Photo by Unsplash

Cybersecurity Basics for African Startups: A 2026 Checklist

6 min read

A step-by-step security checklist for small teams in Kenya and across Africa, with the latest KE-CIRT threat figures and the tools that cost little or nothing.

Every startup should start with six basics: a password manager, two-step sign-in on every important account, prompt updates, staff who check before they pay or click, backups you have restored, and a written plan for a breach. Most of this costs little or nothing, and a small team can set it up in an afternoon and a few follow-up sessions.

I co-founded Hackhouse, a builders' hub in Nairobi, where AfricaHackon Academy runs six-month cybersecurity training. This checklist is for founders without a security team. Work through it in order and repeat the review every quarter.

How big is the cyber threat for startups in Kenya?

Kenya's national computer incident response team, the KE-CIRT/CC at the Communications Authority, detected 2,696,335,021 cyber threat events between July and September 2026 (Techweez, reporting KE-CIRT's 43rd report). About 95% were system attacks, which target unpatched software and weak configurations. Malware accounted for 70.8 million events, brute-force login attempts for 44.9 million and web application attacks for 27.4 million.

Breaches are expensive when they land. IBM's Cost of a Data Breach Report 2026 puts the global average cost at US$4.99 million and reports a 56% increase in AI-driven attacks, led by deepfake impersonation and AI-enabled malware (IBM, 2026). For a startup, even a small fraction of that can use up months of runway.

What do you need before you start?

  • A list of every tool that holds company or customer data: email, bank and M-Pesa dashboards, payroll, code, customer database, cloud storage.
  • Owner access to each of those accounts.
  • A password manager. Bitwarden, for example, has a free plan for individuals and a Teams plan at US$4 per user per month, billed annually.
  • A phone for each person that can run an authenticator app.

What are the cybersecurity basics for a startup?

Step 1: Map what you are protecting

Write down every system that touches sensitive data and who has access to it, including contractors and former staff. Then mark the accounts that would hurt most if stolen. For most startups, that is the main email account, because it can reset every other password, the bank or mobile money dashboard, and the customer database. Secure those first.

Step 2: Use a password manager and two-step sign-in

Move every account into the password manager and let it generate long, unique passwords, so one leak cannot open other accounts. Then turn on two-step verification, starting with email and banking. The UK's National Cyber Security Centre calls it "one of the most effective ways to protect your online accounts from cyber criminals" (NCSC). Where you can, use an authenticator app or a passkey, because SMS codes can be stolen through a SIM swap.

Step 3: Patch everything and lock down logins

With system attacks making up most of what KE-CIRT detects, updates matter. Turn on automatic updates for laptops, phones, browsers and plugins. Patch servers and dependencies on a schedule. Limit admin rights to the people who need them, and rate-limit or lock login pages so brute-force attempts fail.

Step 4: Train the team to spot scams

Teach three habits to everyone, and repeat them when someone new joins:

  • Confirm any request for money, passwords or codes through a second channel, such as a phone call to a known number.
  • Check the full sender address and hover over links before clicking.
  • Treat urgency as a warning sign.

Protect your email domain too. Google's sender guidelines require SPF or DKIM for all senders, and SPF, DKIM and DMARC for anyone sending 5,000 or more messages a day to Gmail. Setting these up also makes it harder for scammers to send email that looks like it comes from you.

Step 5: Meet your data protection duties

If you hold customer data in Kenya, the Data Protection Act applies. Controllers must notify the Data Commissioner within 72 hours of becoming aware of a breach that poses what the Act calls a "real risk of harm", and penalty notices can reach KES 5 million or 1% of the previous year's turnover, whichever is lower (DLA Piper). Encrypt sensitive data in storage and in transit, collect only what you need, and register with the Data Commissioner if you meet the thresholds. Our data privacy guide explains registration and GDPR.

Step 6: Prepare for a bad day

  • Backups. Keep a copy of critical data separate from your main systems, and restore it once a quarter to prove it works.
  • An incident list. Who calls the bank, who resets passwords, who tells customers and who notifies the regulator. Write names and numbers down now.
  • A simple way to report. Make it easy for anyone to say "I think I clicked something" without fear. Early reports cost less to fix.
  • National help. KE-CIRT/CC takes incident reports through an online form and runs hotlines on +254 703 042700 and +254 730 172700.

What security mistakes do startups make?

  • Reusing passwords across accounts.
  • Relying on SMS codes for the most important accounts.
  • Giving everyone admin access and never removing it when people leave.
  • Keeping API keys and passwords in code or chat messages.
  • Skipping backups until after a crisis.

To learn more, explore AfricaHackon Academy and our other programmes, or meet security-minded builders at our events.

Key facts

  • KE-CIRT/CC detected 2,696,335,021 cyber threat events in Kenya from July to September 2026.
  • About 95% of those events were system attacks.
  • IBM puts the 2026 global average cost of a data breach at US$4.99 million.
  • Kenyan controllers must report qualifying breaches to the Data Commissioner within 72 hours.
  • Google requires DMARC for senders of 5,000 or more messages a day to Gmail.

Frequently asked questions

What is the first security step a startup should take?

Secure the main email account with a strong unique password and two-step verification. Email can reset almost every other account, so it comes first.

Is SMS two-factor authentication safe enough?

It is far better than a password alone. For email, banking and admin accounts, use an authenticator app or a passkey where available, because SMS codes can be intercepted through a SIM swap.

Where do I report a cyber incident in Kenya?

Report it to KE-CIRT/CC through the incident form on its website or its hotlines. If personal data is affected, you may also need to notify the Data Commissioner within 72 hours.

Do small startups need a security team?

Most do not need one at first. A founder can set up these basics in a few sessions. Bring in a specialist when you handle payments, health data or large customer databases, or when a client asks for an audit.

Sources

Go deeper with us. Join the Hackhouse community for conversations that go beyond the surface, where builders share the hard-won lessons that never make it into press releases.

StartupsAfricaProduct DevelopmentLeadershipGrowthBuildInAfricaFounderTipsAfricanStartupsDataProtectionStartupSecurityCybersecurity

Share this post