CYBER SECURITY RISKS AND PERFORMANCE OF COMMERCIAL STATE CORPORATIONS IN KENYA

Abstract

Cybersecurity threats have become a critical challenge for commercial state corporations (CSCs) in Kenya as these organizations expand their digital infrastructure to enhance service delivery, operational efficiency, and public accountability. Despite national frameworks such as the Kenya National Cybersecurity Strategy (2022–2027) and the Data Protection Act (2019), recent audits reveal that the majority of CSCs lack formal cybersecurity policies, testing procedures, and dedicated security budgets, exposing them to risks that compromise service continuity and regulatory compliance. The main objective of this study was to examine the influence of cybersecurity risks on the performance of commercial state corporations in Kenya. Specifically, the study sought to assess the effect of network security and regular testing and updates on organizational performance indicators such as service availability, stakeholder satisfaction, and legal compliance. The study was grounded in the Technology–Organization–Environment (TOE) Framework and Dynamic Capabilities Theory. A quantitative, cross-sectional survey research design was employed, targeting all 46 CSCs in Kenya. A purposive sampling approach was used to select a sample of 92 respondents, comprising ICT managers and strategic planning officers. Data was collected using semi-structured questionnaires and analysed using SPSS version 27. A pilot study involving 10 respondents from five non-participating commercial state corporations were conducted to assess the clarity, consistency, and construct alignment of the structured questionnaire, with expert reviews ensuring content validity and reliability confirmed through Cronbach’s alpha using SPSS. For the main study, descriptive statistics including frequencies, percentages, means, and standard deviations summarized the data, while inferential statistics such as Pearson’s correlation and multiple linear regression were used to examine relationships between variables. Network security emerged as the most influential factor, followed by regular testing and updates. The study concluded that effective cybersecurity management enhances operational efficiency, service reliability, regulatory compliance, and stakeholder trust. It emphasized that cybersecurity is not merely a technical function but a strategic performance enabler for public-commercial institutions. The study recommends that commercial state corporations invest in robust network protection systems and implement structured testing and update policies. Strengthening these practices holistically will enhance resilience, ensure service continuity, and improve the overall performance of commercial state corporations in Kenya.

Key Words: Cybersecurity Risks, Commercial State Corporations in Kenya, Network Security, Regular Testing and Updates, Organizational Performance