UAE's cyber blind spot isn't AI or the cloud, it's human error, experts warn

96% of UAE executives don't fully understand their AI dependencies across the web of vendors, models and infrastructure, while 74% struggle with data residency and sovereignty requirements when moving data across borders, according to a recent IBM study in the UAE.

“As organizations moved rapidly to the cloud, many prioritized speed and scale, assuming security controls could be layered on later”, according to Rajeev Nair, Senior Vice President at Special Projects, “At Core42, we see this reflected in growing demand for regulatory requirements to be translated into technical controls that can be continuously monitored and audited.”

Not knowing where your data lives

As GISEC Global 2026 ends, security leaders across the region are converging on the same uncomfortable truth: most breaches today don't happen because a firewall failed, but because the organizations didn’t know what it needed to protect or where their data resides.

“As AI becomes embedded in core operations, organizations need a clear understanding of where their data resides, who can access and operate their infrastructure, how policies are enforced and what dependencies exist across technology providers,” Nair added.

Three common cloud security oversights keep surfacing. According to Nair, it is the mismanaged secrets and keys, excessive privileges to individuals and weak threat prioritization.

However, one of the biggest oversees in the system is assuming that backing up data in cloud is enough, says Fady Richmany, Corporate Vice President and General Manager: Emerging Markets at Commvault.

According to Global research from Absolute Security, 57% of enterprises said recovery from a cyberattack took more than four and a half days on average, highlighting how costly gaps in recovery readiness can be.

Cloud Adoption and conceptions  

One of the common misconceptions about cloud, according to Richmany is that the cloud provider’s resilience automatically translates into the organisation’s resilience.

Cloud adoption is now near-total across Dubai and Abu Dhabi. However, Richmany says that the cloud provider is only responsible for keeping their platforms available and not their data. “Organisations still need to be able to restore their applications, identities, configurations and data cleanly and quickly,” he added.

Which sectors in the UAE face the most sophisticated attacks today, and why?

Salah Suleiman, Managing Director, South Gulf, TrendAI, said, “I would not put one sector at the top of the list.”

According to him, financial services are an obvious target because of the financial value and sensitive information they hold. “Healthcare is equally important because an attack can affect both sensitive data and the availability of essential services.” Logistics and critical infrastructure follow next on the list.

Suleiman noted that UAE plays an impressive role here. As the country builds increasingly connected digital infrastructure, cyberattack can have consequences far beyond the IT environment, affecting operations, services and ultimately trust.

The UAE cybersecurity reported the rising cyberattacks of over 600,000 a day with an increasing share of threats becoming AI-enhanced. “That is why I would look at risk based on potential impact rather than simply the number of attacks a sector receives.” Suleiman says.

“The more connected an organization is to critical services and the wider economy, the more attractive and potentially consequential it becomes to an attacker,” he added.

Are we future proof?

Nobody can predict exactly what the threat landscape looks like even a year out.  Suleiman emphasized that a strategy that works today cannot simply be left in place and expected to work in 2027.

According to Nair, a future ready security strategy will increasingly be an infrastructure strategy, with the resilience and governance inbuilt into the core business and operations.

However, future-readiness, according to Richmany, is to be able to recover cleanly and quickly from an unpredicted attack.

“I would point UAE enterprises to four priorities,” he said pointing towards making isolated, air-gapped recovery the baseline rather than the exception; protecting identity for both human employees and AI agents; defining a "minimum viable business" that is, what you can and cannot operate with and lastly, automating and continuously testing recovery in isolated cleanroom environments.

As attackers use AI to become faster and more sophisticated, experts suggest that businesses need to do the same. With UAE, already ahead of the timeline, the technology to do this already exists. It is now a matter of adoption.