Findings from the Cyber Shujaa Industry Report 2025 show that while demand for cybersecurity professionals stands at about 45,000, universities produce only around 1,500 graduates each year.

Most graduates are also said to lack the technical skills required, leaving a 96 per cent shortfall in critical expertise.

The Communications Authority (CA) reported issuing 13.2 million advisories during the period, with banks, telecoms, and government systems among the main targets.

Attackers exploited weak passwords, outdated software, and poorly secured networks.

Dr Paula Musuva, Curriculum and Training Director at Cyber Shujaa, explained the imbalance.

“On the supply side, many young people struggle to find jobs despite the growing demand for digital skills. On the demand side, companies often compete for the limited number of skilled professionals, leading to a talent gap,” Musuva noted.

Data Commissioner Immaculate Kassait warned that the shortage represents a national security risk.

“We are no longer fighting wars on physical borders. That has shifted. The war has moved to cyberspace. Every single day we are confronted by cybersecurity threats, and those entering this field carry a responsibility almost as heavy as doctors and nurses caring for patients in intensive care,” Kassit said.

The report also flags a gender imbalance, with more than a third of Kenyan organisations lacking women in their security teams.

However, the Cyber Shujaa programme has raised women’s participation to 41 per cent, training 3,000 people and placing over 2,000 in jobs in the past three years.