Seeing cyber risk from outside with Censys

■ What does Censys’ GISEC debut signal about the cybersecurity market in the UAE and Censys’ ambitions in the region?

The UAE is moving incredibly quickly across cloud, AI and digital infrastructure, and cybersecurity has to move at the same pace. That makes the region strategically important for Censys.

Our first GISEC comes at a time when organisations are recognising that internal security visibility alone is no longer enough. Attackers start with the Internet. They see exposed infrastructure, third parties and dependencies that may not appear in an organisation’s inventory.

We want to give defenders that same outside-in view. Our investment in the region is about helping governments and enterprises understand what is actually visible on the Internet and turn that intelligence into action.

■ As UAE organisations rapidly adopt cloud and AI, how is the attack surface changing, and where are traditional approaches to security visibility falling short?

The challenge is no longer simply that organisations have more assets. Their infrastructure is becoming more distributed, interconnected and dynamic.

Cloud services can be created in minutes. AI infrastructure is appearing just as quickly. Third parties introduce dependencies outside your direct control. M&A and shadow IT create assets that security teams may not know exist.

Traditional security starts with a known inventory and looks outward. Attackers do the opposite: they start with what they can discover on the Internet and work inward.

Security teams increasingly need that same Internet-wide perspective — continuously understanding what is exposed, how infrastructure is connected and what has changed — because you cannot manage risk based on an incomplete picture.

■ What has Operation Digital Shield revealed about the Internet-facing risks governments and critical infrastructure operators in the UAE need to address?

Operation Digital Shield reinforces something we see globally: critical infrastructure is increasingly connected for practical operational reasons, but every connectivity decision changes the attack surface. Our latest research identifies roughly 134,000 Internet-exposed ICS hosts globally, with 70 per cent sitting on consumer and mobile networks.

We know that with the right visibility, public-private partnerships can materially reduce that risk. In the US, Censys worked with the Environmental Protection Agency (EPA) to identify exposed water systems and notify operators, helping drive the remediation of more than 94 per cent of those exposures within a year.

For governments and operators, the lesson is that mitigating risk requires continuous, Internet-wide visibility — and the ability to turn that intelligence into coordinated action.

■ How is Censys ARC helping security teams understand emerging threats and the Internet infrastructure adversaries use?

Threat intelligence traditionally starts with an indicator — an IP address, domain or hash — but adversaries change infrastructure constantly. A single indicator is a moment in time.

Censys ARC takes an Internet-wide approach. Our researchers study infrastructure patterns, malware, vulnerabilities and adversary behaviour across the public Internet and turn those observations into intelligence defenders can use.

That allows teams to move beyond asking, “Is this IP malicious?” to understanding the broader infrastructure around an adversary: what else is connected, what characteristics persist as infrastructure changes, and where an attacker may move next.

That context is increasingly important as security operations become more automated and AI-driven. AI can accelerate decisions, but those decisions are only as good as the intelligence behind them.

■ What changes are you seeing in the cyber threat landscape affecting the UAE in 2026, particularly as AI accelerates both attack activity and the growth of Internet-facing infrastructure?

One of the most important trends is that AI is changing both sides of the equation. Attackers can operate faster, while organisations are simultaneously deploying an entirely new category of Internet-facing infrastructure.

At Censys, we already see more than 294,000 IP addresses exposing at least one AI or LLM tool — an increase of more than 60 per cent in nine months. That includes technologies that barely existed in enterprise environments just a few months ago.

We are also seeing technologies such as MCP servers and agent frameworks connect AI more deeply into enterprise systems and data.

For security leaders in the UAE, the implication is straightforward: as technology changes faster, visibility has to become continuous. You cannot secure tomorrow’s infrastructure using yesterday’s inventory.