Cybersecurity shifts from flaws to resilience

■ Tenable is participating in GISEC Global 2026. What makes the Middle East an important market for Tenable, and what will you be highlighting at the event?

The Middle East is at the forefront of digital transformation, with governments and enterprises investing heavily in AI, cloud infrastructure, smart cities and connected technologies. This creates enormous opportunity for growth and innovation, but also a more complex, interconnected cyber environment. For Tenable, the region matters because organizations are embracing technologies that are fundamentally reshaping their digital estates. At GISEC, we'll focus on how organizations can move beyond fragmented, reactive security towards a unified approach to reducing cyber exposure across IT, cloud, identities, OT and AI. The conversation is no longer just about finding vulnerabilities but about understanding which exposures could be exploited, how they connect, and what business impact they could create.

The argument is simple. Attackers have AI finding flaws faster than organisations can patch them. Tenable levels the playing field and provides defenders with the same level of leverage.

■ The UAE and other Gulf countries are accelerating their adoption of AI. What cybersecurity risks does this create for the region?

The UAE's ambition to lead in AI brings major opportunities for diversification and transformation, but the pace of adoption creates a distinct challenge: ensuring security and governance keep up with the technology. AI is being woven into government services, finance, healthcare and critical infrastructure, environments with sensitive data and privileged identities, where a single weak point can have wide-reaching consequences.

Tenable's 2026 Cloud and AI Security Risk Report found that 70% of organisations have integrated at least one third-party AI or MCP package, while 18% have granted AI services admin permissions that are rarely audited. The priority for the UAE should be visibility: knowing where AI is deployed, what it can access, and how it interacts with enterprise environments treated as part of enterprise risk management, not a standalone issue.

The risk isn't the AI. It's the access we hand it.

An AI service is another identity in your estate, except this one gets plugged in by a developer on a Tuesday and rarely looked at again. Our 2026 Cloud and AI Security Risk Report found seven in ten organisations have pulled in at least one third-party AI component, and 18% have granted AI services administrative permissions that are almost never audited. That second number is the one for the board.

In government services, finance and healthcare, that's an over-privileged, unmonitored identity sitting next to sensitive data and privileged systems. So treat AI as part of identity governance. It isn't an AI problem, it's an access problem wearing new clothes.

■ The Middle East is investing heavily in smart cities, cloud, critical infrastructure and connected systems. How does this affect cyber resilience?

Interconnection is the goal of a smart city. It's also what lets a small failure travel.

Tenable's State of Cloud and AI Security survey, run with the Cloud Security Alliance and published last September, found 82% of organisations now operate hybrid environments and 63% use more than one cloud provider. Those are global numbers. The direction in the Middle East is the same, only quicker.

The practical consequence is that the boundary you're defending no longer matches the boundary on your org chart. A weakness in a cloud account can finish at a traffic system or a substation.

Resilience isn't more controls. It's knowing which paths lead to the services people notice when they stop working.

■ How should organizations rethink traditional vulnerability management as threats grow more sophisticated?

Vulnerability management remains foundational but isn't enough on its own. Organizations need to shift from counting vulnerabilities to understanding which exposures are most likely to cause a business-impacting incident. This is where exposure management comes in combining vulnerabilities, threat, misconfigurations, identity risks, asset criticality and attack pathways into a full picture of risk. The goal isn't eliminating every vulnerability, which isn't realistic; it's identifying what matters most and directing resources there. For security leaders, this marks a shift from activity-based metrics to risk-based decisions aligned with business priorities.

■ Human error remains a major factor in incidents, especially phishing and social engineering. How can organizations address this?

Employees aren't the weakest link. They're the most targeted one, which is a different problem with a different fix.

Training helps at the margins, but no amount of it makes a person immune to a well-built lure. So stop designing controls that assume the click won't happen and design for what happens after it. Addressing exploitable flaws on the endpoint that are targeted by attackers, least privilege, short-lived credentials, monitoring that notices an account behaving unlike itself are far more effective than hoping the training stuck.

Get that right and the click becomes an event rather than an incident.

Blaming the user is bad security economics. One person's bad morning shouldn't be load-bearing or lead to a breach

■ Looking five to ten years ahead, how do you see cybersecurity evolving, and what should Middle Eastern organizations prioritize now?

Over the next 5 years, I'd expect cybersecurity  to continue to dramatically change shape. Less finding and reporting, more continuous validation of whether the controls you think you have actually hold, with machines doing most of the work on both sides. Attack and defence both speed up, and the human role moves up to deciding what's worth protecting.

I'd also expect identity to become the critical cornerstone. Once most of the actors in an estate are software, access is the perimeter.

The strategy for now? Get a complete picture of what you own across IT, cloud, identity, OT and AI. Fix the governance of who and what can reach what. Build security into transformation programmes while they're still on paper, because retrofitting costs several times more.