Safaricom Cybersecurity Summit: AI will build trust only through measurable controls

Moving security to the strategic level

Safaricom held its 2026 Cybersecurity Summit in Nairobi on 14 October under the theme Harnessing AI, Strengthening Security. The programme brought together executives, public officials, technical specialists and vendors to discuss resilience, cloud services, artificial intelligence and protection of the digital economy.

The organiser’s message was that cybersecurity should be treated not only as a defensive function but as a condition for innovation, trust and growth. For an operator supporting communications, payments and many enterprise services, that shift is logical. An AI-assisted feature may improve service, but it can also widen the attack surface and accelerate mistakes.

The official programme said 70 per cent of content would consist of workshops, demonstrations and technical sessions, with 30 per cent devoted to strategy. It listed representatives from Kenya’s ICT ministry, Safaricom, Microsoft, Cloudflare and security suppliers. Public sources do not provide an exhaustive record of decisions taken, so this analysis assesses the theme and the controls required to make it operational.

AI creates an invisible supply chain

A modern AI service rarely depends on one component. It may combine a local interface, a model API, a cloud provider, a vector database, document sources and tools able to take actions. Each component introduces data flows, permissions and contractual terms. Without an inventory, an organisation no longer knows precisely where customer information travels.

For a telecom or payment provider, data can reveal relationships, habits, location and economic vulnerability. Sending a support conversation to an external model is therefore not a simple productivity decision. The organisation must know the purpose, legal basis, retention period, processing jurisdictions and whether the supplier uses data for another purpose.

The first control is not a sophisticated product. It is a register of AI systems and their flows. Every use case should have a business owner, technical owner, data classification and exit plan. Pilots that cannot answer those questions should not reach production.

Secure decisions, not only models

AI security debates often focus on model theft and poisoned training data. In real services, a more immediate risk can be excessive trust in a plausible output. An assistant may misstate a rule, reveal content from another case or execute an instruction hidden inside a document.

Controls must match the consequence of the decision. A tool rewriting public text does not need the same safeguards as a system that can suspend an account, approve a payment or change network configuration. As impact rises, accessible tools should narrow, intermediate steps should be logged and human approval should become mandatory.

Testing must reflect African use: mixed languages, shared devices, intermittent connections, social engineering and mobile-first services. A model that performs well on an international benchmark may mishandle Swahili, code-switching or a mobile-money scenario. Security therefore includes service quality and fairness, not only resistance to technical attack.

Vendors do not replace governance

Large suppliers at a summit can demonstrate solutions and transfer knowledge. They can also create dependency if architecture, logs and detection rules become inseparable from one platform. Buyers should require event portability, documented interfaces, exit terms and a clear separation between customer data and telemetry reused by the supplier.

A successful demonstration does not prove that a product will work with an organisation’s volumes, constraints and staffing. Before purchase, an operator should run a realistic scenario: compromise of a privileged account, API abuse, slow exfiltration or regional service disruption. It should measure detection time, evidence quality, manual steps and degraded-mode operation.

Skills transfer is real when an internal team can modify a rule, explain an alert and lead an investigation without opening a vendor ticket every time.

A trust dashboard for leadership

Treating security as a growth enabler requires metrics executives understand. Alert and licence counts are insufficient. Leaders need to know which critical services are covered, how quickly teams isolate incidents, how many assets remain unknown and which suppliers can access sensitive data.

African operators and digital businesses should take five actions:

• maintain a register of AI uses, data and owners;
• separate experimentation from production permissions;
• test models for injection, leakage and local-use failures;
• negotiate portability, reversibility and log access;
• connect security metrics to service continuity and customer impact.

Safaricom’s summit was right to connect innovation with cybersecurity. Trust will not result automatically from AI adoption or new products. It will be produced by explicit accountability, tested controls and the ability to demonstrate that essential services remain under control when incidents occur.

— ◆ —