Key takeaways
- Most attacks start with weak passwords or phishing.
- Turn on two-factor authentication for email and banking.
- Keep automatic, tested backups off-site.
- Train staff — people are the first line of defence.
In this guide
Cyber attacks are no longer a problem for big banks only. Kenyan SMEs lose money every year to phishing, fake invoices, SIM-swap fraud and ransomware. The good news: a few simple habits block most attacks.
The most common threats
- Phishing: emails or WhatsApp messages pretending to be KRA, a bank or a supplier.
- Invoice fraud: criminals change payment details on a real-looking invoice.
- Weak passwords: reused passwords let attackers into several accounts at once.
- Ransomware: files are locked until you pay.
Your 10-point security checklist
- Use a password manager and unique passwords.
- Turn on two-factor authentication for email, banking and social media.
- Keep computers and phones updated automatically.
- Install reputable antivirus on every computer.
- Back up daily, keep one copy off-site and test restores.
- Separate guest Wi-Fi from your business network.
- Confirm any change of bank details by phone.
- Give staff only the access they need.
- Remove access immediately when staff leave.
- Train staff to spot suspicious messages.
What to do if you are hacked
- Disconnect affected devices from the network.
- Change passwords from a clean device.
- Inform your bank if money is involved.
- Restore from a clean backup.
- Report to the National KE-CIRT/CC and review what went wrong.
Data protection obligations
Under Kenya’s Data Protection Act, businesses that handle personal data must keep it secure. Good cybersecurity protects your customers and your reputation.
Need help? Our networking & IT support team can audit your setup, and our security installation service covers physical security.
Frequently asked questions
Are small businesses really targeted?
Yes, attackers often target small businesses because they have fewer protections.
What is phishing?
Fake messages that trick people into sharing passwords or paying fake invoices.
How often should we back up?
Daily for business data, with at least one copy stored off-site.
A Nairobi IT company helping Kenyan businesses grow with websites, software, marketing, networking and security. Our guides are written from real client projects.
