Earlier this week, I facilitated a highly insightful discussion panel on technology and cybersecurity at the launch event for NCBA Insurance’s new CyberGuard offering — An innovative and comprehensive Cyber Insurance solution for businesses of all sizes in Kenya. I was invited to moderate the panel by the Adili Group, who are key collaborators and partners with NCBA Insurance in realizing CyberGuard. 

Indeed, given that cyberattacks having surged by a staggering 38% across Africa in the past year, the timing for this discussion couldn’t have been more critical. As I mentioned in my opening remarks, our task was to “bring that conversation from the hypothetical into your reality, into your boardroom, into your server room and ultimately onto your balance sheet”.

The panel featured a formidable lineup of industry experts, each bringing a unique and vital perspective to the table:

• Willie Oelofse, a Director at Adili Group with a deep background in forensic risk and compliance.
• Mbabu Muturi, the Head of Adili Cyber Services at Adili Group and our frontline technical defender.
• Kenneth Ringera, a Microsoft Sales Professional specializing in Africa’s Financial Services Industry at Microsoft.

The insights that emerged were a powerful and sobering reminder that in the digital age, cyber resilience is not just an IT issue — it’s a fundamental pillar of business survival and governance. Here are my most significant takeaways from our rich and candid discussion.

1. The Boardroom Blind Spot: It’s A People Problem, Not ATechnology Problem

One of the most powerful themes, articulated brilliantly by Willie Oelofse, was that the most common and dangerous blind spot in cybersecurity sits right in the boardroom. There’s a pervasive and dangerous misconception that spending large sums on technology is a silver bullet for cyber risk. As Willie stated, the reality is starkly different: “About 70% of the problem is… people. It’s not technology”.

He explained that boards often delegate the responsibility to their technical teams without equipping themselves to ask the right questions. This leads to a false sense of security, which shatters into chaos when an incident occurs. Describing the all-too-common reaction of an unprepared board, Willie noted, “It’s amazing to see how board members react when it goes wrong. They run all over the place”. The core lesson here is that leadership must be trained in crisis management for cyber incidents. A calm, structured, and pre-planned response is infinitely more valuable than panic in the heat of a breach.

2. The Ground Truth In Kenya: Phishing, Practicality, & “Info Stealers”

Bringing the conversation to the local context, Mbabu Muturi was unequivocal about the most underestimated threat facing Kenyan businesses today: the simple phishing attack. He pointed out that this is the primary gateway for threat actors, who then use stolen credentials to pivot from one institution to another. He specifically mentioned the rise of “info stealer” malware in our region, which is prolific in harvesting credentials on a massive scale.

His advice was refreshingly practical, cutting through the often-intimidating jargon of cybersecurity. “Security is saying, close that door. Security is saying, don’t log on to free Wi-Fi… It’s very simple. Those are blind spots,” Mbabu urged. This is a call to action for all of us to address the simple, everyday vulnerabilities that we overlook in our digital lives, both personally and professionally. It’s not always about complex systems; it’s about consistent, secure habits.

3. Building A Fortress: Culture, Collaboration, & Daily Habits

Kenneth Ringera from Microsoft passionately drove home the point that as every business becomes a digital business, a deeply ingrained culture of security is non-negotiable. He even practiced what he preached, carrying his bag on stage with him, explaining, “You saw me walking up here with my bag. That’s a culture thing. I cannot leave my bag in the car”. It was a simple but powerful demonstration of personal security posture.

He emphasized that simple habits, like enabling Multi-Factor Authentication (MFA), are the foundational building blocks of a resilient organization. Moving beyond the annual phishing test, he challenged leaders to implement a continuous, “90-day roadmap” to ensure security measures are adopted across the entire organization. His closing statement on the topic was particularly resonant: “If you don’t secure everyone, you have secured no one”.

4. When The Inevitable Happens: The First 24 Hours & The Strategic Role of Insurance

A recurring theme was the sober acceptance that a breach is inevitable. The conversation then shifted to the critical question of response and recovery. Mbabu painted a vivid picture of the chaos that ensues in an unprepared organization: “You then end up on a call, a team’s call for 48 hours, fighting between our response team and the IT department in the company”.

This is where the strategic value of a product like CyberGuard becomes clear. The panel agreed that cyber insurance is not just a financial backstop; it’s a partnership that brings structure, expertise, and calm to a crisis. Willie emphasized that insurance should be the final piece of a mature risk management strategy, pursued after a company has put its house in order. Kenneth added that the requirements for getting insured can “accelerate” the adoption of essential security measures like MFA, effectively improving a company’s security posture from day one.

5. Voices from the Floor: The Talent Gap & Proactive Measures

The audience engagement was fantastic, raising two particularly salient points. Wamaitha Mwangi, a CISO at HEVA Fund, challenged the panel on the critical “cyber security talent shortage” in Kenya and the urgent need for more “localized threat intel”. The panel acknowledged this as a global issue but highlighted ongoing efforts by firms like Microsoft to map local threat actors and the need for universities to create practical, hands-on cybersecurity programs.

Another excellent question came from Samuel Odhiambo of NCBA Bank Assurance, who asked if “vulnerability scans to come earlier, before the cover is taken, is something that can help to drive awareness and even uptake of the product”. The panelists unanimously agreed, stating that assessments need to become more regular and proactive, shifting from a reactive measure to a continuous part of business as usual.

In closing, my final takeaway was this: “cyber security is a shared responsibility that requires collaboration across all sectors and all partnerships”. The launch of CyberGuard and the depth of this discussion signal a maturing market. The threats are real and growing, but so is our capacity to build a resilient and secure digital future for Kenya.