Only 33% of organisations in the UAE consider cyber resilience a top priority, and just 15-19% of CISOs in the Emirates regularly test their recovery plans, according to new research from Palo Alto Networks and IDC Research. This result is significantly lower than the average among all surveyed countries (28%) across EMEA and LATAM markets, indicating discrepancies between intent and execution.
UAE organisations cited endpoint, network, and cloud as the top attack vectors, while endpoint detection and response and continuous authentication were listed as their top focus areas for cybersecurity investment.
The research covered eleven countries across EMEA and Latin America.
Across EMEA and LATAM, the research found that less than half (40%) of organisations feel confident in their ability to overcome a cyberattack without major disruption, highlighting the need to develop strategic initiatives and challenge existing toolkits to improve cybersecurity postures. Only 38% of CISOs across EMEA believe their cyber resilience state is mature.
Haider Pasha, Chief Security Officer, EMEA & LATAM, at Palo Alto Networks, the world’s cybersecurity leader, comments: “Despite moderate maturity levels across EMEA and LATAM, including the UAE, it’s surprising how few CISOs are equipped to regularly test their recovery plans. But CISOs face an uphill battle. On the one hand, geopolitical events and supply chain disruption are adding to the threat level, while on the other hand, a shortage of talent and relevant expertise all make implementing solutions and preparing to counter future attacks ever more challenging.”
Surprisingly, just 21% of CISOs in EMEA and LATAM in the banking, financial services and insurance industry regularly test recovery plans, one of the lowest rates across verticals, despite it being one of the most heavily regulated sectors. However, the research reflects an appetite for making a culture shift around cyber resilience, with influence from senior leadership becoming increasingly important. 72% of respondents said board members are a primary driver of the organisation’s focus on cyber resilience, higher than regulatory imperatives (70%).
With threat levels and market complexity increasing, CISOs have a difficult task. The research results show how, despite 78% of organisations in EMEA and LATAM acknowledging the significance of cyber resilience, fragmentation and demand for resources are preventing aspirations from aligning with reality. Talent shortage and lack of emerging security technology skills rank as the top challenges in achieving cyber resilience, both cited by 70% of respondents, followed by lack of correlation across multiple point products (52%).
“What’s clear is that many organisations don’t yet have the resources and confidence to implement a cyber-resilient tech stack designed to prevent attacks. Instead, they have to rely heavily on tactics such as disaster recovery, which are designed to respond to incidents, rather than plan for them. The lack of visibility into the impact of threats and the focus on resolution is leaving organisations exposed to more threats and unable to plan for future risks,” Pasha added.
The research uncovered surprisingly few differences between markets in Europe, Latin America and the Middle East. This shows a consensus that cyber resilience is mission-critical for businesses. Markets where cyber resilience is the biggest priority include Saudi Arabia (48%), Spain (44%), Brazil (43%) and France (42%). Some European markets, including Germany and the UK, are less likely to consider it a business priority.
Alongside fragmentation, the research highlights a number of technology challenges. Using mature cybersecurity controls for cyber resilience stands at just 11% with some EMEA countries rating it as low as 0-5%, and most rely heavily on business continuity plans (74%), disaster recovery plans (72%), ransomware recovery plans (54%) and crisis management strategies (51%).