Kenya has appointed Dr. Martin Koyabe as the inaugural Non-Executive Chairperson of the Board of Directors of the National Cybersecurity Agency, giving the country’s newest security institution its first leadership structure since it was legally established in May. President William Ruto’s appointment, published under Gazette Notice No. 13506, takes effect from August 21, 2026, and runs for a three-year term under the State Corporations (National Cybersecurity Agency) Order, 2026.
What the Agency Is and Who It Affects
The National Cybersecurity Agency was legally established on May 15 under Legal Notice No. 89, but Koyabe’s appointment marks the shift from paper existence to actual operation. The agency is mandated to coordinate national cybersecurity policy, protect critical information infrastructure and strengthen the country’s capacity to prevent and respond to cyber threats across government and the private sector. That mandate touches nearly every digitized part of Kenya’s economy, from mobile money rails and bank systems to government e-services and the data centers increasingly anchoring East Africa’s cloud ambitions.
Principal Secretary for ICT and Digital Economy John Tanui framed the appointment as a strategic milestone tied to Kenya’s push to grow its digital economy to 30 percent of GDP. He noted that the deepening digitization of government services, financial transactions and critical infrastructure has turned cybersecurity into both a national security priority and an economic one, since a compromised digital layer would undercut the very growth the government is chasing.
Koyabe’s Credentials and the Diaspora Framing
Koyabe brings more than three decades of experience across ICT, cybersecurity, telecommunications, policy and regulation. He currently serves as a senior manager and technical lead at the Global Forum on Cyber Expertise in The Hague, where he has worked on cyber-capacity-building programs across Africa, and he is also a founding partner and technical director at Africa Cyber Expertise. His academic background includes a PhD in Communication Engineering from the University of Aberdeen, alongside executive studies at Cambridge and the Harvard Kennedy School. He holds several patents in cybersecurity and telecommunications technology and founded MWK Consult, a London-based technology firm.
Following the announcement, Koyabe thanked Ruto and framed the appointment as recognition of the Kenyan diaspora’s contribution to national development, a point he made explicitly in his public remarks. The diaspora angle matters beyond symbolism. Kenya has increasingly looked to its expatriate technical talent to staff new institutions, a pattern also visible in how African governments and companies court Africans working abroad in AI and cybersecurity roles. Whether that pipeline produces durable institutional capacity or a rotating cast of well-credentialed but externally based leaders is a live question for Nairobi’s policy circles.
Regional Precedents and the Nigeria Comparison
Kenya is not alone in scrambling to formalize national cybersecurity coordination after a run of costly incidents. Nigeria stood up its own Cybersecurity Coordination Council earlier in 2026 only after a string of bank breaches, including a major fraud attempt at First City Monument Bank, forced the federal government’s hand. Kenya’s own path has followed a similar arc. Recent cyber incidents in the country have been cited alongside South Africa’s infrastructure troubles as evidence that African digital economies are outrunning their disaster-recovery and security coordination capacity.
Kenya Broadcasting Corporation reported that the Communications Authority detected 3.4 billion cyber threats in the third quarter to March this year, a 26.1 percent drop from the previous quarter, while the National KE-CIRT/CC issued 20.6 million advisories over the same period. Those numbers cut two ways. A decline in detected threats could reflect genuinely improved defenses, or it could reflect gaps in detection capacity that the new agency is specifically meant to close. Kenya’s rapid build-out of M-Pesa-linked financial infrastructure, including Safaricom’s recent merger of its M-PESA and MySafaricom apps into a single super app handling millions of daily transactions, raises the stakes for whichever answer turns out to be correct.
The Accountability Question
Naming a well-credentialed non-executive chairperson is the easy part of building a cybersecurity institution. The harder test is whether the agency gets the budget, enforcement powers and technical staffing to match its mandate, and whether it can act with independence when the entities it is meant to police include politically connected government ministries and state-linked infrastructure providers. Kenya’s fintech and banking sector, the subject of growing foreign investment interest as conferences like the Africa Fintech and Banking Summit turn toward cybersecurity and cross-border resilience as core themes, will be watching closely for signs that the agency has real teeth rather than a ceremonial board.
What Comes Next
Koyabe and the rest of the board now face the work of building out the agency’s operational structure, staffing and enforcement mechanisms from what is currently a legal framework and a chairperson. Tanui has expressed confidence that the board will help protect Kenya’s digital infrastructure while supporting its ambitions as a regional innovation hub. Whether that confidence is warranted will depend on decisions the agency has not yet had the chance to make.
