The race to stay cyber ready is on

Harish Chib, Vice President for Emerging Markets, Middle East & Africa at Sophos, says AI is giving cybercriminals a significant advantage. “Attackers have always looked for an edge. Now they've got one: AI. It's sharpening their scams, speeding up their timing, and handling a lot of the work that used to slow them down.”

For Chib, this coincides with unprecedented regional digital growth. “Everything here is scaling, new infrastructure, more workloads shifting to the cloud, more systems connected to one another than ever before. Good for growth, but it also means there's more for attackers to target.”

Resilience replaces prevention

This expanding attack surface is forcing organisations to rethink what cyber resilience actually means. Keeping every attacker out is becoming an increasingly unrealistic benchmark; speed of response and recovery is emerging as a more meaningful measure.

Moses Frost, SANS Certified Instructor at SANS Institute, says: “Resilience is about capability, not just control. What matters most is how quickly an organization detects, responds, and recovers. And the ability to do that depends on people, their skills, and their experience under pressure.”

That human capability becomes even more important as technology changes rapidly. Frost adds: “Skills age as fast as threats change, so continuous learning belongs inside security operations.”

Identity takes centre stage

Kamel Heus, Vice President of Sales, MEA at Saviynt, similarly believes organisations need to operate on the assumption that attackers may succeed. “Prevention alone can't keep up, so resilience now means assuming compromise.”

Identity is becoming central to that approach. “Since most breaches ride on legitimate credentials, Identity is usually the fastest signal for detecting and containing an incident,” Heus says.

For UAE businesses, this requires cybersecurity to become integral to business operations rather than remain primarily a technology function. Chib says: “Cybersecurity can't sit apart from how the business runs day to day. Incident response needs real investment. So does the skills shortage, it won't resolve on its own.”

But as IT, operational technology and connected infrastructure converge, the consequences of an attack can extend far beyond compromised information.

Bachir Moussa, Regional Vice President for EMEA South, Nozomi Networks, says: “As IT, OT, and IoT systems become increasingly interconnected, cyber incidents no longer impact only data and networks. They can directly affect operations, safety, production, and business continuity.”

That makes resilience particularly significant for a region investing rapidly in smart cities, industrial automation and critical infrastructure. Moussa adds: “At the same time, geopolitical tensions continue to elevate risks for critical infrastructure operators across the region, making cyber resilience a strategic business priority rather than simply a technology concern.”

See what attackers see

At the same time, organisations face another fundamental challenge: understanding the infrastructure they actually expose to potential attackers.

Mark Howell, Vice President - EMEA, Censys, says leaders should begin with one fundamental question: “do we know what an attacker can see?”

“Cloud adoption, third parties, M&A and AI are creating Internet-facing infrastructure faster than traditional inventories can track it,” Howell says. “Moving from reactive security to continuous exposure management requires an outside-in, real-time view of what is actually exposed, how it is connected and how it changes.”

That shift also challenges the traditional practice of treating every vulnerability as equally urgent. With thousands of potential weaknesses across increasingly interconnected digital environments, prioritisation becomes critical.

Maher Jadallah, Vice President, Middle East & Africa, Tenable, says: “To transition from reactive firefighting to continuous exposure management, business leaders must stop treating every software flaw as a critical emergency.”

“Rather than attempting to patch thousands of isolated bugs, organizations should focus on the toxic combinations and attack paths that put their most critical assets at risk.”

From visibility to action

AI will increasingly underpin this continuous approach, helping organisations discover assets, understand relationships and respond at machine speed. But technology alone cannot deliver resilience.

Frost identifies governance, capability and multidisciplinary expertise as priorities. “Third, invest in people who bridge disciplines: AI and security, IT and OT, governance and implementation.”

For Moussa, stronger collaboration must accompany that investment in technology. “Technology is important, but resilience ultimately depends on people, processes, and informed decision-making. The organizations that will be most successful are those that align cybersecurity, operational resilience, and business outcomes into a single strategic vision.”

Heus, meanwhile, argues that security itself must become continuous: “Leaders who build for continuous, not periodic security will move fastest and safest.”

As the industry gathers at GISEC, that may define cybersecurity’s next chapter: not an endless attempt to eliminate every threat, but the ability to continuously see risk, prioritise it, respond decisively and keep the business moving.