Cybersecurity in Tanzanian Banks: An Evaluation of Threats, Institutional Strategies, and Client Awareness

Abstract

This study evaluates network security vulnerabilities and countermeasures in Tanzania’s banking sector. Using a mixed-methods approach, data were collected from 15 commercial banks through structured interviews with ICT managers, document reviews of regulatory compliance, and vulnerability scanning with Nessus. The assessment focused on five criteria: risk exposure, technical capabilities, regulatory compliance, business impact, and adaptability to evolving threats. Results show that phishing, credential theft, and malware are the most common types of attacks, with only 40% of sampled banks conducting regular penetration tests and 30% utilising multifactor authentication. Compliance with PCI DSS and Bank of Tanzania guidelines was partial, particularly in areas such as access control and vulnerability management. Limited budgets and a shortage of skilled personnel further weakened the security posture. The findings highlight the urgent need for coordinated investment in layered defences, staff training, and more vigorous enforcement of security standards to protect customer data and maintain public trust in Tanzania’s banking system.