A man evaded President William Ruto's protection service at a thanksgiving event in eastern Kenya on Sunday, climbed onto the stage and briefly put his left arm around the president before bodyguards pushed him to the ground.
No-one was hurt during the tussle, and the man — who has not been named — was removed from the platform. No arrests have been reported.
The incident prompted an immediate security response: police formed a special team to investigate how the man bypassed multiple layers of security, a new head of the Presidential Escort Unit was appointed, and other senior personnel were either removed or placed on leave as authorities reviewed procedures.
After the episode, Mr. Ruto told those nearby: "Leave that young man alone. That young man has no problem." Douglas Kanja, speaking for the security services, described any breach involving the president as "unacceptable" and said the episode amounted to "the gravest national concern." Kanja added that "any attempt to breach security will be met with the full force of the law."
The rapid reassignments and the criminal inquiry underscore how closely the episode is being treated. Police said the probe will seek to establish how the man reached the stage despite the layers of protection that normally surround the head of state at public appearances.
The encounter is not isolated. In May 2025, a shoe was thrown toward the head of state during a rally, and barely three months before Sunday security officers intercepted a young man who approached the president near the podium. Those incidents have contributed to rising unease inside the security apparatus and among officials charged with managing large crowds at presidential events.
Officials stress that public events involving the president or other national leaders must follow security procedures. But the sequence of recent disruptions — the shoe-throwing in May 2025, the interception a few months ago, and the Sunday intrusion — has raised fresh concerns about how quickly someone can move from the crowd to the stage when events draw large numbers of people close to the head of state.
The most striking tension from Sunday lies in the different responses at the moment the man reached Mr. Ruto. The president's instruction to "leave that young man alone" projected calm and a desire to avoid escalation. Security officials immediately described the breach as unacceptable and moved quickly to reshuffle leadership and open an investigation. That contrast — a public show of composure from the president and an aggressive institutional response from security — frames the dilemmas authorities now face.
What happens next is straightforward and consequential: investigators must explain how the intrusion occurred, and the effectiveness of the personnel changes will be judged by whether similar gaps remain. The police special team has been tasked to determine how the man bypassed multiple layers of security; its findings will guide whether the measures taken so far are adequate or whether deeper reforms are required.
The unanswered question sharpened by Sunday's episode is not whether the president was endangered — nobody was hurt — but whether the security adjustments will close the gap between the public-facing calm Mr. Ruto displayed onstage and the operational vulnerabilities his protectors have acknowledged. If the probe finds procedural failures, further changes appear likely; if it finds the breach was an isolated lapse, officials will point to the new appointments as evidence of corrective action. Either way, the coming report will be the test of whether presidential events remain vulnerable or become safer.
