Staying ahead of the cyber threat with Sophos

■ GISEC 2026 is placing a strong focus on AI-driven security and critical infrastructure resilience. How closely do these themes align with Sophos’ priorities?

AI is changing both sides of cybersecurity: attackers are using it to move faster, automate their campaigns, Detection gets harder. So, defenders need AI too, but it has to be governed and actually useful, not just more noise in the system. This is precisely why we built Sophos Fusion, our AI-native cybersecurity defense system. It brings together endpoint, network, identity, email, cloud, MDR, XDR, next-gen SIEM, threat intelligence, and third-party integrations into one coordinated defense architecture.

Critical infrastructure resilience matters just as much, particularly in a region where governments and enterprises are investing heavily in digital transformation. Protection that works across the entire environment is needed, helping teams prevent, detect, and respond quickly when something happens. At Sophos, our focus is to help customers build that resilience without adding more complexity.

■ What is the biggest misconception you still encounter when speaking with customers about ransomware and AI-driven threats?

Ransomware is still mainly treated as a malware problem, and assumption is exactly what puts organizations at risk. Most attacks begin much earlier and far more quietly, often through a compromised identity, a phishing email, or stolen credentials. Our recent State of Ransomware report 2026 found that 79 per cent of attacks used an identity-based initial access vector. By the time encryption occurs, the attacker has typically already spent time inside the environment, moving laterally, escalating privileges, and preparing to maximize disruption.

AI-driven threats carry a similar blind spot. It’s easy to file them under “future concern,” but attackers are already using AI to make phishing more convincing, speed up intelligence gathering, and scale their operations well beyond what manual methods allowed.

What’s needed isn’t more point products stacked on top of one another. It’s stronger identity security, greater visibility across the environment, and coordinated response before an incident becomes a crisis.

■ How are boardrooms in the region responding differently to cyber risk now that it is increasingly linked to geopolitical instability, rather than being viewed primarily as a financial or operational risk?

Boards used to see cybersecurity as an IT problem. That’s changed. What we see now, especially in the Middle East, is cyber risk being treated as a strategic resilience issue, discussed at the same level as business continuity or reputation. Part of that comes from where we operate: a highly connected digital economy, with real exposure to geopolitical tension, supply chain risk, and growing regulatory expectations. Boards are therefore looking at cybersecurity through a wider lens: business continuity, trust, reputation, national resilience, and the ability to keep operating under pressure.

Financial and operational impact still matter that hasn’t gone away. But the conversation has matured beyond that. Senior leaders want real answers, not reassurance. How prepared are we, really? How fast can we recover? Are our security investments actually reducing risk, or just adding cost? Can our teams coordinate effectively the moment something goes wrong? These are the same questions we build Sophos Fusion to help answer, giving boards a clear, evidence-based view of risk instead of a patchwork of dashboards and assumptions.

■ What does Sophos’ business roadmap for the region look like over the next 12 months, and where do you see the biggest opportunities for growth?

Our priority for the next 12 months is to help organisations in this region get ahead of risk rather than continually responding to it. Most security environments were not designed Most security environments weren’t designed. They were built up over time, one purchase at a time, often after an incident or an audit finding. For many businesses, the result is a security stack too large to manage effectively, with less visibility than they realise.

The greatest opportunity we see is not tied to a specific technology. It is a question of capacity. A significant number of organizations, government entities included, do not have security teams sized for the threats they now face. That is why managed detection and response comes up in nearly every customer conversation we have. Cloud security and identity follow closely behind, largely because that is where workloads are shifting and where attackers are finding their way in.

What shapes our roadmap most, though, is the pace of change across this region. Governments and enterprises are transforming quickly, which is a genuine advantage, but it also introduces exposure when security is treated as an afterthought rather than built into that transformation from the outset. Our role at Sophos is to support that shift, for the customers and partners we work with, in a way that’s scalable, open, and aligned with how their businesses are evolving.