capacity to deploy sophisticated security infrastructure. A single incident involving compromised accounts, stolen customer information or disrupted operations can therefore have serious consequences.
Safaricom says it is addressing this challenge through its Software-Defined Wide Area Network (SD-WAN) and Managed Security Operations Centre (MSOC).
The SD-WAN solution provides secure, centrally managed connectivity across multiple business locations, while the MSOC offers continuous threat monitoring, expert analysis and coordinated incident response.
Together, the services are intended to give smaller businesses access to enterprise-grade security capabilities without requiring them to establish and manage complex cybersecurity operations internally.
The commercial significance of this approach is clear. As more businesses move their operations online, security services can become an important part of the infrastructure they need to operate reliably and maintain customer confidence.
Reliable internet access alone is not enough if businesses cannot adequately protect the systems and information that depend on it.
Kenya’s Cyber Resilience Requires Skills and Preparedness
Beyond technology and security products, the summit highlighted the need to address the cybersecurity skills gap.
Effective cybersecurity requires people who can identify emerging threats, investigate suspicious activity, manage incidents and help organisations strengthen their defences. It also requires employees outside specialist technology roles to understand basic security practices.
The Communications Authority of Kenya has previously identified inadequate system patching, limited awareness of phishing and social engineering, and the misuse of artificial intelligence among factors contributing to cyber threats. Its cybersecurity reporting has also emphasised measures such as regular software updates, stronger access controls, firewalls and multi-factor authentication.
These measures illustrate why cybersecurity cannot depend on a single product or intervention. Organisations need multiple layers of protection, supported by trained personnel and clearly defined procedures.
They must also prepare for the possibility that some attacks will succeed despite preventive controls. Secure backups, tested recovery procedures and effective incident response can help limit disruption and accelerate the restoration of services.
Strengthening these capabilities will be important as businesses, public institutions and consumers become more dependent on interconnected digital systems.
The challenge is not simply to detect more threats, but to ensure organizations can prevent avoidable incidents, contain attacks when they occur and recover without suffering prolonged disruption.
Organizations also need to maintain clear accountability for how AI systems are used, particularly when those systems influence customer interactions, access to information or business decisions.
At the same time, cybersecurity should not be viewed solely as a constraint on innovation. Effective safeguards can make customers more confident in digital services, help businesses manage operational risks and create a stronger foundation for sustainable technology adoption.
The summit provided an opportunity to position cybersecurity as a shared responsibility involving businesses, technology providers, regulators and other stakeholders in Kenya’s digital ecosystem.
Now in its fourth year, the event has become a platform for industry dialogue, knowledge sharing and collaboration, according to the company.
As artificial intelligence continues to reshape digital services, that trust will need to be supported by practical safeguards, skilled professionals, effective oversight and a willingness among organizations to work together against evolving cyber threats.
ALSO READ: Safaricom Ethiopia Surpasses 15 Million Subscribers as It Marks Five Years
