Kenya's AI imperative balancing innovation with cybersecurity preparedness

Kenyan business leaders are already enthusiastically embracing AI, applying it across diverse sectors to drive efficiency and foster innovation.

From fraud detection in financial institutions to enhancing customer service in telecommunications and optimising operational efficiency in insurance, the allure of AI’s promise—faster insights, better decisions, and stronger performance—is undeniable.

However, beneath this wave of enthusiasm lies an uncomfortable truth: the foundation upon which many Kenyan organisations are building their AI strategies is often shaky.

A substantial portion of critical data and AI infrastructure remains hosted outside the country, creating a growing risk that Kenya could become a consumer rather than a producer of AI, raising economic and structural concerns about dependency on foreign-owned systems.

The rush to adopt AI often sees organisations experimenting with advanced analytics while grappling with incomplete, unstructured, or poorly protected data. They seek automation without first resolving fundamental business process inefficiencies.

This isn’t merely a risky undertaking; it's counterproductive.

AI is only as powerful as the environment it operates in. When systems are disjointed, data is unreliable, and teams are unprepared, AI doesn’t fix the problem — it amplifies it. It accelerates dysfunction, leading to flawed insights that can severely mislead even the most experienced leadership teams.

This strategic oversight is particularly perilous given the rising tide of cybersecurity threats. Kenya is grappling with a dramatic surge in cybercrime, having recorded a staggering 201.7 percent rise in cybersecurity threats in Q1 2025, with incidents skyrocketing to 2.5 billion.

While AI serves as a potent weapon for cybersecurity teams, it is equally leveraged by cybercriminals.

AI is increasingly used to enhance attacks, from sophisticated phishing schemes—which remain a dominant threat, initiating approximately 90 percent of cyberattacks—to AI-driven malware. AI-related cybercrime is expected to account for 40-50 percent of all cyberattacks by 2025.

A new and significant vector of risk is emerging from the internal use of AI itself.

The solution is clear: cybersecurity must transcend the IT department and become a boardroom imperative. It is no longer merely a technical issue but a core leadership responsibility. An organisation lacking visibility over its assets, clarity over its data, and alignment between its systems and strategy will find AI to be an expensive experiment in failure, not a solution.

The operational environment for many Kenyan organisations could exacerbate the already murky waters.

Furthermore, the risk of "jailbreaking"—manipulating large language models (LLMs) through malicious prompts to execute unauthorised database queries, external API calls, or even gain access to networked machines—is a growing reality for organizations rapidly deploying AI without a comprehensive understanding of its security implications. 

The solution is clear: cybersecurity must transcend the IT department and become a boardroom imperative. It is no longer merely a technical issue but a core leadership responsibility. An organization lacking visibility over its assets, clarity over its data, and alignment between its systems and strategy will find AI to be an expensive experiment in failure, not a solution.

These pillars—process, people, data, infrastructure, and decisioning—are not technical features; they are the bedrock of digital leadership.

They determine whether a Kenyan organization is genuinely prepared for AI or merely engaging in a performative adoption. For Kenyan businesses, the moment has arrived to shift the discourse from how to adopt AI to whether they are truly ready for it. In the digital economy, readiness is not optional; it is the only strategy that scales.

The writer is the CEO of Serianu