Savvies Eyes

Decision intelligence for the people responsible for technology, cyber & AI in Kenya

● Briefing liveSyncing cycle…
The morning decision layer

Know what changed. Understand why it matters. Decide what to do next.

Savvies Eyes turns noisy public cybersecurity and AI reporting into a short, confidence-ranked briefing built for people who make decisions — not analysts hunting through feeds.

Less noise. Better decisions. Kenya first.

Today's 3 hot signals — jump straight there
Microsoft's August Patch Tuesday fixes 398 flaws…10.0Critical SharePoint auth-bypass (CVE-2026-55040…7.5Malware attack forces Suisun City…10.0

What needs your attention

Ranked by consequence (severity × confidence), not clicks
● CRITICAL SIGNALscore 10.0/10 = 10 (severity) × 1 (Confirmed)

Microsoft's August Patch Tuesday fixes 398 flaws, including a WinSock zero-day under active attack

Microsoft patched 398 CVEs (42 critical) across Windows, Office, SharePoint, Azure and more. The actively-exploited flaw, CVE-2026-68820, is a use-after-free in the Windows AFD.sys WinSock driver that can grant SYSTEM privileges; it's been observed in the Lazarus Group's Operation Dream Job campaign.

Decision: Confirm the August cumulative update is applied to all Windows endpoints/servers; prioritize internet-facing and privileged systems first.
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersIf you run Windows infrastructure, this is this month's single highest-priority patch — it's already being used in real attacks, not a theoretical risk.
Who should careCISO / IT Lead / Founder running Windows infrastructure
🇰🇪 Kenya impactIndirect — global vulnerability, no Kenya-specific targeting reported. Still applies to any Kenyan org running Windows.
What to doConfirm the August cumulative update is applied to all Windows endpoints/servers; prioritize internet-facing and privileged systems first.
RelatedSame Microsoft August patch cycle as the SharePoint flaw below.
● CRITICAL SIGNALscore 7.5/10 = 10 (severity) × 0.75 (Developing)

Critical SharePoint auth-bypass (CVE-2026-55040, CVSS 9.1) chains into unauthenticated RCE

Rapid7 researchers detailed how a JWT token-validation flaw in on-prem SharePoint Server (2016, 2019, Subscription Edition) lets an unauthenticated attacker impersonate any user, including admins. The auth-bypass half was patched in July; it chains with a second bug into full remote code execution, with that component expected to close in Microsoft's August cycle. SharePoint Online is not affected.

Decision: Check whether you run on-prem SharePoint Server (not Online); if so, confirm July's auth-bypass patch is applied and watch for the RCE-chain patch this cycle.
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersOn-prem SharePoint runs internal company intranets everywhere — an attacker who can impersonate any user, including admins, has a direct path to internal documents and credentials.
Who should careIT Manager / CISO running on-prem SharePoint
🇰🇪 Kenya impactIndirect — applies to any Kenyan org running on-prem SharePoint Server (not SharePoint Online).
What to doCheck whether you run on-prem SharePoint Server (not Online); if so, confirm July's auth-bypass patch is applied and watch for the RCE-chain patch this cycle.
RelatedSame patch cycle as the WinSock zero-day above.
● CRITICAL SIGNALscore 10.0/10 = 10 (severity) × 1 (Confirmed)

Malware attack forces Suisun City, California to shut down 911 dispatch and declare a State of Emergency

A confirmed malware attack disrupted 911 routing, emergency dispatch, and municipal services in Suisun City, prompting a State of Emergency declaration and a full IT network shutdown while federal and state agencies assist with recovery.

Decision: Pull up your incident response plan and confirm it covers a full operational shutdown scenario, not just data-breach notification.
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersA live example of how a routine malware infection can cascade into a public-safety emergency — the scenario every critical-infrastructure operator should be modeling.
Who should careCISO / Operations Lead at any organization running critical or public-facing infrastructure
🇰🇪 Kenya impactIndirect — no Kenya-specific link, but directly relevant to any Kenyan county government, utility, or emergency-services operator's continuity planning.
What to doPull up your incident response plan and confirm it covers a full operational shutdown scenario, not just data-breach notification.
RelatedFits this week's pattern — Gov/Mil/LE was the most-targeted sector in the Aug 5–11 roundup below.

Everything else this cycle

14 items
High priorityCybersecurity🇰🇪 KenyaConfirmed

Interpol names Kenya a regional hub for mobile-money fraud and infrastructure-targeted ransomware

Interpol's African Cyberthreat Assessment Report 2026 singles out Kenya as standing out in incident volume across East Africa, driven by mobile-money fraud and ransomware aimed at infrastructure.

Source: Kenyans.co.ke · https://www.kenyans.co.ke/news/125832-interpol-reveals-why-kenya-has-become-east-africas-cybercrime-hotspot
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersA reputational and risk signal for anyone running fintech, telecom, or government systems in Kenya — expect more scrutiny from partners, insurers, and regulators.
Who should careFounder / Board / CISO at a Kenyan fintech, telecom, or government-adjacent org
🇰🇪 Kenya impactHIGH — Kenya is named directly as the subject of this finding.
What to doIf you're in fintech/telecom/gov, raise this in your next risk review — it's now citable in board and insurer conversations.
RelatedSee the Nigeria Daily Trust claim below — the closest other African-continent signal tracked this cycle.
Medium priorityCybersecurity🇰🇪 KenyaConfirmed

Kenya tightens online-identity rules, ending the era of anonymous public browsing

New rules under Kenya's National Cybersecurity Strategy push a shift from 'access at all costs' to 'access with accountability,' effectively closing out anonymous public internet access.

Source: TechCabal Daily · https://techcabal.com/2026/08/12/techcabal-daily-kenyas-new-internet-bouncers/
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersIf you run a Kenyan platform with user accounts, expect new identity-verification and compliance obligations tied to this shift.
Who should careFounder / Legal & Compliance at a Kenyan platform business
🇰🇪 Kenya impactHIGH — this is a Kenya-specific policy change with direct compliance implications.
What to doFlag to legal/compliance now; identity-verification obligations tend to have implementation deadlines.
ContextCybersecurity🇰🇪 KenyaConfirmed

Kenya ranks second in the META region for web-based cyber threats (Kaspersky H1 2026)

Kaspersky data shows security software blocked 4.5 million online attacks in Kenya in H1 2026, with 21.2% of users affected — placing Kenya second in the Middle East/Türkiye/Africa region.

Source: Kenyan Wall Street · https://kenyanwallstreet.com/kenya-cyber-threats-kaspersky
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersConfirms Kenya is a sustained target, not a one-off — useful context if you're making the case for security budget internally.
Who should careAnyone building the case for security investment in a Kenyan org
🇰🇪 Kenya impactHIGH — Kenya-specific ranking, directly citable.
What to doNo immediate action — use as supporting context in budget/board conversations.
Medium priorityAI🇰🇪 KenyaDeveloping

Kenya's draft Artificial Intelligence Bill, 2026 draws 'too soon?' pushback

Legal commentary is questioning whether Kenya's draft AI Bill, 2026 is moving ahead of the country's readiness to regulate the technology.

Source: Bowmans · https://bowmanslaw.com/insights/kenya-artificial-intelligence-bill-2026-proposed-too-soon/
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersIf you're building or deploying AI in Kenya, this debate could directly shape what compliance looks like — worth tracking before rules solidify.
Who should careFounder / Legal & Compliance building or deploying AI in Kenya
🇰🇪 Kenya impactHIGH — Kenya-specific regulatory debate with direct compliance implications.
What to doNo action required yet — this is worth a calendar reminder to check status in 4-6 weeks.
RelatedFeeds into the AI policy consultation below.
Medium priorityAI🇰🇪 KenyaConfirmed

Kenya's draft National AI & Emerging Technologies Policy closed public consultation

The Ministry of ICT and the Digital Economy closed consultation on the draft AI and Emerging Technologies Policy 2026, which proposes a National AI and Emerging Technologies Council as the country's central AI regulator.

Source: TechWeez / ICT.go.ke · https://techweez.com/2026/07/28/kenya-ai-policy-2026-public-consultation/
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersThe resulting regulations will likely draw directly on this consultation — a preview of what's coming.
Who should careFounder / Legal & Compliance building or deploying AI in Kenya
🇰🇪 Kenya impactHIGH — direct precursor to Kenya's AI regulatory framework.
What to doNo action required — monitor for the resulting policy/regulations.
RelatedFeeds into the AI Bill debate above.
Medium priorityAIProjection

Agentic AI adoption accelerating: Gartner projects 40% of enterprise apps will ship built-in task-specific agents by end of 2026

That's up from under 5% a year earlier, per industry trend roundups — a sharp signal of how fast autonomous AI agents are moving from pilot to production across enterprises.

Source: AI Weekly / industry roundups · https://aiweekly.co/
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersIf competitors are shipping agentic features and you're not planning for it, this is the pace you're being measured against.
Who should careFounder / Product Lead evaluating AI roadmap
🇰🇪 Kenya impactNo Kenya-specific adoption data exists yet for this stat — flagged honestly rather than guessed. Worth watching whether Kenyan fintech/telecom players (the sectors with the budget to move first) start shipping agentic features at anything close to this pace.
What to doNo immediate action — useful input for product/roadmap planning conversations.
ContextAI🇰🇪 KenyaDeveloping

Nairobi Securities Exchange plans East Africa's first AI-focused ETF

The NSE is developing an AI-stocks-focused exchange-traded fund it aims to launch before year-end — a first for the region.

Source: CNBC Africa · https://www.cnbcafrica.com/2026/kenyas-stock-exchange-plans-east-africas-first-ai-focused-etf
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersA signal Kenyan capital markets are starting to price in AI exposure — relevant if you're fundraising or benchmarking investor sentiment.
Who should careFounder fundraising / Board benchmarking investor sentiment
🇰🇪 Kenya impactMODERATE — Kenya-specific market development, not a security risk item.
What to doNo action needed — awareness only.
ContextAIDeveloping

Open-weight models keep closing the gap with closed frontier labs

The model capability race continues to accelerate, with frontier labs shipping major updates every few months while open-source/open-weight models rapidly narrow the gap with commercial APIs.

Source: Build Fast with AI / industry roundups · https://www.buildfastwithai.com/blogs/collection/ai-industry-news-trends
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersDirectly relevant if you're deciding whether to build on a closed API or a cheaper open-weight model.
Who should careFounder / Engineering Lead making AI vendor decisions
🇰🇪 Kenya impactNo direct Kenya link, but this is the exact tradeoff a Kenyan founder faces earlier than most: dollar-denominated closed-API pricing versus a cheaper self-hosted open-weight model, under real forex and bandwidth cost pressure most Silicon Valley roadmaps don't factor in.
What to doNo action needed — awareness only.
High priorityDeep Savvy Intel🇰🇪 KenyaConfirmed

Kenya flagged as a regional hub for mobile-money fraud & infrastructure ransomware (Interpol 2026)

Same Interpol finding as in the Cybersecurity tab, viewed through the leak-economy lens. No Kenya-linked victim was named on the monitored leak-announcement channels this cycle — flagged here as the baseline to watch against, not fabricated to fill the slot.

Source: Kenyans.co.ke · https://www.kenyans.co.ke/news/125832-interpol-reveals-why-kenya-has-become-east-africas-cybercrime-hotspot
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersThe risk profile to watch — if a Kenyan victim shows up on a leak-announcement channel, this is the backdrop it fits into.
Who should careCISO / Founder at a Kenyan fintech, telecom, or government-adjacent org
🇰🇪 Kenya impactHIGH (cross-referenced with the Cybersecurity tab item — not scored twice in the Risk Radar).
What to doNo new action — same as the Cybersecurity tab entry.
RelatedSee the Panzer/Daily Trust claim below — the closest regional leak-site activity tracked this cycle.
Medium priorityDeep Savvy IntelAfrica-regionalPending verification

Panzer hacking group claims breach of Nigeria's Daily Trust newspaper, 320GB allegedly exfiltrated

A threat actor calling itself Panzer claimed on a monitored leak-announcement channel to have breached Nigerian outlet Daily Trust, exfiltrating 320GB of data. Not Kenya-specific, but the closest African-continent signal this cycle.

Source: Hackmanac Cyber News (Telegram, public OSINT channel) · https://t.me/s/hackmanac_cybernews
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersWorth watching for whether similar actors turn toward Kenyan media or public-sector targets next.
Who should careCISO at a Kenyan media or public-sector organization
🇰🇪 Kenya impactMODERATE — regional (West Africa), not Kenya-specific; included as an early-warning pattern.
What to doNo action needed — awareness only.
RelatedCross-reference with the Interpol Kenya hub finding above.
ContextDeep Savvy IntelConfirmed

Weekly leak-site roundup: 476 claimed cyberattacks across 62 countries (Aug 5–11, 2026)

Hackmanac's weekly tally of ransomware/leak-site claims: 476 attacks across 62 countries, with 'Orova' and 'The Gentlemen' the most active groups (35 claimed victims each). The US was most affected (33% of incidents), Government/Military/Law Enforcement the most-targeted sector (16%), and roughly 75.5TB of data claimed stolen overall.

Source: Hackmanac Cyber News (Telegram, public OSINT channel) · https://t.me/s/hackmanac_cybernews
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersThe baseline — if your organization isn't seeing anything resembling this volume of attention, either you're well-defended or you're not watching closely enough.
Who should careCISO benchmarking their own alert volume against the wider landscape
🇰🇪 Kenya impactIndirect — global aggregate stat, no Kenya-specific breakdown available this cycle.
What to doNo action needed — reference stat for context.
Medium priorityDeep Savvy IntelPending verification

Dire Wolf ransomware group claims breach of Spanish healthcare provider Quirónsalud

Claimed exfiltration includes medical records, protected health information, financial documents and internal NDAs. Unverified by the hospital group as of this cycle.

Source: Hackmanac Cyber News (Telegram, public OSINT channel) · https://t.me/s/hackmanac_cybernews
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersHealthcare breaches carry outsized regulatory and reputational cost — a pattern worth watching even outside Spain.
Who should careCISO / Compliance Lead in healthcare
🇰🇪 Kenya impactIndirect — no Kenya link; relevant as a sector pattern for Kenyan healthcare operators.
What to doNo action needed — sector pattern awareness.
RelatedSecond Spain-based breach disclosed the same week as TuLotero below.
Medium priorityDeep Savvy IntelConfirmed

TuLotero (Spain) confirms breach exposing ~100,000 users' national ID documents and verification selfies

The betting platform confirmed unauthorized access to identity-verification data — front/back images of Spanish national ID cards and selfies — affecting roughly 2% of its user base.

Source: Hackmanac Cyber News (Telegram, public OSINT channel) · https://t.me/s/hackmanac_cybernews
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersA confirmed case of identity-document exposure — exactly the data SIM-swap and identity-fraud schemes rely on.
Who should careCISO / Fraud Lead at any platform doing identity verification
🇰🇪 Kenya impactIndirect — relevant pattern for Kenyan platforms doing KYC/ID verification (e.g. mobile money, betting, lending apps).
What to doIf you store ID-verification images, confirm they're encrypted at rest and access-logged.
RelatedSecond Spain-based breach disclosed the same week as Quirónsalud above.
ContextDeep Savvy IntelConfirmed

Coupang (South Korea) hit with $410M regulatory fine after insider-caused breach of 33M customer records

A former employee exploited weak internal controls to access customer data; regulators also found Coupang's marketing program collected activity data from ~11M customers without consent.

Source: Hackmanac Cyber News (Telegram, public OSINT channel) · https://t.me/s/hackmanac_cybernews
▸ So what? — why it matters, Kenya impact, what to do
Why it mattersA concrete number for what a breach actually costs once regulators get involved — useful when making the business case for security investment.
Who should careFounder / Board building the case for security investment
🇰🇪 Kenya impactNo direct Kenya link, but a useful benchmark alongside Kenya's own enforcement trend: the ODPC ordered Co-operative Bank, Family Bank and KWFT to jointly pay Ksh650,000 in April 2026 for unlawfully sharing a customer's loan data. Different scale, same direction — regulators are no longer just warning, they're fining.
What to doNo action needed — reference figure for budget conversations.

📬 Get the weekly digest by email Coming soon

The site is for checking in; the email is for not forgetting to. One weekly "here's what mattered" note, Kenya first.

Savvies Eyes · Decision intelligence, not a raw feed. We don't run our own sensors, crawlers, or dark-web collection infrastructure — we synthesize public reporting.Sources are attributed on every card · Confidence and interpretation are kept separate from reported fact · All scores are computed live from the formula in "How this number is calculated" — and that formula is an editorial judgment call, disclosed, not a statistical model. "🇰🇪 Kenya impact" is our current localization lens — the starting point, not the ceiling; expect it to grow into a broader "Regional impact" field as coverage extends to other African markets.