By Michael Etale
For years, cybersecurity operated on the assumption that cyberattacks depended heavily on human intelligence and expertise. Scammers relied on phishing emails, but these were often generic and easy to spot by a careful reader.
Today, that premise no longer applies, as artificial intelligence (AI) has changed the cybersecurity landscape.
Artificial intelligence is a technology that allows computers and machines to perform tasks that would normally require human intelligence. When used well, AI can save time and help people work more efficiently.
Unfortunately, criminals are also using it to plan and carry out cyberattacks, which has added to the broader cyber threat facing Kenya.
Between July 2025 and June 2026, National Kenya Computer Incident Response Team recorded 11.12 billion attempts to attack computer systems, which was 29% more than the 8.62 billion recorded the previous year.
From April to June 2026, more than 2.25 billion of these attempts targeted computer systems. The team also recorded nearly 59 million cases of harmful software and over 24 million attempts to break into accounts by repeatedly guessing passwords. Many attempts failed, but the volume highlights a growing threat.
Previously, carrying out attacks on this scale would have required coordinated groups to spend weeks gathering information and preparing each attempt.
Today, with the use of AI, criminals can target computer systems and accounts more quickly and at a greater scale. This is possible because AI can produce highly convincing emails, imitate voices, clone images and videos, and personalise messages within minutes. As a result, sophisticated cyberattacks that once demanded specialized expertise are now executable through accessible AI tools.
For banks, this changing threat landscape calls for a more robust approach to cybersecurity. As AI makes impersonation and social engineering more convincing, familiar signals, such as an email that appears to come from a senior executive, or a voice on a call that sounds like a trusted colleague, can no longer be treated as proof of identity.
Banks must strengthen verification across digital and human interactions, monitor transactions for unusual patterns and equip employees and customers to recognise emerging scams.
AI-driven systems learn what normal activity looks like and can flag subtle deviations, such as unusual login locations, unexpected transaction sequences, or attempts to access restricted information.
By analysing large volumes of data in real time, these tools can help security teams identify potential threats earlier and focus their attention on activity that warrants investigation.
Beyond detecting suspicious activity, AI can also help banks test their defences before attackers find a way in. It can check software and systems for weaknesses and explore how those weaknesses might be exploited. Teams can then prioritise fixes and strengthen vulnerable areas.
By revealing weaknesses early and helping teams focus on the most urgent fixes, AI-assisted testing allows banks to strengthen their systems before those gaps can be exploited.
These measures are particularly important because individuals are increasingly exposed to AI-enabled impersonation. Using AI, fraudsters can personalize their messages to individuals using publicly available information and impersonate contacts, making it more difficult to distinguish between genuine and fraudulent requests, particularly when the communication creates a sense of urgency.
Evidently, the question is no longer whether an individual, or organisation can recognise a sophisticated scam. It is whether the systems, safeguards and response mechanisms in place can prevent an attempted attack from becoming a costly breach.
Kenya’s cyber incident figures illustrate the challenge. Billions of attempts create a persistent threat that cannot be addressed through awareness alone. Individuals and institutions must combine vigilance with practical safeguards
For customers, that means setting up safety nets before you need them. Use a different password for every account, switch on two-step verification, and activating transaction alerts to identify suspicious payments within minutes.
For banks and businesses, it means assuming some attempts will succeed and designing for that by strengthening controls against unusual transfers, detecting suspicious behaviour early, and ensuring customers can report suspected fraud and get assistance quickly.
AI has made attacks cheaper and easier to launch. The best response is not only to make attacks harder to execute, but also to make successful breaches more difficult to achieve and less costly to recover from.
The author is the Chief Information Security Officer at Absa Bank Kenya