The Kenyan government has opened a shared Security Operations Centre (SOC) at Konza Technopolis, providing public institutions and private companies with specialised network monitoring and incident‑response services.

The facility operates on a subscription model, with organisations paying annual fees based on the scale and type of digital assets – such as servers, firewalls and routers – they wish to protect.

AI tools continuously scan participating networks, flagging suspicious activity and coordinating responses to incidents like hacking, ransomware and phishing.

Beyond alerts, the SOC offers threat intelligence, proactive threat hunting and detailed investigation of flagged events, helping organisations distinguish genuine attacks from routine traffic.

Government ministries are among the first users, bringing public‑sector websites, applications and databases under the shared service as Kenya expands digital public services.

The SOC complements existing managed‑security offerings from telecom firms such as Safaricom, adding a government‑backed alternative for organisations that cannot justify building their own security operations centre.

The launch follows a surge in cyber threats: the Communications Authority recorded 2.7 billion threat incidents between July and September 2026, a 14.45 % rise from the previous quarter, with brute‑force attempts up 85.41 %.

Government agencies were among the most affected sectors, alongside ISPs and cloud providers, underscoring the need for continuous visibility across multiple digital assets.

John Paul Okwiri, chief executive of the Konza Technopolis Development Authority, said the SOC will strengthen Kenya’s capacity to detect and respond to cyber threats, supporting a secure and resilient digital ecosystem.