Britain’s top cyber technologist has visited Nairobi to deepen the UK-Kenya cybersecurity partnership. Ollie Whitehouse, chief technology officer of the UK National Cyber Security Centre (NCSC), met Ambassador Philip Thigo, Kenya’s Special Envoy on Technology to the President, according to a TechAfrica News report published October 7.
The talks covered personal data, online services and digital payments. Both sides also discussed safer e-government, local cybersecurity skills and public confidence in digital platforms. Artificial intelligence featured as well. The engagement builds on the UK-Kenya Strategic Partnership, which runs from 2025 to 2030, according to Innovation Village.
The readout names no funding, no timeline and no signed agreement. That gap matters more than the headline.
Why Digital Payments Security Is at Stake
Kenya’s economy runs on mobile money. In April, Safaricom folded M-Pesa and its self-care app into a single super app. That concentrates payments, identity and services in one place. The telco is also landing a second submarine cable with Meta that links Kenya to Oman. Each asset is a target.
The threat data backs that up. Kenya’s national incident response centre, KE-CIRT/CC, detected 11.12 billion cyber threats in the 2025/26 year, a 29% rise, according to Techweez. DDoS attacks climbed 114% to 72.2 million. Malware detections rose 65% to 230.3 million.
Detections are not breaches, however. Quarterly counts swing widely. Communications Authority data reported by TechTrends Kenya shows 4.56 billion threats in October to December 2025, then 2.36 billion in April to June 2026. Automated scanning inflates the totals, so the numbers show exposure rather than losses. The authority did put one loss figure on record: $83 million to cybercrime in 2023, according to Techpoint.
A New Agency Looks for Its First Partners
The UK talks arrive as Kenya builds a cybersecurity agency from scratch. President William Ruto signed the National Cybersecurity Agency Order on May 6, 2026, and Parliament approved it on June 22. The order creates an autonomous regulatory and technical body under the State Corporations Act.
The agency will run the National Cybersecurity Operations Centre. It will also audit and certify the resilience of critical information infrastructure and coordinate responses to major incidents. Until now, responsibility sat across several institutions, including the Communications Authority’s KE-CIRT/CC.
John Tanui, principal secretary for ICT and the digital economy, said in August that the UK partnership would support the agency through technical cooperation with the NCSC, according to ITWeb Africa. Ecofin Agency reported that both governments also want real-time threat intelligence sharing. Their agenda includes AI in cyber defence, with election periods named as a use case.
The Accountability Questions Behind the Talks
Start with overlap. The EU launched its own cybersecurity resilience project in Kenya in January, worth about €3 million over three years, according to Innovation Village. In 2024, the US and Google announced a cyber operations platform pilot for Kenyan e-government services. Each partner brings its own tools, standards and reporting lines. Kenya needs one operating picture.
Data governance follows. Real-time intelligence sharing means Kenyan network data may flow to a foreign agency. Reports of the talks do not say what safeguards apply under Kenya’s Data Protection Act of 2019.
Oversight is the third issue. The agency’s board includes the National Intelligence Service, the Kenya Defence Forces, the National Police Service and the Treasury, alongside academia and the private sector. Analysts cited by TechAfrica News have urged clear oversight so cybersecurity powers do not expand unchecked.
Speed carries its own risk. Kenya has seen fast rulemaking outrun capacity before. Its 2019 digital lending rules shrank credit availability, according to TechMoonshot’s analysis of Ghana’s lending crackdown. A cyber regime that audits critical infrastructure before the agency has staff could repeat that pattern.
What Comes Next
Three things will show whether the UK-Kenya cybersecurity partnership has teeth. Watch for a published work plan from the new agency. Watch for UK funding attached to the talks. And watch how Nairobi coordinates British, European and American support. A partnership that turns visits into analysts, tooling and a working operations centre will protect the digital economy. One that stops at meetings will not.
