The terror attack in Nairobi was a tragedy. But also, to some extent, unexpected. Kenya suffered relatively frequent attacks between 2013 and 2016 - Westgate in 2013, the Mpeketoni attack and the Gikomba attack in 2014, the Garissa university attack in 2016. Since then there's been a break in larger attacks. And since the earlier Gikomba attack, Nairobi has been spared, and Kenyan authorities have scored some successes in dismantling al-Shabaab networks in the country. They also thwarted a larger operation in Nairobi last year.
Kenya has done a great deal to prevent attacks, and to manage post-attack scenarios better. Its successes so far include: improved coordination, dismantling local radical networks in contact with the al-Shabaab and curtailing channels for foreign recruitment.
There have been two other areas of progress that has been, for the most part, spearheaded by civil society. The first is the implementation of deradicalisation programmes. These aim to integrate former al-Shabaab fighters into society. The second has been efforts at countering violent extremism by introducing programmes designed to prevent young people from being radicalised.
But there are still huge problems that need to be addressed. One is the fact that young Muslims have very low trust in the Kenyan police, and many remain sympathetic to al-Shabaab. These problems are hard to address because of high levels of joblessness among young people which has created fertile recruiting grounds for al-Shabaab.
Although Kenya has made considerable progress this week's attack shows that al-Shabaab is still strong, viable and able to take advantage of Kenyan weaknesses.
Kenya's role in Somalia
Kenya's role in Somalia has made it an important target for al-Shabaab.
This type of attack is planned inside Somalia and carried out by people trained by al-Shabaab in Somalia. They believe these units don't draw on older affiliated groups inside Kenya, which is seen as unprofessional, but develop their own well planned ad-hoc support solutions instead, usually based out of Somalia.
Kenya's intervention in Somalia, although slow moving at the start, was a watershed in forcing the al-Shabaab to give up large territories, and crucial for the decline al-Shabaab between 2011 and 2015. Kenya is still crucial on the ground inside Somalia, where its forces serve as a buffer against territories that are still fully controlled by al-Shabaab.
And Kenyan forces will play a crucial role in new plans being made for offensives against these territories.
This means that al-Shabaab will continue to target Kenya.
There are other factors at play too. Traditionally, Kenya, which is a more open society than neighbouring Ethiopia, Tanzania and Uganda, has been an easier target than the other countries in the region, and has, until now, had weaker intelligence capacities than, for example, Ethiopia and Tanzania.
There are areas, however, in which Kenya has upped its game, particularly when it comes to dealing with a post-attack emergency.
After the most recent attack it soon became clear that Kenya's security forces are more efficient than in the past. Coordination between the services was much better, and, wisely, it appears that the recce squadron (and thus the police) were left in charge. This meant that embarrassing situations, such as fire exchanges between the police and the army during the Westgate attack, were avoided.
There have been complaints that people took a long time to clear the building complex. But it's large and not easy to clear, a situation comparable to the In-Amenas compound attacked in Algeria in 2013, when the Algerians had to clear a large oil refinery. Clearing operations like this will take time. That it happened as quickly as it did this time shows Kenya has developed the professionalism and ability to plan fast.
The death rate also seems less than Westgate, although the casualty rate reported by the al-Shabaab (59) (radio statement) is much higher than the one reported by Kenyan authorities (21).
Disparities were just as great in the Westgate and Mepketoni attacks. In both al-Shabaab's reports proved to be much more accurate than the information provided by the authorities.
This is understandable: Kenyan officials would naturally want to play down the attack in a bid to calm potential tourists thinking about travelling to the country. Tourism is vitally important for the Kenyan economy.
There was one very legitimate criticism of the handling of the attack - the presence of armed non-police and non army/police security personnel at the scene. This made it much harder for the Kenyan police and army to know who to fight.
But an encouraging development is that the Kenyan parliament has announced that it will be reviewing the attack. Hopefully, this will be covered.
Kenya's handling of this attack shows the progress has been made in its anti-terrorist measures. But it also illustrates what problems remain in place. One includes providing erroneous information.
Other big challenges are that Kenya's tourism industry remains vulnerable to al-Shabaab's ability to sow fear. Another is that as long as al-Shabaab controls territories inside Somalia, and is allowed to dominate local people in the Somali countryside and harness resources from them, it will be sustained and able to launch attacks which can penetrate Kenya's web of countermeasures.