The latest terror attack on a hotel complex in Nairobi has once again drawn attention to the security situation in Kenya. In particular, the extent to which Somalia-based extremist group al-Shabab has infiltrated the country and evaded security agencies.

Tuesday's attack came three years to the day after al-Shabab militants attacked a Kenyan military base in neighboring Somalia, killing over 100 troops. In 2015 extremists stormed Garissa University College in Kenya's North Eastern Province, killing 148 people. The last attack linked to al-Shabab in central Nairobi occurred back in 2013 at Westgate shopping mall, resulting in 71 deaths, including the four gunmen.

Each of these events resulted in changes to the way the government carried out counterterrorism activities and led to increased monitoring of the porous Kenya-Somalia border.

So what does the latest attack mean for the security situation in Kenya?

Kenya's counterterrorism strategy under scrutiny

The Kenyan government has been recognized for its relatively successful counterterrorism strategy, especially when it came to curtailing al-Shabab fighters attempting to cross into Kenya from Somalia. So Tuesday's terror attack was largely unexpected. 

"People thought that the security agencies were on top of things, so it really is a surprise to many people," Emmanual Kisiangani, a Nairobi-based political analyst, told DW.

Kenya significantly increased security spending in 2015 and also implemented a decentralization process which allocated more power to the region and local levels with the aim of better tracking extremists within the country. Kisiangani thinks Kenya's security agencies have done relatively well in preventing major attacks up until this point.

"It's a very difficult thing to prevent these attacks totally," he says. "They say that the security agencies always need to be right, but terrorists only need to be right once. In between, the security agencies have certainly preempted many similar attacks, including one about a year ago which could have been quite dramatic."

The fact that al-Shabab has been referred to as "weakening" by governments, security agencies and the media in recent months may have also spurred on the group to carry out as dramatic an attack as possible.

"We have had a few instances where we think al-Shabab is extremely weak and on the brink of being annihilated," says Kisiangani. "Then they want to prove that they are still strong. Every time people think that they are [weak], they try and do something to send out a message that they still have the capacity to cause harm."

Stig Jarle Hansen, an expert on African jihadists at the Norwegian University of Life Sciences, thinks the fact that the attack took place in the heartland of Kenya, rather than along the border zone, will be a wake-up call for Kenyan security forces.

"Al-Shabab did something that was unexpected in many ways," he told DW. "But when it comes to their modus operandi, it's rather typical [for them]…We've seen it before at Westgate and we've seen it in Mogadishu as well."

Al-Shabab reaches into Kenya

Al-Shabab has been active in Somalia since civil war broke out in 2006. Since then, the jihadist militant group has carried out numerous deadly attacks in the region despite a number of major losses thanks to the combined efforts of the Kenyan, Somalian and US militaries.

But recruitment by al-Shabab of Kenyans — the majority of whom are young, disillusioned and from the country's poorest neighborhoods —remains one of the biggest challenges for security forces. Kenya's military is leading a large-scale operation in the Boni National Reserve near the border with Somalia, hoping to push al-Shabab militants back across the border, and preventing them from reaching out to sympathizers inside Kenya.

"I think the Kenyan police have been relatively successful in getting to some of the recruit lines and command networks inside Kenya," says Hansen. "But they haven't been successful in addressing the root causes. There is still a lot of radical youth."

Whether or not the militants involved in the hotel complex attack were in fact Kenyans is still unknown. Despite a stronger Kenyan presence along the border, it is still possible that Somalia-based militants could have found a way into the country.

"Given the limitations of Kenyan security, you cannot police each and every place," Kisiangani told DW. "So it is feasible they could have actually crossed the border."

Read more: Life in Somalia under peacekeepers and al-Shabab threats

Damage yet to be fully felt

President Uhuru Kenyatta was quick to reassure concerned citizens on Wednesday morning that the situation was under control and they were free to "go back to work without fear." Only a few hours before, sporadic gunfire could still be heard as people were rescued in the early hours during an operation described by police as a "mopping up" exercise.

"The government does not want to instill any more fear because of course this is the objective of these terrorists," Kisiangani said. "So it is natural that the government wants to be positive."

But while the immediate damage appears to be over, Hansen believes Kenya should quickly turn its attention to mitigating the long-term damage. Far from being a random attack, the target was chosen very deliberately in order to inflict as much harm as possible on the country's vulnerable tourism sector — physical or otherwise. 

"Al-Shabab is really hitting Kenya where it hurts," Hansen told DW. "The effects of this attack haven't been fully felt yet. We will now see the reactions of the various [international] travel agencies and see how much this will lead to financial losses."