AI Is A Chef, Not A Cook: Cabinet Secretary Hon. William Kabogo Gitau On Children, Kenyan Data & Kenya’s New Cybersecurity Architecture

Moses Mwemezi Kemibaro

6 min read

·

Oct 17, 2026

--

Listen

Share

Press enter or click to view image in full size

Cabinet Secretaries at corporate summits usually read a speech, thank the host and leave. Hon. William Kabogo Gitau did read a speech at the fourth Safaricom Cybersecurity Summit in Nairobi on Wednesday, and it was a serious one. But the moment that will be remembered came when he put the pages down, admitted that AI had not worked very well for him that morning because his notes repeated what Peter Ndegwa and Nicholas Mulila had already said, and spoke without them. What followed could have been the most useful thing a Kenyan minister has ever said about artificial intelligence in public.

The Numbers The CS Put On The Table

The scripted half of the address was a stock-take, and the figures do hold up. Kenya now has more than 84 million active mobile subscriptions, which the Communications Authority’s third-quarter report for FY2025/26 confirms at 84.1 million, a 7.4 per cent rise in a single quarter that pushed mobile penetration to 157.7 per cent. Citizens pay, trade and reach government through their phones, and that reach is what makes the country a target. “That growth has made us a target,” he said, plainly.

Between April and June 2026, he said, the National KE-CIRT detected more than 2.3 billion cyber threat events and issued more than 20 million advisories. The Authority’s own report puts those at 2.36 billion events and 20.75 million advisories. What the CS did not say, and what I think matters, is that the quarterly detection count actually fell 30% from the previous quarter and nearly halved from two quarters earlier, even as the full financial year total reached 11.12 billion, up 29% on the year before. The threat is enormous and the trend is more complicated than a single number suggests. He added that web application attacks, many aimed at government systems, rose 40% on the previous quarter, and that attackers are now using AI to write more convincing messages, imitate voices and produce deepfake video.

Press enter or click to view image in full size

A National Cybersecurity Agency, & The Question It Raises

The institutional response is substantial. Kabogo listed the National Cybersecurity Strategy 2022 to 2027, the Computer Misuse and Cybercrimes Act 2018, the Critical Information Infrastructure and Cybercrime Management Regulations 2024, sector cybersecurity operations centres in telecoms and energy, and, new this year, a National Cybersecurity Agency.

The agency was established by presidential order under the State Corporations Act in May 2026 and approved by Parliament on the 22nd June 2026. Its mandate includes auditing critical infrastructure, running the National Cybersecurity Operations Centre and coordinating incident response. Alongside it sits the Kenya AI Strategy 2025 to 2030 and the draft Kenya Artificial Intelligence and Other Emerging Technologies Policy, which went out for public comment in July and August and is now being finalized.

He was explicit about what AI does to both sides of this architecture.

“Used well, it helps our teams detect threats faster, sift through billions of events and respond before damage spreads. Used carelessly, or left to attackers, it lowers the cost of crime and widens its reach.”

On where the buck stops: “Responsibility for these systems remains with the people and institutions who deploy them.”

The question the agency raises is one the CS himself hinted at. He said operators such as Safaricom often detect an attack before anyone else does, and that when that intelligence reaches the national centre quickly and in confidence, other institutions can close the same gap before they are hit. Whether the new agency becomes a two-way intelligence exchange or a one-way reporting obligation is the main decision that will determine whether it works, or not. Kenya already requires certain incidents to be reported within 72 hours. The private sector will judge the agency by what comes back.

The Voice Note That Sounds Like Your Mother

“A child can now receive a voice note that sounds exactly like their mother. A fake video can show her father or her teacher saying something they never said.”

He went on to describe AI tools being used to create non-consensual images of young people, games using AI to keep children playing and spending, and the newest risk of all: “AI companions add a further risk, because a child may not recognize when entertainment has become manipulation.” He cited Australia’s minimum age of 16 for social media accounts and said Kenya will learn from it while developing an approach suited to its own conditions.

His priorities were age-appropriate design, accessible reporting channels, digital literacy in schools, and platforms giving parents simple controls and a plain explanation of how their services decide what children see. He was explicit about where the burden sits: “Technology companies and platforms have a duty to build these protections into their services from the start. We do not expect parents to become cybersecurity experts.” Then came the commitment: “I therefore call for a national conversation on child online safety, bringing together government, parents, schools, technology companies, telecommunication operators and children themselves. My ministry will convene that conversation.” The invitation was open to Safaricom and every organisation in the room.

I welcome this without reservation, but with one caveat. In Kenya, most children are online on a device registered to an adult’s ID, which makes age assurance the challenge that Australia’s model does not solve for us. A national conversation is the right first step. It needs a date, a chair and a published output, or it will join the long list of conversations in Kenya that were convened but never concluded.

Press enter or click to view image in full size

The Skills Pipeline

On people, the CS said more than 3,000 students from universities and technical institutions took part in the Communications Authority’s National Cybersecurity Bootcamp this year, a figure Huawei, the co-organiser, has also published, and that Kenya’s network of digital hubs and ICT centres of excellence, which he counted at 446 and 47 respectively, gives Kenya a physical footprint through which cybersecurity awareness and skills can reach young people everywhere. The hubs programme has had a difficult rollout, and the CS himself told Parliament in June 2026 that just over 300 were operational, so the larger number is a target rather than a finished network.

Who Will Cook With Kenyan Ingredients?

“AI has made us very clever, most of us, and also equally foolish sometimes, because if you listen to this speech and the other speech and everything else, they all sound the same,” he said, to laughter that was also a little uncomfortable. His argument was that most of us are talking about AI when we should be talking about data.

“Treat AI as a chef. A chef makes good food from the ingredients we give it. So AI uses data. We need to build good data so that we can rely on AI.”

Then the challenge: “We define our problems today with data collected elsewhere. When is it that we will make our own data?” The task he put to the community in the room was to build Kenyan data, in Kiswahili, Kikuyu, Luo and the rest, so that our own models can answer our own questions. His example was very apt: ask an AI the best way to maintain oral hygiene and it will recommend a toothbrush and toothpaste, because no model has been trained on the plants and traditional remedies that generations of Kenyans used for the same purpose.

This is the right diagnosis but also where much work needs to be done. Nobody in Kenya is adequately funding the collection, cleaning and licensing of large vernacular datasets at the scale a serious large language (LLM) model needs. The draft AI policy talks about data sovereignty; the CS has now said what sovereignty would actually require.

Looking Towards The Next Steps

First, whether the child online safety conversation gets a date before the end of the year. Second, whether the National Cybersecurity Agency shares intelligence back to the operators who detect attacks first, or merely collects it. Third, whether anyone in government or industry puts money behind the chef’s ingredients. The CS has set the agenda. The rest of us now have to show up with the data.