KICTANet attended the workshop on Kenya’s Draft Cyber Hygiene and Awareness Strategy, joining government, private-sector, academic, and civil-society stakeholders to review the improved draft. While the strategy makes important progress toward coordinated, measurable, and inclusive cyber hygiene, stakeholders are also raising serious concerns about its ability to deliver lasting change.
Awareness is not yet behavior change.
The central critique emerging from the workshop is that awareness alone does not guarantee safer online behavior. Stakeholders repeatedly warn that Kenya can deliver awareness campaigns at scale without producing durable behavioral change, especially where messages are generic, repetitive, or disconnected from people’s daily digital realities.
The draft strategy responds by proposing a Cyber Culture Monitoring Framework, a Cyber Culture Index, and the recurring measurement of awareness, behavior, and incident reporting. However, stakeholders stress that these mechanisms need to demonstrate whether phishing exposure, fraud losses, unsafe practices, and incident rates are actually declining.
Fragmentation remains a major risk.
Kenya already has many actors conducting cyber-awareness work, including NC4, the Communications Authority, KE-CIRT, banks, telecommunications providers, and civil society organizations such as KICTANet. Stakeholders note that these efforts often overlap, use different campaign logics, and measure success in inconsistent ways.
The proposed National Cyber Hygiene Agenda seeks to address this by creating a whole-of-society coordination structure. KICTANet’s view is that this coordination must be more than a forum: it requires clear mandates, sustainable financing, shared information systems, and practical mechanisms to prevent duplication. Without these, the strategy risks adding another layer of coordination rather than reducing fragmentation.
Inclusion needs stronger delivery.
The strategy correctly identifies children, youth, women, persons with disabilities, senior citizens, MSMEs, teachers, parents and civil servants as groups facing disproportionate exposure to online harm. It also commits to accessible, audience-specific interventions that respond to language, geographic, disability and digital-access differences.
Stakeholders, however, caution that inclusivity cannot remain a principle on paper. Kenya’s linguistic diversity, unequal access to devices, and varying levels of digital literacy mean that a single national campaign or an English-language online platform will not reach everyone. The strategy needs clearer plans for local-language content, offline channels, community-based delivery, and targeted support for groups with limited connectivity.
Sustainability is still unresolved.
Stakeholders identify resource scarcity, funding gaps, institutional resistance, political instability and bureaucratic duplication as major threats to implementation. They also highlight the risk that cyber hygiene remains reactive, gaining attention after a major incident, then fading once public concern subsides.
Measurement must become mandatory.
A further critique is that the strategy’s 2032 ambition for a cyber-resilient population needs sharper, time-bound and measurable outcomes. Stakeholders argue that Kenya should define observable indicators, such as reductions in preventable incidents, improved reporting and measurable behavior change, rather than relying on broad aspirations.
Stronger incentives, procurement requirements, sector-specific expectations and transparent accountability are needed to ensure that businesses handling consumer data and payments adopt basic cyber hygiene practices.
A strategy worth improving
KICTANet views the refined strategy as a necessary and timely intervention. Its strongest contribution is its shift from isolated awareness activities toward coordinated governance, education, measurement and marketplace accountability. Cyber hygiene will become part of Kenyan culture only when safe digital behavior is practical, accessible and consistently reinforced across government, schools, businesses and communities.
