The Kenya Revenue Authority (KRA) is procuring multiple cybersecurity partners to protect its customs technology stack, moving away from a single-supplier model in a shift that points to growing concern about concentration risk in critical trade infrastructure.
This decision stems from a simple problem: leaning on one company for cybersecurity across customs systems creates a single point of failure. If that supplier suffers a breach, closes shop, or falls behind on payments, KRA’s defenses go with it.
Bringing in multiple vendors spreads that risk, giving KRA access to specialized capabilities that no single provider can cover alone.
READ: KRA Seeks Bidders for Billion-Shilling Tech Overhaul
The transition is not a clean slate. KRA’s customs operations run on infrastructure anchored by BSMART System Solutions, a Malaysian technology firm that supplies the Regional Electronic Cargo Tracking System (RECTS) deployed at the Port of Mombasa and across East Africa.
Any incoming cybersecurity vendors will need to work within what BSMART has already built, not around it. The procurement is additive, layering new security capacity onto existing infrastructure rather than replacing it.
That constraint bears value because of what RECTS does. The system handles cargo tracking across the East African Community’s Single Customs Territory, a cross-border framework that connects Kenya with Uganda, Tanzania, Rwanda, Burundi, and South Sudan.
A security failure at that layer does not stay within Kenya’s borders. It has the potential to ripple across partner states that depend on the same integrations to move goods.
Getting the security architecture right around RECTS, without breaking the cross-border connections that regional trade depends on, is the central challenge KRA’s procurement must navigate.
READ: New Faces, Same Mountain: What Adan Mohamed Inherits at KRA
New vendors coming in will need a clear understanding of how deeply BSMART’s technology is embedded before they can meaningfully contribute.
KRA has not disclosed a timeline for completing the procurement or named prospective vendors. The process is still ongoing.
