The most expensive breaches at Kenyan banks, SACCOs, and telcos rarely start with a foreign hacker. They start with a payroll clerk, a contractor with excess privileges, or a departing sales manager copying the CRM to a personal Gmail account. Insider threats — whether malicious, negligent, or compromised — remain the hardest category to detect because the actor already has legitimate access.
Building an insider threat program in Kenya is not just a technical exercise. Get the surveillance design wrong and you will face challenges under the Employment Act 2007, the Data Protection Act 2019, and Article 31 of the Constitution, which protects the right to privacy. This is the balance every CISO and Head of HR in the region needs to strike.
Understand the Three Insider Threat Categories
Before you buy any tooling, classify the risk you are actually trying to manage. Programs fail when they treat all three types the same way.
- Malicious insiders: Employees or contractors who intentionally steal data, commit fraud, or sabotage systems. Think of a relationship manager exfiltrating a client book before joining a competitor.
- Negligent insiders: Staff who click phishing links, share passwords, misconfigure a shared drive, or email a spreadsheet of KRA PINs to the wrong recipient. This is the largest category by volume.
- Compromised insiders: Legitimate users whose credentials have been hijacked, often via credential stuffing or SIM swap attacks — a documented threat vector in the Kenyan market.
Your controls, detection logic, and response playbooks differ for each. A negligent insider needs coaching and better guardrails. A malicious insider needs evidence preservation and legal escalation.
Build the Legal Foundation Before You Deploy Tools
This is where most Kenyan enterprises stumble. Deploying a DLP tool or user behaviour analytics platform without the right legal scaffolding creates evidence that may be inadmissible and exposes the company to unfair termination and privacy claims.
You need four documents in place before monitoring begins:
1. An Acceptable Use Policy signed by every employee and contractor, explicitly stating that company systems, email, and endpoints are subject to monitoring.
2. A Monitoring and Surveillance Policy that defines what is collected, why, how long it is retained, and who can access it. This is your lawful basis under the Data Protection Act.
3. A Data Protection Impact Assessment (DPIA) for the monitoring activity itself. Under the Kenya Data Protection Act, systematic monitoring of employees is high-risk processing and a DPIA is expected. DPIA Services Page
4. Employment contract clauses that reference the above policies and align with the Employment Act's disciplinary and termination procedures.
Monitoring without disclosure is not just poor practice — it can render your evidence useless at an ELRC hearing and expose the company to damages awarded by the ODPC.
Detection: What to Actually Watch For
Once the legal groundwork is in place, focus your detection on high-signal behaviours rather than blanket surveillance. Volume of data is not the goal; relevance is.
Priority telemetry sources
- Endpoint DLP: USB writes, uploads to personal cloud storage, print jobs of sensitive documents.
- Email gateway: Auto-forwarding rules to external domains, large outbound attachments, sending to personal addresses.
- Identity and access logs: Off-hours logins, impossible-travel events, privilege escalation, dormant account reactivation.
- SaaS activity: Bulk downloads from Microsoft 365, Google Workspace, Salesforce, or your core banking system.
- HR triggers: Resignations, performance improvement plans, and role changes should raise monitoring sensitivity for that user for a defined period.
The last point matters most. The single strongest predictor of data theft is a departing employee in the final 30 days of notice. Integrate HR events into your SIEM or vCISO review cadence.
Respond Without Creating New Legal Risk
A good detection is worthless if the response process is sloppy. Your incident response playbook for insider incidents must run parallel tracks: technical containment, HR process, and legal review.
- Preserve evidence properly: Chain of custody matters if the case reaches the ELRC or DCI. Do not let a well-meaning IT admin wipe the laptop.
- Involve HR and Legal early: Any disciplinary action must follow the notice and hearing requirements in Sections 41 and 44 of the Employment Act.
- Avoid confrontation before containment: Revoke access first — VPN, email, SaaS, physical badge — then hold the disciplinary meeting.
- Report where required: If personal data was exfiltrated, you have 72 hours to notify the ODPC under the Data Protection Act. Incident Response Planning Service
The goal is not to catch people. It is to deter, detect early, and respond in a way that protects the business, respects the employee's rights, and holds up in court.
Start Small, Prove Value, Then Scale
Most Kenyan mid-sized enterprises do not need a 24/7 insider threat operations centre on day one. Start with the legal foundation, integrate HR triggers into existing SIEM or MDR feeds, and build detection use cases around your top three data assets — customer data, financial records, and intellectual property. Mature from there.
SecureZaidi helps East African enterprises design insider threat programs that satisfy both the CISO and the Head of Legal. Ready to assess your posture? Contact SecureZaidi for a free consultation.