For decades, cybersecurity sat comfortably on the margins of the corporate boardroom. It was largely treated as an IT issue, left to chief information officers and technology teams. Board members received periodic reports filled with technical jargon before returning their attention to revenue growth, expansion and capital allocation.
That approach is no longer sustainable. As Kenyan and African enterprises accelerate digital transformation, embrace open banking APIs, migrate critical infrastructure to multi-cloud environments and deploy Generative AI, their exposure to cyber threats is expanding rapidly. Cyber risk is no longer simply a technology concern. It is now a board-level issue that can determine corporate value, regulatory compliance, business continuity and public trust.
After more than three decades of working in technology and organisational transformation across governments, non-profits and large enterprises, I believe boards must begin viewing digital trust not as a defensive cost, but as a strategic asset that can create competitive advantage.
The scale of the threat is significant. According to regular threat intelligence reports from the Communications Authority of Kenya (CA), through the National KE-CIRT/CC, Kenya routinely detects billions of cyber threat events every quarter. These include system vulnerabilities, distributed denial-of-service (DDoS) attacks, ransomware and increasingly sophisticated supply-chain compromises.
For large enterprises, the danger goes beyond automated attacks. Sophisticated threat actors increasingly target intellectual property, high-value financial transactions and vast databases containing customer information. The risks also extend beyond an organisation’s own systems. As businesses across the region adopt cloud platforms and increasingly depend on external technology providers, misconfigured cloud environments and poorly monitored third-party access can create significant vulnerabilities.
When a serious breach occurs, the damage is rarely limited to the cost of repairing systems. Businesses can face operational disruption, regulatory penalties, litigation, loss of investor confidence and, perhaps most damaging, the erosion of customer trust and market share.
Cybersecurity should therefore be integrated into business strategy from the outset. Done properly, it enables innovation by allowing companies to adopt new technologies, enter markets and launch digital products with greater confidence. Boards should assess cyber risk through the same financial and strategic lens they apply to other major business risks. Strong cybersecurity protects both tangible and intangible assets, reduces unexpected losses and can enhance enterprise value. It can also influence cyber-insurance costs, the cost of capital and the attractiveness of a company during mergers, acquisitions and strategic partnerships.
There is also a growing regulatory imperative. Under Section 31 of Kenya’s Data Protection Act, 2019, data controllers and processors are required to undertake Data Protection Impact Assessments (DPIAs) before processing that is likely to result in high risks to individuals’ rights and freedoms. DPIAs should therefore not be treated as administrative paperwork. For boards and risk committees, they should form part of the decision-making process for major technology deployments, new products and digital transformation initiatives.
Similarly, the Central Bank of Kenya’s Guidance Note on Cybersecurity Risk Management places responsibility on boards of financial institutions to oversee cybersecurity strategies, ensure appropriate resources and review independent assessments of cyber resilience. Cybersecurity is increasingly a governance responsibility, not merely a technical one.
Four priorities for the boardroom
First, translate cyber risk into financial language. Boards cannot effectively govern what they cannot measure. Counting blocked malware attacks tells directors little about potential business loss. Frameworks such as Factor Analysis of Information Risk (FAIR) can help translate cyber exposure into monetary terms, enabling boards to assess investments against return on investment and risk appetite.
Second, build privacy and security into projects from the beginning. Privacy by Design means embedding security controls, encryption and data-minimisation measures into products and services at the design stage rather than trying to fix weaknesses after launch.
Third, prioritise operational resilience, not just prevention. No organisation can guarantee a zero-risk environment. Boards should therefore demand realistic tabletop exercises in which executives and directors practise responding to ransomware, data breaches and major service disruptions.
Lastly, strengthen third-party risk management. An enterprise can have excellent internal controls and still be exposed through a weak supplier. Vendor frameworks should include appropriate security audits, recognised certifications such as ISO/IEC 27001 and binding data-processing agreements with clear breach-notification requirements.
In an economy where consumers, investors and international partners increasingly care about how organisations protect data, digital trust can become a powerful market differentiator. Companies that demonstrate responsible data stewardship, transparent governance and strong cyber resilience will be better positioned to win customers, attract investment, manage insurance costs and secure international partnerships.
Cybersecurity is no longer an IT detail to be delegated and forgotten. It is a cornerstone of modern corporate governance. For Kenya’s boardrooms, the question is no longer whether cyber risk belongs on the agenda. It is whether directors are prepared to treat digital trust as a strategic asset, and use it to build more resilient, credible and competitive enterprises.
