Summary

  • Kenya’s National KE-CIRT/CC reported 2,696,335,021 detected cyber-threat events in July–September 2026, up 14.45% from the previous quarter.
  • It issued 20,258,111 cyber-threat advisories, down 2.36%; the report publishes neither the event unit nor the method connecting detections to advisories.

Kenya’s latest cybersecurity report puts two huge numbers on the same page. Detected cyber-threat events rose to 2,696,335,021. Advisories issued fell to 20,258,111. The first figure increased 14.45% from April–June; the second decreased 2.36%.

The figures moved in opposite directions. That is the useful question. It is also the point where the report’s arithmetic ends and its operating method should begin.

The Communications Authority of Kenya’s National KE-CIRT/CC calls the first measure detected “cyber threat events” and the second advisories issued “in response” to those events. The July–September report supplies no data dictionary for an event, no deduplication rule, no collection-coverage statement, and no event-to-advisory linkage. It records the totals, not the counting machinery behind them.

The prior quarter makes the gap harder to wave away. In April–June, the centre reported 2,355,938,192 detected events, down 30.03%, while advisories rose to 20,748,489, up 0.81%. The new quarter reversed both directions: event counts climbed; advisory counts eased. Each series may be useful on its own. The published record does not explain how they relate.

The event subtotals add up exactly. “System attacks” account for 2,552,948,966 of the 2,696,335,021 events—about 94.7%. Malware contributes 70,800,154; brute force 44,949,518; web-application attacks 27,435,527; mobile-application attacks 177,732; and DDoS 23,124. That makes the total reproducible from the page.

The advisory subtotals also add up: 8,379,145 for system attacks, 10,380,579 for web applications, 916,418 for brute force, 549,931 for malware, 18,837 for mobile applications and 13,201 for DDoS. The report offers a category ledger. It does not offer the rule that turns one ledger into the other.

That distinction matters to network operators. A detector event, a distinct attack, a confirmed compromise, an incident and an advisory are different counting objects. One campaign can touch many systems; one noisy sensor can emit repeated matches; one advisory can address a class of events. The report does not say which unit its event counter captures or how the centre handles those cases.

Without that bridge, a quarter-on-quarter rise can prompt concern but cannot tell a chief security officer whether exposure widened, collection improved, a classification changed or the same activity generated more records. The accompanying report names system patching, credential controls and web-application weaknesses as concerns, but it does not map the 2.7 billion records to affected operators or service outcomes.

The Authority has begun work on a national Threat Intelligence Sharing Platform. Its report describes training, review of existing sharing arrangements, planning for a national CTI dashboard and an initial action plan. That is the right moment to design the dashboard’s receipts. A chart should show what entered the counter, how duplicates were treated, when a category changed and which advisories followed.

Kenya does not need a smaller number. It needs a number an operator can audit. The current report gives a precise total with no published rule for what one event is. That is a fine way to fill a page and a poor way to budget a response.

Sources