The Kenyan agricultural sector accounts for 23.2% of the country’s gross domestic product (GDP) and employs more than 40% of the population. It is also responsible for around 65% of the country’s export earnings. Thriving since COVID-19, despite some downturn over the past year, Kenya is also considered one of Africa’s hubs for agriculture and agritech. The country has more than 40 active agritech startups specialising in AI and sensors, platforms that focus on IoT solutions for soil and environmental conditions, and tools designed to support the industry and its growth. And Kenya’s AI Strategy 2025-2030 puts the sector at the forefront of its commitment towards data-driven innovation.
However, a significant percentage of the country’s agricultural sector still consists of fragmented, smallholder farms at different stages of digital maturity. Some have highly sophisticated tools, while others are still manual and paper-based with only a few basic digital processes in place. The highly advanced, digital side of the market is valued at around 1.2 billion according to Ken Research, with growth seen in IoT, e-learning platforms, data analytics services, mobile applications, and digital marketplaces. Here, sensors, AI and intelligent platforms are changing how farmers are managing their soil, water, livestock and yield.
However, despite the improvements introduced by these technologies, they are also introducing risk. A risk that the sector hasn’t fully realised. It is also one that isn’t sitting where the investment is most concentrated, which is on the farms and in the systems of the larger commercial operators, but rather in the third-party service providers. These small and medium-sized enterprises (SMEs) that move produce from the farm to the warehouse and from the warehouse to the retail shelf are often the weakest part of the chain.
While the infrastructure at the farm or retail level isn’t immune to attack – threat actors will always focus their efforts on profitable targets – it is less vulnerable than these SMEs. The smaller operators have limited to no cybersecurity infrastructure, monitoring capability, patch management processes or awareness of how they are in a position of material risk that can impact the entire agriculture supply chain.
Across Kenya’s commercial farming and food logistics sectors, connected devices are continuously transmitting data about soil conditions, temperature, humidity, crop health and cold-chain integrity. From verified temperature readings to GPS-tracked logistics and point-of-origin records, this data travels from sensors and systems through the hands of a logistics operator, into a distribution centre, and eventually informs the procurement and shelf-life decisions of a major retailer or export buyer. This data is currency, and it is precisely what threat actors are after, particularly when it reveals the operational patterns and processing systems of a large agritech company, information that can be monetised on its own or used to deepen access to the broader infrastructure.
At each structured point in this chain, there is a level of security. Larger farms, retailers and distribution centres have invested in enterprise-grade systems or endpoint protection, but the SMEs that connect these nodes have become an analogue gap. And this gap is prime real estate for a man-in-the-middle attack. The moment the data leaves the sophistication of the farm and enters the small logistics operator’s hands, it crosses an analogue boundary that’s far easier for the threat actor to breach.
The mechanism of this attack isn’t elaborate, and it’s a lot easier for hackers to achieve. Once a threat actor identifies and exploits a vulnerability in a sensor or connected device, they can inject errors into what that device reports. The sensor continues to function and report, and the distribution centre and retailer continue to receive data, but the data is false. A temperature reading may indicate that the produce is within a safe range when it is not. A point-of-origin record may validate a consignment that it should reject. A shelf-life indicator built on a manipulated data foundation will pass through every subsequent system without triggering an alert, because the system has no reason to question data that arrives from a verified source.
The consequences are twofold. On the commercial level, companies run the risk of production delays, spoiled inventory, customer dissatisfaction, and the high costs of tracing and replacing compromised stock. The second is regulatory – under Kenya’s Data Protection Act 2019, data controllers are required to notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of a breach. When false data is injected at the analogue gap, the retailer is left holding non-compliant records that they relied on in good faith.
Solving for this challenge comes down to treating the supply chain as a security perimeter in its own right, one that requires identity verification, access controls, continuous monitoring and supplier accountability at every node. Zero trust is the right framework here as it ensures nobody moves through the supply chain without verification, and this should be supported by multi-factor authentication, biometric verification and supplier auditing.
Kenya’s agriculture sector is an African success story, but the analogue gap must be addressed as a cybersecurity problem that can impact this success if not managed correctly. All the attacker needs is a point where nobody is watching, and the impact is significant.
