Effect of Risk Management Strategies on the Mitigation of Cybersecurity Threats in Fintech Companies in Nairobi City, Kenya
DOI:
https://doi.org/10.47604/ijmrm.4014Keywords:
Risk Management Strategies, Cybersecurity Threats, Threat Mitigation, Fintech, Deterrence Theory, Resource-Based ViewAbstract
Purpose: The purpose of this study was to examine the effect of risk management strategies on the mitigation of cybersecurity threats in fintech companies in Nairobi City, Kenya. Specifically, the study identified the cybersecurity threats faced by fintech companies, assessed the types and levels of risk management strategies they employ, and determined the effect of these strategies on threat mitigation.
Methodology: The study adopted a correlational research design anchored on Deterrence Theory and the Resource-Based View. The target population comprised 306 cybersecurity, risk, information technology and compliance professionals drawn from 98 fintech companies in Nairobi City. A sample of 173 respondents was selected through stratified random sampling and 12 key informants were purposively selected. Data were collected using structured questionnaires and key informant interviews, and 145 usable questionnaires were returned (83.8%). Quantitative data were analysed using descriptive statistics, Pearson correlation and multiple regression, while qualitative data were analysed thematically.
Findings: Malware infections were the most prevalent threat (M = 4.57, SD = 0.524), followed by phishing (M = 3.46) and Distributed Denial of Service (DDoS) attacks (M = 3.41), although the consequences of DDoS attacks were rated as severe (M = 3.91). Regular vulnerability assessments (M = 3.83) and threat intelligence gathering (M = 3.79) were the most widely implemented practices, while technical controls recorded the lowest level of implementation (M = 3.52). Risk management practices were strongly correlated with mitigation (r = .705, p < .01) and explained 49.8% of the variance in mitigation outcomes (R² = .498, F = 141.604, p < .01), rising to 55.6% when threat exposure was added (R² = .556, F = 89.050, p < .01). Improved perception of security posture (M = 4.04) was rated higher than reduction of the financial impact of attacks (M = 3.31), revealing a perception–protection gap.
Unique Contribution to Theory, Practice and Policy: Fintech companies should enforce multi-factor authentication, move from annual to continuous vulnerability scanning, institute role-based awareness training with phishing simulations, and appoint dedicated cybersecurity personnel in proportion to their risk profile. Regulators should harmonise Kenya’s fragmented cybersecurity rules into proportionate minimum standards for all categories of fintech, mandate independent security audits for high-volume firms, and operationalise sector-wide threat intelligence sharing. Theoretically, the study shows that deterrence in fintech cybersecurity works mainly through denial rather than punishment, and that resource-based advantage lies in dynamic cybersecurity capabilities rather than in information technology budgets.
Downloads
References
AlBenJasim, S., Dargahi, T., Takruri, H., & Al-Zaidi, R. (2023). FinTech cybersecurity challenges and regulations: Bahrain case study. Journal of Computer Information Systems, 1–17. https://doi.org/10.1080/08874417.2023.2187394
Almomani, A. (2020). Cyber security attacks: A review of common types, prevention, and detection. Journal of Information Security, 11(4), 251–266. https://doi.org/10.4236/jis.2020.114016
Atere, T. O. (2022). Cybersecurity regulation in the financial sector: Reflexive risk management in the UK, USA and Nigeria [Doctoral dissertation, Newcastle University].
Aven, T. (2016). Risk assessment and risk management: Review of recent advances on their foundation. European Journal of Operational Research, 253(1), 1–13. https://doi.org/10.1016/j.ejor.2015.12.023
Bains, P., & Wu, C. (2023). Institutional arrangements for fintech regulation: Supervisory monitoring (Fintech Note). International Monetary Fund. https://doi.org/10.5089/9798400234058.001
Barney, J. (1991). Firm resources and sustained competitive advantage. Journal of Management, 17(1), 99–120. https://doi.org/10.1177/014920639101700108
Bello, O. A., Folorunso, A., Ejiofor, O. E., Budale, F. Z., Adebayo, K., & Babatunde, O. A. (2023). Machine learning approaches for enhancing fraud prevention in financial transactions. International Journal of Management Technology, 10(1), 85–108.
Central Bank of Kenya (Digital Credit Providers) Regulations, Legal Notice No. 46 of 2022. (2022). Government Printer.
Central Bank of Kenya. (2017). Guidance note on cybersecurity. Central Bank of Kenya.
Central Bank of Kenya. (2019). Guideline on cybersecurity for payment service providers. Central Bank of Kenya.
Central Bank of Kenya. (2025). Bank supervision annual report 2024. Central Bank of Kenya.
Chaganti, R., Bhushan, B., & Ravi, V. (2022). The role of blockchain in DDoS attacks mitigation: Techniques, open challenges and future directions. arXiv. https://doi.org/10.48550/arXiv.2202.03617
Chetalam, L. J. (2018). Enhancing security of MPesa transactions by use of voice biometrics [Master’s thesis, United States International University-Africa].
Chowdhury, D., & Kulkarni, P. (2023). Application of data analytics in risk management of fintech companies. In 2023 International Conference on Innovative Data Communication Technologies and Application (ICIDCA) (pp. 384–389). IEEE. https://doi.org/10.1109/ICIDCA56705.2023.10100067
Communications Authority of Kenya. (2025). Cyber security report: Fourth quarter of the financial year 2024/2025 (April–June 2025). Communications Authority of Kenya.
Cremer, F., Sheehan, B., Fortmann, M., Kia, A. N., Mullins, M., Murphy, F., & Materne, S. (2022). Cyber risk and cybersecurity: A systematic review of data availability. The Geneva Papers on Risk and Insurance – Issues and Practice, 47(3), 698–736. https://doi.org/10.1057/s41288-022-00266-6
Creswell, J. W. (2014). Research design: Qualitative, quantitative, and mixed methods approaches (4th ed.). SAGE.
Demyanova, E. A. (2018). Current issues of company evaluation under fintech. Strategic Decisions and Risk Management, 1, 102–113.
Foya, D., & Garikayi, V. R. (2021). Assessing cyber security awareness and organisational preparedness on cyber security in audit firms. Indiana Journal of Economics and Business Management, 1(1), 19–34.
Giudici, P. (2018). Fintech risk management: A research challenge for artificial intelligence in finance. Frontiers in Artificial Intelligence, 1, 1. https://doi.org/10.3389/frai.2018.00001
Grima, S., Thalassinos, E., Cristea, M., Kadłubek, M., Maditinos, D., & Peiseniece, L. (Eds.). (2023). Digital transformation, strategic resilience, cyber security and risk management. Emerald. https://doi.org/10.1108/9781803826103
Hair, J. F., Black, W. C., Babin, B. J., & Anderson, R. E. (2019). Multivariate data analysis (8th ed.). Cengage Learning.
Hasan, M., & Hoque, A. (2023). FinTech risk management and monitoring. In Novel financial applications of machine learning and deep learning (pp. 3–16). Springer. https://doi.org/10.1007/978-3-031-18552-6_1
Hopkin, P. (2018). Fundamentals of risk management: Understanding, evaluating and implementing effective risk management (5th ed.). Kogan Page.
Javaheri, D., Fahmideh, M., Chizari, H., Lalbakhsh, P., & Hur, J. (2023). Cybersecurity threats in FinTech: A systematic review. Expert Systems with Applications, 122697. https://doi.org/10.1016/j.eswa.2023.122697
Juma, I., & Faturoti, B. (2025). Enforcing data privacy in Kenya and Nigeria: Towards an African approach to regulatory practice. International Review of Law, Computers & Technology, 1–26.
Kaur, G., Habibi Lashkari, Z., & Habibi Lashkari, A. (2021). Understanding cybersecurity management in FinTech. Springer. https://doi.org/10.1007/978-3-030-79915-1
Kraaijenbrink, J., Spender, J.-C., & Groen, A. J. (2010). The resource-based view: A review and assessment of its critiques. Journal of Management, 36(1), 349–372. https://doi.org/10.1177/0149206309350775
Kristian, A., Az-Zahra, A. R., Hidayat, F., Fauzi, A. Y., & Kallas, E. (2024). Enhancing cybersecurity risk management strategies in financial institutions: A comprehensive analysis of threats and mitigation approaches. Journal of Computer Science and Technology Application, 1(2), 96–103. https://doi.org/10.52909/jcsta.v1i2.178
Lallie, H. S., Shepherd, L. A., Nurse, J. R., Erola, A., Epiphaniou, G., Maple, C., & Bellekens, X. (2021). Cyber security in the age of COVID-19: A timeline and analysis of cyber-crime and cyber-attacks during the pandemic. Computers & Security, 105, 102248. https://doi.org/10.1016/j.cose.2021.102248
Lee, I., & Shin, Y. J. (2018). Fintech: Ecosystem, business models, investment decisions, and challenges. Business Horizons, 61(1), 35–46. https://doi.org/10.1016/j.bushor.2017.09.003
Mugenda, O. M., & Mugenda, A. G. (2003). Research methods: Quantitative and qualitative approaches. ACTS Press.
Musamali, R., Jugurnath, B., Maalu, J., & Mahuni, K. (2024). Fintech regulation in Kenya: Global practises and lessons learnt. Journal of Smart Economic Growth, 9(2), 32–66.
Mwangi, T., Asava, T., & Akerele, I. (2022). Cybersecurity threats in Africa. In The Palgrave handbook of sustainable peace and security in Africa (pp. 159–180). Palgrave Macmillan. https://doi.org/10.1007/978-3-030-96462-4_8
Mwase, A., Ngassam, E. K., & Singh, S. (2024). Fintech resilience: An exploration of security risks and risk management strategies. Scientific and Practical Cyber Security Journal. https://doi.org/10.58254/spcyb.2024.1.15.142
Najaf, K., Schinckus, C., Mostafiz, M. I., & Najaf, R. (2020). Conceptualising cybersecurity risk of fintech firms and banks sustainability. International Journal of Financial Innovation in Banking. https://doi.org/10.1504/IJFIB.2020.108767
Naseer, H., Maynard, S. B., & Desouza, K. C. (2021). Real-time analytics, incident response process agility and enterprise cybersecurity performance: A contingent resource-based analysis. International Journal of Information Management, 59, 102334. https://doi.org/10.1016/j.ijinfomgt.2021.102334
Ng, B. Y., & Rahim, M. A. (2005). A socio-behavioral study of home computer users’ intention to practice security. In Proceedings of the Pacific Asia Conference on Information Systems (PACIS 2005) (pp. 234–247).
Nicoletti, B. (2021). Banking 5.0: How fintech will change traditional banks in the ‘new normal’ post pandemic. Palgrave Macmillan. https://doi.org/10.1007/978-3-030-75871-4
Nye, J. S., Jr. (2017). Deterrence and dissuasion in cyberspace. International Security, 41(3), 44–71. https://doi.org/10.1162/ISEC_a_00266
Otuu, O. O., & Aguboshim, F. C. (2023). Exploring the role of financial cybersecurity risk management in enhancing the performance of banking payment systems in Nigeria: A qualitative case study. In 2023 IEEE International Humanitarian Technology Conference (IHTC) (pp. 1–8). IEEE. https://doi.org/10.1109/IHTC58054.2023.10366147
OWASP Foundation. (2023). OWASP API security top 10 – 2023. https://owasp.org/API-Security/editions/2023/en/0x11-t10/
Parsons, K., McCormac, A., Butavicius, M., Pattinson, M., & Jerram, C. (2014). Determining employee awareness using the Human Aspects of Information Security Questionnaire (HAIS-Q). Computers & Security, 42, 165–176. https://doi.org/10.1016/j.cose.2013.12.003
Pigola, A., & da Costa, P. R. (2025). Cybersecurity management: An empirical analysis of dynamic capabilities framework for enhancing cybersecurity intelligence. Information & Computer Security. https://doi.org/10.1108/ICS-08-2024-0185
Rajaiah, J., Majumder, A., Ingale, K., & Pasumarti, S. S. (2022). Central bank and fintech: Regulatory challenges and framework. In Digitalization and the future of financial services (pp. 41–65). Springer.
Republic of Kenya. (2018). Computer Misuse and Cybercrimes Act, No. 5 of 2018. Government Printer.
Republic of Kenya. (2019). Data Protection Act, No. 24 of 2019. Government Printer.
Republic of Kenya. (2025). Virtual Asset Service Providers Act, No. 20 of 2025. Government Printer.
Rid, T., & Buchanan, B. (2015). Attributing cyber attacks. Journal of Strategic Studies, 38(1–2), 4–37. https://doi.org/10.1080/01402390.2014.977382
Sapian, S. M., Ibrahim, N., & Shahwan, S. H. (2020). The conduct of risk management in trade financing processes: Exploring the prospects and challenges in fintech era. Humanities & Social Sciences Reviews, 8(3), 1072–1080. https://doi.org/10.18510/hssr.2020.83107
Spelman, F. (2022). Predictive analytics for malware detection in FinTech using machine learning classification [Master’s applied research project, Dublin Business School].
Straub, D. W. (1990). Effective IS security: An empirical study. Information Systems Research, 1(3), 255–276. https://doi.org/10.1287/isre.1.3.255
Teece, D. J., Pisano, G., & Shuen, A. (1997). Dynamic capabilities and strategic management. Strategic Management Journal, 18(7), 509–533. https://doi.org/10.1002/(SICI)1097-0266(199708)18:7<509::AID-SMJ882>3.0.CO;2-Z
Van Cooten, J., & Blythin-Hammond, J. (2017). The development of FinTech in Nairobi: Contributions to financial inclusion and barriers to growth.
Willison, R., & Warkentin, M. (2013). Beyond deterrence: An expanded view of employee computer abuse. MIS Quarterly, 37(1), 1–20. https://doi.org/10.25300/MISQ/2013/37.1.01
Yamane, T. (1967). Statistics: An introductory analysis (2nd ed.). Harper & Row.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Justine Ochieng Odero, Dr. Samuel Osike, Prof. E. K. Bor
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution (CC-BY) 4.0 License that allows others to share the work with an acknowledgment of the work's authorship and initial publication in this journal.
