Kenya Launches Sovereign Cybersecurity Operations Centre

Kenya has launched a sovereign Security Operations Centre (SOC) to strengthen national cybersecurity capabilities as cyber threats increasingly target public services, financial institutions and critical digital infrastructure.

John Tanui, Principal Secretary in the State Department for ICT and Digital Economy, launched the SecureKE Sovereign Security Operations Centre through Konza Technopolis.

The facility will provide shared cybersecurity services to government institutions and private sector organisations that may not have the resources to operate their own security operations centres.

Its capabilities include continuous security monitoring, artificial intelligence-supported threat detection, incident investigation, vulnerability management and coordinated response to cyber incidents.

The launch comes as Kenya expands its digital infrastructure and moves more public services online through the Digital Superhighway programme. Millions of citizens now access government services through eCitizen, while the country recorded 58.5 million mobile data subscriptions by June 2025.

However, the expansion of digital services has also increased the potential attack surface for cybercriminals.

Tanui cited data from the Kenya Computer Incident Response Team Coordination Centre (KE-CIRT/CC), which detected approximately 4.56 billion cyber threat events between October and December 2025.

Reported banking cyber-fraud losses also reached approximately KES 1.9 billion in 2025, while ransomware, phishing, identity theft and artificial intelligence-enabled attacks continue to grow in sophistication.

“Cybersecurity is not only an ICT concern. It is a national security priority, an economic imperative and a responsibility of institutional leadership,” Tanui said.

Sovereign infrastructure for shared cybersecurity

SecureKE is designed to address the cost and technical barriers that prevent many organisations from establishing dedicated security operations centres.

Its shared-service model allows participating institutions to access monitoring and incident response capabilities through a common platform.

The sovereign infrastructure is also intended to strengthen local control over sensitive security operations, including data governance and access management.

Tanui said the centre complements Kenya’s Cloud First approach by supporting the secure management of digital infrastructure and services within the country.

He urged principal secretaries, chief executives and heads of public institutions to prioritise cybersecurity in organisational planning, governance and resource allocation.

This includes identifying critical systems, assessing vulnerabilities, improving monitoring and incident response, and complying with cybersecurity and data protection requirements.

The government also wants the centre’s performance measured against operational outcomes, including fewer successful intrusions, fewer critical vulnerabilities, faster threat detection, shorter response times and improved continuity of public services.

Tanui challenged the Technopolis Development Authority and the SecureKE team to establish clear service commitments, governance safeguards and measurable performance indicators.

“SecureKE’s success must be judged not by the number of institutions connected, but by how much more secure and resilient they become,” he said.

National cybersecurity coordination

The launch also comes as Kenya works to establish the National Cybersecurity Agency, which is expected to coordinate cybersecurity institutions, capabilities and incident response efforts.

According to Tanui, the agency will provide a national coordination framework to strengthen collaboration among public institutions and other stakeholders.

The SecureKE initiative is also expected to develop local cybersecurity expertise, create employment opportunities and support knowledge transfer to Kenyan professionals and technology companies.

Tanui called on private sector partners to continue supporting innovation, capacity building and responsible threat intelligence sharing.