Kenyan businesses are facing a new cybersecurity challenge as artificial intelligence (AI) agents become more capable of performing tasks independently, raising concerns over how companies protect their digital identities, credentials and sensitive information. The emerging risks come as cyber threats continue to increase, forcing organisations to strengthen their security systems alongside their adoption of AI technology.
Unlike conventional chatbots, which primarily respond to questions and generate content, AI agents can connect to business applications, databases and internal systems to execute tasks with limited human intervention. Although this capability can improve productivity, it also creates another potential entry point for cybercriminals when access permissions or credentials are compromised.
Robert Ng’etich, threat intelligence team lead for East Africa at NTT Data, told Business Daily that AI agents effectively operate as privileged users within an organisation. If an attacker gains control of an agent with extensive permissions, the intrusion could expose confidential information or spread into other connected systems.
The concern comes against a backdrop of rising cyber incidents in Kenya. The Communications Authority of Kenya detected 11.1 billion cyber-threat incidents in the year to June 2026, representing a 29% increase from 8.6 billion recorded a year earlier.
Distributed denial-of-service attacks, which overwhelm websites and networks with malicious traffic, rose by 114.3% to 72.16 million incidents. Web application attacks also increased by 99% to 51.51 million, highlighting vulnerabilities affecting online services and digital platforms.
Cybercriminals are also using AI to make attacks more convincing. These techniques can help generate realistic phishing messages, translate fraudulent communications into local languages such as Swahili and create deepfake audio or videos that imitate colleagues and senior executives.
Such impersonation can persuade employees to disclose confidential information, reveal login credentials or authorise fraudulent payments. The speed at which AI can support these activities also allows attackers to conduct certain research and prepare attacks much faster than traditional methods.
Businesses are being encouraged to apply strict access controls to AI agents, limiting each system to the information and applications required for its assigned tasks. Companies also need to protect credentials, monitor agent activity and investigate unusual behaviour.
AI is simultaneously becoming a tool for cybersecurity teams. Security operations centres are using it to analyse large volumes of alerts, identify connections between suspicious events and accelerate incident reporting.
For Kenyan organisations, the challenge is to capture the productivity benefits of AI without creating unnecessary vulnerabilities. As adoption expands, digital identity management and continuous monitoring are likely to become increasingly important components of corporate cybersecurity strategies.
