Opening addresses at summits are usually throat-clearing. Nicholas Mulila’s at the fourth Safaricom Cybersecurity Summit in Nairobi on Wednesday was not. As Safaricom’s Chief Corporate Security Officer, he is responsible business continuity, ethics and compliance, revenue assurance, physical and cyber security and the anti-money laundering activities for the largest technology company in East Africa, and he used his fifteen minutes to do something more useful than welcome us. He set an examination paper, and he opened it with a perspective that probably the rest of the day never really shook off.

“Cybersecurity is not just a tech issue. It is a business issue, and a bigger issue, both in terms of business and in terms of society. Accountability for it sits with all the business leaders who are here, all the government leaders, and even community leaders.”

A Security Chief Who Tried The Tools Himself

Mulila’s theme was that AI helps Safaricom work faster, serve customers better and anticipate problems before they arise, and that the same tools now produce automated phishing and convincing deepfakes at scale. He told us he had tried a deepfake tool himself about a year ago, just to see how it worked, and that the results were unsettling. 

Minutes later, Peter Ndegwa confirmed that a cloned version of the Group CEO’s own voice had been used to push a fake promotion. When the people responsible for securing M-PESA tell you the technology has already been turned on them, the appropriate response is not reassurance. Mulila expressed the discomfort in simple terms: “As we sit here, there could be some guys sitting on our systems, and we don’t know what they are doing. And tomorrow they can cause a lot of chaos.”

The Interpol Numbers & Where They Actually Come From

The data he shared was from the Interpol African Cyberthreat Assessment Report 2026, published in June 2026, which identified East Africa as a hub of mobile money fraud and infrastructure-targeted ransomware, and Kenya specifically as a hotspot for phishing and network attacks. The report says SIM swap fraud in Kenya surged by 327 per cent in 2025, with more than 123,000 fraudulent SIMs issued and an estimated USD 3.8 million drained from mobile wallets, and it records 46,786 DDoS attacks against Kenyan telecommunications operators in the first half of 2025. Mulila added the Communications Authority’s own count for January to March this year, which I checked at 3.37 billion detected threat events, and made the point that these are only the attempts that can be seen. “This is only the number they can detect. It must be much, much more,” he said.

Interpol’s footnote for that 327 per cent figure is Safaricom’s own disclosure in October 2025 that its SIM swap fraud investigations rose from 11 cases to 47. The headline about Kenya is, in origin, a headline about Safaricom’s casework, which is both a credit to the company’s transparency and a reminder of how thin the national data behind these alarms can be. In Kenya, Safaricom is not just the biggest target. It is also most of the dataset.

3 Pertinent Questions For The Kenyan Boardroom

The core of the address was a set of questions Mulila asked each organization to take seriously. 

“Where is AI being used? Which particular areas are we using AI in? Who is accountable? Have we left the accountability to the guys in the technology team, or have we taken full accountability? How do we detect any suspicious activity on our networks?”

His verdict followed without a pause: “If your answer to any of those questions is ‘I don’t know’, I can almost conclude for all of us that we have a lot of work to do.”

I have sat in enough meetings to know he is right. Most boards in Kenyajn and beyond could not tell you where AI is already running inside their operations, because it arrived through a vendor’s product update rather than through a decision. 

Marketing teams are using generative AI tools on customer data without a policy. Finance teams are pasting figures into free chatbots that train on confidential company information. The accountability question is not hypothetical, and the World Economic Forum’s finding that a third of organisations globally still assess no AI tool for security before deploying it is, I suspect, generous for Kenya and the majority of markets globally. 

Nobody Can Protect Themselves Alone

The perspective that Mulila shared with the most conviction was about ecosystems. “As one organisation, we cannot totally protect ourselves. A simple vulnerability can affect you because of the people you work with, because of the partners you work with, because of the partners you interconnect with,” he said. That is why the summit exists: to get the ecosystem into one room, close points of weakness across it, and share intelligence rather than hoard it. It is also, though he did not say so, why the new National Cybersecurity Agency will succeed or fail on whether intelligence flows in both directions.

In Kenya or anywhere else for that matter, the attack surface of any large institution is not its own firewall. It is the agency with an administrator login to the website, the fintech partner on an API, the agent network, the outsourced call centre and the consultant with a shared drive. The weakest link is almost always someone you trust and have stopped checking.

Security Before Innovation, Not After

Mulila’s closing rule was simple.

“Security must not come after innovation. Security must become part and parcel of innovation, and we have to continue to build proper governance and proper controls around it.”

He asked the room to ask every question, including the ones that feel foolish: “Let’s ask all the questions, even those ones we consider not to be so clever. Let’s ask all of them so that we can get proper answers.” The foolish questions are the ones nobody has answered. That is good advice for a summit and better advice for a board.

In Closing…

I would add a fourth question to his three, and it’s the one I would ask first. Which of your partners currently holds a login, a key or an integration into your systems, and when did you last audit it? Most organisations cannot answer that either. Mulila’s three questions test whether leadership understands its own AI posture. The fourth tests whether it understands its own perimeter(s). Both are overdue, and the Interpol numbers suggest the people on the other side of the ledger already know the answers.