ACDF 2026 in Nairobi: African cyber sovereignty must now deliver operational capability

A forum built around moving from vision to action

The seventh Africa Cyber Defense Forum took place in Nairobi from 2 to 6 November 2026, combining technical workshops, two plenary days and the Cyberlympics competition. Its theme, Africa’s Cyber Sovereignty: From Vision to Action in a Fragmented World, captured a central tension. African states want greater control over infrastructure and data, while detection, investigation and recovery capability remains uneven across the continent.

The public programme shows that ACDF was not limited to policy speeches. It included training in digital forensics and incident response, SOC design, responsible artificial intelligence and threat-intelligence workflows using MISP. Announced participants included representatives from the Communications Authority of Kenya, NC4, M-PESA Africa, Airtel Kenya, FIRST and Shadowserver.

At publication time, no detailed final declaration with funded commitments and a shared implementation timetable was publicly available. Africa Cyber Review therefore does not present programme themes as adopted outcomes. The useful question is what the forum’s structure reveals about African priorities and how subsequent progress should be measured.

Sovereignty is more than server location

Moving data to a national data centre or selecting a regional cloud can reduce some dependencies, but neither decision creates cyber sovereignty on its own. An organisation remains dependent if it cannot interpret an alert, preserve evidence, reconstruct an attack timeline or restore a critical service without waiting for an external provider.

The DFIR workshops announced in Nairobi covered evidence acquisition, volatile memory, Windows logs, timeline construction and chain of custody. That focus matters. Prevention and awareness have received substantial investment across Africa, while the ability to investigate a compromise and produce defensible findings remains less common and harder to share.

Measurable sovereignty should include four capabilities: local detection, methodical investigation, controlled sharing of useful indicators, and recovery against documented time objectives. The jurisdiction in which a platform is hosted is only one part of that equation.

Turning received intelligence into action

The programme also featured practical MISP training for CSIRTs. The objective should not be to add another indicator feed to already overloaded teams. It should be to turn heterogeneous information into contextualised objects: affected sector, validity period, confidence, observed technique and recommended action.

An indicator collected in Europe or North America is not automatically relevant to a Kenyan bank, a mobile-money operator or a public body running legacy software. African CSIRTs need to enrich external information with local telemetry and redistribute what is useful to their constituencies. That requires classification rules, trusted communities and procedures that protect victims during exchange.

Regional mechanisms should be tested through exercises involving national CERTs, sector regulators and major operators. The number of installed platforms is a weak metric. The time between observing a threat and distributing an actionable, validated response is far more revealing.

Local talent and suppliers are critical infrastructure

Cyberlympics Kenya and the Startup Hub added an ecosystem dimension. Technical competitions can identify people able to solve difficult problems under pressure, while a startup space can bring African suppliers closer to CISOs, regulators and public buyers. These initiatives only have lasting value when they lead to placements, procurement and professional pathways.

African organisations should publish more operational problems that local teams can address: affordable log management, detection for hybrid environments, incident response for local authorities, payment-API security and exposed-asset inventory. Procurement can reward skills transfer, data portability and the ability to operate when international connectivity is degraded.

Supporting a local ecosystem does not require rejecting global technology. It means retaining the ability to choose, integrate and replace. A sovereign architecture should allow an organisation to change provider without losing logs, detection rules or incident history.

How to judge what follows Nairobi

Institutions represented at ACDF can report verifiable outcomes: people trained, exercises completed, notification times, tested sharing arrangements and procedures moved into production. They should also document what remains unfunded.

Five questions follow from the 2026 agenda:

• Can teams preserve and analyse evidence without immediate external dependence?
• Do SOCs have telemetry, authority and decision procedures, or only dashboards?
• Is received intelligence enriched and converted into sector-specific action?
• Do exercises include business owners, authorities and critical suppliers?
• Do identified talents gain access to jobs, laboratories and real contracts?

Nairobi offered a credible bridge between policy, technical practice and the supplier ecosystem. Success will not be measured by attendance. It will be measured during the next serious incident, when African teams must understand the intrusion, coordinate the response and restore services with capabilities they control.

— ◆ —