Recovery is becoming the real test of cyber resilience for organisations across the UAE. Cohesity’s fifth annual Global Cyber Resilience Report finds that 73% of UAE organisations experienced a material impact from a cyberattack in the past 12 months, up sharply from 59% in 2025, and that almost nine in ten (88%) have experienced one at some point. As attacks grow more frequent and sophisticated, the research shows organisations are being judged less on their ability to prevent an incident and more on their ability to recover from one when it doesn’t go to plan.
Johnny Karam, Managing Director, International Emerging Region at Cohesity, said: “UAE organisations are strengthening their cyber resilience even as attacks grow more frequent and sophisticated. What the research tells us is that many recovery strategies are still built for a version of an incident that doesn’t reflect what teams actually encounter once an attack hits. Closing that gap is the next stage of resilience maturity in the region.”
Cyber resilience is becoming a continuous process, not a finished state
Nearly two-thirds (64%) of UAE organisations say they have a cyber resilience strategy in place but recognise it still requires improvement to keep up with today’s threats and challenges, up from 54% in 2025. Meanwhile, global confidence in cyber resilience strategies has declined from 47% reporting complete confidence in 2025 to 37% in 2026, underscoring the growing challenge organisations face in keeping pace with today’s threat landscape. The findings suggest organisations are taking a more measured view of cyber resilience, recognising that strategies must continue to evolve as threats become more sophisticated.
That evolving mindset comes against an increasingly challenging cyber landscape. Nearly three-quarters (73%) of UAE organisations experienced a material cyberattack in the past 12 months, up from 59% in 2025. The scale of the challenge is even clearer given that almost nine in ten (88%) organisations have experienced a material cyberattack at some point.
The findings suggest organisations are taking a more proactive and realistic approach to strengthening their cyber resilience strategies as attacks become more frequent, sophisticated and difficult to predict. Resilience is increasingly defined by an organisation’s ability to recover effectively, alongside its ability to prevent attacks in the first place.
Recovery plans are struggling to keep pace with modern cyberattacks
While organisations continue to strengthen their resilience capabilities, the research suggests many recovery strategies remain built around assumptions that are increasingly challenged during real-world cyberattacks. Many recovery plans still rely on the assumption that recovery will follow a largely linear, step-by-step sequence without significant backtracking (91%). Yet during actual cyberattacks, 93% of those who have experienced a material cyberattack in the past 12 months say recovery requires workarounds or improvisation, highlighting the gap between planned recovery and operational reality.
The challenge extends beyond recovery sequencing. Among organisations that experienced a material cyberattack, 88% identified gaps in how their recovery plans accounted for critical dependencies including AI systems, third-party integrations, security tooling, workforce skills and other modern digital environments, while 71% found the scope of the attacks spread beyond their initial assessment.
Together, the findings point to a growing gap between planned recovery and operational recovery, highlighting the need for recovery strategies that can adapt as attacks evolve beyond expectations.
Johnny Karam said: “Recovery rarely follows a linear path. Organisations need to adapt as attacks evolve and new dependencies emerge, and that’s reshaping how we should think about resilience. Real success comes down to the certainty with which organisations can recover critical business operations when attacks don’t unfold according to plan. That requires recovery strategies that are continuously tested, adaptable and built for real-world scenarios.”
Operational recovery remains the biggest challenge after an attack
The research suggests that restoring systems is only one part of the recovery process. For many organisations, the greater challenge lies in restoring normal business operations quickly and with minimal disruption. Among organisations that experienced a material cyberattack in the past 12 months, delays to business recovery were linked to dependencies between systems that had not yet been validated or were not functioning correctly (93%), a lack of confidence that restored data and systems were clean and safe to use (93%), and key systems or applications that had been restored but were not yet fully functional or verified for use (90%).
The research also found that only 45% of those who experienced a material cyberattack in the past 12 months conducted an independent forensic review to validate restored systems before reconnecting to production environments, suggesting many organisations continue to balance the pressure to restore operations quickly with the need to validate that recovered environments are secure.
The findings reinforce that cyber resilience is evolving beyond an IT objective into a broader business continuity priority. As cyberattacks become increasingly complex, organisations will need greater certainty that critical business operations can be restored quickly, safely and with minimal disruption. Those that continuously test recovery plans, validate restored environments and prepare for unpredictable attack scenarios will be better positioned to minimise disruption, maintain stakeholder trust and strengthen long-term resilience.