As Uganda’s digital economy expands rapidly, experts have issued a stark warning: cybersecurity must be built into the country’s digital infrastructure from the start, not treated as an afterthought. The call was made during the inaugural National Cybersecurity Conference held at Sheraton Kampala Hotel, bringing together government officials, regulators, security agencies, financial institutions, and technology firms.
The conference comes as Uganda’s use of digital services continues to grow, increasing both opportunities and exposure to cyberattacks. The latest Communications Sector Cybersecurity Posture Report by the Uganda Communications Commission (UCC), presented at the conference, showed that while reported malware infections declined from about 1.59 million in 2024 to 1.41 million in 2025, the sector’s overall cybersecurity rating remained in the basic security category, indicating continued elevated risk.
The report also showed the growing scale of Uganda’s digital ecosystem, with 47.5 million active mobile money users, 18 million mobile internet users, 20.3 million smartphones, and 36.7 million mobile money subscribers. This rapid digitalisation has made the country an attractive target for cybercriminals.
Assistant Commissioner of Police Andrew Mubiru, the Director of Forensic Services at Uganda Police Force, said the widespread use of mobile money, digital banking, e-government services, and social media had made them prime targets.
“The pressure is so much concentrated in the financial sector in the form of mobile money. Banks and payment platforms remain the most consistently targeted. Government and critical infrastructure, the public sector, utilities and small businesses are also being targeted,” Mubiru said.
He noted that one of the challenges in fighting cybercrime was the failure by some victims and institutions to report incidents promptly, with some organisations only seeking assistance after an attack has escalated.
UCC Executive Director Nyombi Thembo said the cybersecurity figures should encourage stakeholders to strengthen their collective response rather than become complacent.
“These threats are real. The question before us, therefore, is: How do we ensure that the defenders stay ahead of the threat?” Thembo asked.
He said cybersecurity should be incorporated into digital infrastructure from the beginning rather than treated as an issue to be addressed after systems have been developed. “Cybersecurity must not be something we add to digital transformation after the infrastructure has been built. Cybersecurity must be part of the infrastructure itself,” he said.
Thembo cited malware, ransomware, denial-of-service attacks, vulnerable web infrastructure, phishing and impersonation, including attacks aided by artificial intelligence, among the threats facing Uganda. He urged government agencies, regulators, telecommunications operators, financial institutions, academia and researchers to abandon siloed approaches to cybersecurity, noting that “a cybercriminal does not stop to consider which Government agency has jurisdiction before launching an attack.”
State Minister for ICT Joyce Nabbosa Ssebuggwawo said cybersecurity should no longer be viewed as the sole responsibility of ICT departments and system administrators. She said the growing dependence on digital platforms had made cybersecurity a matter of national security, economic stability, service delivery, and public trust.
“Cybersecurity is no longer simply about protecting computers. It is about protecting institutions, economies, election-management systems, political party databases, media platforms, and national security,” Ssebuggwawo said.
She warned that attacks on interconnected systems could have wider consequences across the economy, affecting telecommunications, financial services, e-government services, and eroding public confidence in the wider digital ecosystem. She called for a whole-of-government and whole-of-society approach involving all stakeholders.
Bank of Uganda Governor Michael Atingi-Ego urged banks, telecommunications companies, government agencies, and utility providers to adopt stronger and coordinated cybersecurity standards. He said institutions must move beyond merely complying with regulations and build systems capable of withstanding and recovering from cyberattacks and technology failures.
“The rigor we now require of banks under our cyber and technology risk management guidelines should not remain a banking sector achievement alone,” Atingi-Ego said, calling for common security standards across sectors.
Airtel Money Managing Director Japhet Aritho said human vulnerability and increasingly sophisticated social engineering scams were becoming major threats to Uganda’s digital financial ecosystem. He said while technology-related vulnerabilities had improved, fraudsters were increasingly targeting customers through voice calls, SMS, and other forms of social engineering.
“Fraud is the major problem that we have to deal with as we deepen financial inclusion. And this fraud is eroding trust,” Aritho said.
He warned that declining trust could undermine the growth of mobile money, digital banking, and the wider digital economy. “When there’s no trust, mobile money can never grow. Banking, digital banking will never grow. The digital economy will struggle,” he said.
Aritho called for stronger collaboration among telecommunications companies, banks, regulators, and law-enforcement agencies, emphasizing that “we are strong as the weakest link in the ecosystem.”
The experts agreed that Uganda’s digital growth must be matched by stronger cybersecurity, faster information sharing, improved incident response, and greater investment in local expertise if public trust in the country’s digital economy is to be maintained.
