Kenya
Regional economic anchor and NGO hub. Al-Shabaab spillover in the north-east and coast, plus urban criminality in Nairobi and Mombasa, define the threat picture.
- Capital
- Nairobi
- Region
- East Africa
- Population
- 55.1M
Cross-border spillover; urban crime
- Overall risk
- Moderate
- Risk trend
- Stable
- Confidence
- High
- Last reviewed
- 15 September 2026
- Intelligence coverage
- Active
- TerrorismHigh
- Political instabilityModerate
- Conflict zonesLow
- Maritime securityModerate
- Cyber threatsHigh
- Travel riskModerate
- Violent & organised crimeModerate
- Kidnap & ransomModerate
| Category | Current risk | Trend | Change | Confidence | Reviewed |
|---|---|---|---|---|---|
| Overall risk | Moderate | improving | -1 | high | 15 Sept 2026 |
| Terrorism | High | stable | 0 | high | 15 Sept 2026 |
| Political instability | Moderate | stable | 0 | moderate | 15 Sept 2026 |
| Conflict zones | Low | improving | -1 | low | 15 Sept 2026 |
| Maritime security | Moderate | stable | 0 | moderate | 15 Sept 2026 |
| Cyber threats | High | improving | -1 | high | 15 Sept 2026 |
| Travel risk | Moderate | improving | -2 | moderate | 15 Sept 2026 |
| Violent & organised crime | Moderate | improving | -2 | moderate | 15 Sept 2026 |
| Kidnap & ransom | Moderate | improving | -2 | moderate | 15 Sept 2026 |
| Civil unrest & protest | Moderate | improving | -2 | moderate | 15 Sept 2026 |
| Humanitarian access | Moderate | improving | -1 | moderate | 15 Sept 2026 |
| Health & medical | Low | stable | 0 | low | 15 Sept 2026 |
| Infrastructure & power | Moderate | stable | 0 | moderate | 15 Sept 2026 |
| Climate & natural hazard | Low | improving | -1 | low | 15 Sept 2026 |
| Disinformation & influence ops | High | stable | 0 | high | 15 Sept 2026 |
Direction and change reflect movement in recorded incident tempo against the previous assessment block. Confidence reflects the density of corroborated reporting held for that category, not the severity of the rating.
| Minor | Moderate | Serious | Major | Severe | |
|---|---|---|---|---|---|
| Almost certain | |||||
| Likely | |||||
| Possible | |||||
| Unlikely | |||||
| Rare |
Select a category chip to see how its placement was reached.
Highlighted bars are the most recent four weeks — the window the desk uses for tempo comparison.
- Cyber1
- Civil unrest1
- Airport disruption1
- High1
- Moderate2
- NBO · Jomo Kenyatta IntlNairobi · average delay 11 minRegional hub; periodic protest-related road delays.
- MBA · Moi IntlMombasa · average delay 24 minCoastal gateway; routine.
- CyberHighSource reliability A · confidence 2
Ransomware campaign targeting regional banking sector
Multiple, Kenya
Threat actor deploying LockBit-derivative against mid-tier financial institutions. Initial access via exposed VPN appliances. Advisory issued to portfolio clients.
Operational implication: review movement authorisations affecting Multiple and confirm that journey plans account for cyber exposure.
Source: INGO ADVISORY cyber threat intel
- Civil unrestModerateSource reliability B · confidence 3
Cost-of-living protests planned in Nairobi CBD
Nairobi CBD, Kenya
Organisers calling for demonstrations Friday. Police deployment expected. Advise avoiding CBD 10:00–17:00; brief drivers on secondary routes.
Operational implication: review movement authorisations affecting Nairobi CBD and confirm that journey plans account for civil unrest exposure.
Source: INGO ADVISORY East Africa desk
- Airport disruptionModerateSource reliability C · confidence 4
Cargo handler strike disrupts Jomo Kenyatta ops
JKIA, Nairobi, Kenya
Wildcat industrial action delaying ground handling. Passenger flights operating; cargo throughput reduced ~40%. Clients advised on freight contingencies.
Operational implication: review movement authorisations affecting JKIA, Nairobi and confirm that journey plans account for airport disruption exposure.
Source: INGO ADVISORY aviation cell
Grading follows a NATO-style source reliability (A–F) and information confidence (1–5) framework. INGO ADVISORY has no NATO affiliation.
What happened
Kenya is currently assessed at moderate overall risk. Regional economic anchor and NGO hub. Al-Shabaab spillover in the north-east and coast, plus urban criminality in Nairobi and Mombasa, define the threat picture.
Why it matters
The rating shapes three practical things for organisations operating here: whether movement needs authorisation, how much lead time a journey plan requires, and what medical and evacuation cover has to be in place before anyone travels. Attack intent against soft targets in urban centres remains the principal mass-casualty risk.
What happens next
Expect the current pattern to hold over the next 30 days absent a political trigger. The realistic worst case is a short, sharp deterioration around Nairobi rather than a sustained continental shift — plan for disruption measured in days, not weeks.
Operational implications
Journey management, vetted transport and a working check-in schedule carry more weight here than additional analysis. Where categories are rated High or above, treat movement as authorisation-based rather than notification-based.
Recommended actions
Refresh the country brief before any new deployment, confirm the in-country contact list is current, rehearse the escalation path with the response desk, and set explicit hold and withdrawal criteria in writing.
Principal drivers
- Attack intent against soft targets in urban centres remains the principal mass-casualty risk.
- No single dominant driver: risk is diffuse and best managed through routine briefing and journey discipline.
- Security force redeployments or curfew announcements in the capital.
- Cross-border movement restrictions with neighbouring East Africa states.
- Airline schedule changes, insurance repricing or route suspensions.
- Fuel, cash or telecoms disruption sustained beyond 72 hours.
- Public statements setting dates for elections, verdicts or demobilisation.
Any two indicators firing inside the same week should prompt a review of movement authorisations and a refreshed country brief.
- Political environment
- Rated moderate. Regional economic anchor and NGO hub. Al-Shabaab spillover in the north-east and coast, plus urban criminality in Nairobi and Mombasa, define the threat picture.
- Security environment
- Security rated moderate; terrorism high, conflict low, crime moderate.
- Operating environment
- Infrastructure rated moderate. Expect procurement, permitting and utility reliability to shape delivery timelines more than headline security.
- Travel environment
- Travel risk rated moderate. 2 airport records held on the aviation board.
- Maritime
- Maritime security rated moderate across 2 port records.
- Border environment
- 9 land crossing records held, with status and operating considerations on the border board.
- Humanitarian access
- Access rated moderate; health and medical environment rated low.
- Outlook
- Cross-border spillover; urban crime
Personalised Kenya intelligence brief
Tailor the brief to your organisation and audience, then export to PDF or standalone HTML. Every export carries numbered citations for each source used and a stated limitations section. Download the citations appendix as CSV to analyse or reuse the underlying source records.
Kenya intelligence library
Category ratings
Localised risks warrant briefed travel. Vetted accommodation and drivers, pre-travel briefings and 24/7 tracking recommended.
Recent activity
Threat actor deploying LockBit-derivative against mid-tier financial institutions. Initial access via exposed VPN appliances. Advisory issued to portfolio clients.
Organisers calling for demonstrations Friday. Police deployment expected. Advise avoiding CBD 10:00–17:00; brief drivers on secondary routes.
Wildcat industrial action delaying ground handling. Passenger flights operating; cargo throughput reduced ~40%. Clients advised on freight contingencies.
Operating guidance
- Avoid predictable patterns of movement; vary routes and timings around government, security and diplomatic facilities.
- Assume elevated targeting of finance, energy and NGO sectors; enforce MFA, VPN hygiene and third-party access reviews.
- Vet drivers, accommodation and local partners through in-country due diligence; refresh annually.
- Maintain a written crisis management plan aligned to INGO ADVISORY response playbooks; rehearse twice a year.
Intelligence library
Free operational toolkit
Operational tools for Kenya teams
Six free operational tools for NGO and charity teams — no sign-up, nothing leaves your browser.
- Travel risk authorisationRisk-tiered approval form with control verification before movement is signed off.
- Vehicle & convoy check13-point pre-departure inspection with go / no-go clearance logic.
- Safeguarding / PSEA referralAnonymised referral log for PSEA and misconduct concerns.
- Cyber hygiene assessmentScored self-assessment producing a prioritised remediation workplan.
- Staff accountability roll callReal-time headcount and status tracking during an incident.
- Endurance calculatorContingency stock planning for water, food, fuel and cash.
In-country network, senior analysts and a delivery bar built for board-level scrutiny.