Kenya's cybersecurity skills gap persists despite training efforts

Organisations are increasingly shifting from reactive responses to preventive strategies against cyber threats. [Courtesy]

A growing shortage of cybersecurity professionals with practical skills continues to hit the country despite more than 1,000 young people graduating under the Cyber Shujaa Programme. 

A new industry report released during the seventh Cyber Shujaa graduation ceremony at United States International University–Africa shows that employers are still struggling to fill key cybersecurity positions even as universities continue producing graduates every year.

“An estimated 1,500 cybersecurity graduates enter the Kenyan job market each year. Despite this growing talent pool, employers continue to report difficulties in filling certain cybersecurity roles,” the 2026 Cyber Shujaa Industry Report states. 

The report links the shortage to a mismatch between university training and the skills required in the job market. 

It found that employers are looking for graduates with skills in cybersecurity law, malware analysis, cryptography, cloud security, cybercrime and digital forensics, yet many graduates ranked low in these areas. 

The report says many training institutions continue focusing on network security and vulnerability analysis while giving limited attention to emerging areas now in demand in the industry. 

It also found gaps in communication, report writing and entrepreneurship skills among graduates. 

According to the findings, the mismatch has contributed to unemployment, long job search periods averaging seven months and underemployment among graduates. 

“Even among employed graduates, only 52 per cent indicated that they were earning the minimum wage,” the report says. 

The study further established that many graduates leave school without practical exposure to real-world cybersecurity situations, making it difficult for them to respond to modern threats facing organisations. 

The report identified shortages in Security Operations Centre (SOC) analysis, threat intelligence, incident response, cloud security, DevSecOps, Governance Risk and Compliance (GRC), and digital forensics. 

Speaking during the graduation ceremony, William Makatiani, the chief executive of Serianu Ltd, said the demand for cybersecurity professionals remained high as organisations faced more sophisticated attacks. 

“We are witnessing a higher rate of proactive strategising by Kenyan firms, including assigning stronger roles for their information security teams, levelling up cybersecurity to board visibility and deepening their budgets by at least 40 per cent over the past year alone,” Makatiani said. 

He said organisations were increasingly shifting from reactive responses to preventive strategies against cyber threats. 

“We are encouraged that over the past decade, Kenyan organisations have accepted the rationale for shifting from reactive to proactive strategies to combat sophisticated attacks, including AI-powered phishing and ransomware,” he said. 

Makatiani said cybersecurity defence, training and human resource budgets were expected to reach Sh5 billion in 2026. 

The programme, implemented by Serianu in partnership with the Kenya Bankers Association and United States International University–Africa, and supported by the Challenge Fund for Youth Employment, has so far trained more than 5,000 cybersecurity professionals. 

Programme data shows that over 75 per cent of participants complete the training, while more than 92 per cent attain industry-recognised certifications. 

More than half of the trainees have either secured jobs or started businesses within the cybersecurity sector. 

The report comes amid rising cyber threats in the country as more services move online across banking, e-commerce and government systems. 

According to the findings, cyber threat incidents reported by late 2025 had risen by 441 per cent, with more than 4.5 billion threat detections and losses exceeding Sh30 billion. 

The report recommends stronger collaboration between universities and industry players in curriculum development to ensure graduates acquire practical and market-driven skills.