October is Cybersecurity Awareness Month, and across the Middle East, the theme has rarely felt more urgent. AI is making attacks faster and more convincing, while rapid digital transformation is widening the region’s attack surface. Phishing emails read like genuine messages, stolen identities open trusted doors, and attackers move from discovery to exploitation in hours rather than weeks. In this environment, awareness alone is no longer enough. Organisations must pair informed people with strong identity controls, full visibility and security that assumes mistakes will happen. Resilience, not vigilance alone, now measures a mature security posture.
Identity is the new perimeter
Dr. Kamel Heus, Vice President of Sales, MEA at Saviynt, says the hidden crisis is identities that nobody owns. “Non-human identities. Organizations here have invested heavily in protecting their people, but service accounts, API keys, bots and now AI agents already outnumber employees by more than 140 to 1, and most can’t name them all. Many are owned informally by whoever built them. They hold broad standing access and keep running long after that person leaves. Attackers don’t need to break in when an unmanaged credential lets them log in. Stop treating people as the weakest link and design for the mistakes they will make. Awareness training matters, but AI-generated phishing is now too convincing to rely on vigilance alone. Every manager should own their team’s access through reviews they actually understand, and not spreadsheets they rubber-stamp. Every AI agent needs its own identity, a named owner and only the access its task requires, checked continuously at runtime. AI security begins and ends with identity.”
Keyur Shah, Associate Field CISO at Sophos, believes identity misuse is the risk to watch most closely. “The biggest underestimated risk today is identity. As Middle East organisations accelerate cloud, SaaS and AI adoption, human and machine identities are expanding rapidly. Attackers are increasingly exploiting stolen tokens, active sessions and over-privileged accounts to operate as trusted users. We need to stop treating cybersecurity awareness as an annual compliance exercise. Employees should regularly experience realistic phishing, impersonation and AI-driven social-engineering scenarios, with simple ways to report suspicious activity. Awareness reduces the likelihood of an incident; resilience determines its blast radius. AI is shrinking the time defenders have to make the right decision. Businesses need connected defense across identity, endpoint, network, email and cloud, using AI to correlate signals and accelerate response while humans retain judgment and accountability. The goal is not simply to fight AI with more AI, but to build context, control, and coordinated response because speed without control only creates faster failure.”
According to Adnan Fakhouri, Customer Success Lead at QuantumGate, the quantum transition deserves attention today. “The most underestimated risk is the time required to prepare for the quantum transition. Cryptography is embedded across payments, identity, networks and critical infrastructure, and replacing it safely can take years. With ‘harvest now, decrypt later’ creating exposure today, organizations need to start with cryptographic discovery. Encouragingly, our GCC research found 64% have approved post-quantum budgets, but execution now needs to follow. Security culture improves when the secure choice is also the easiest choice. Phishing-resistant authentication, including passkeys and security keys, can remove passwords from the attack path, while clear ownership of keys and certificates reduces avoidable gaps. Executive sponsorship is equally important, because culture follows the priorities leaders set. AI is increasing the speed, scale and credibility of cyberattacks, so businesses need to strengthen the foundations that attackers exploit. Identity should be a priority, with phishing-resistant authentication and stronger verification for high-risk actions.”
Seeing the whole surface
Subhajeet Singha, Senior Threat Intelligence Researcher at the Acronis Threat Research Unit, states that supply chain exposure is often overlooked. “I would highlight supply chain and third-party risk. Organizations depend on software vendors, managed service providers and cloud integrations, but may have limited visibility into those suppliers’ security practices and the access they hold. A compromise at one supplier can expose multiple downstream customers. Stolen credentials, hijacked sessions and phishing techniques that bypass some forms of multifactor authentication can allow attackers to abuse trusted access. Reviewing supplier permissions, monitoring how that access is used and removing it when no longer needed, should be part of ongoing risk management. Awareness training needs to go beyond an annual checkbox exercise. Employees need guidance that reflects their responsibilities, clear reporting channels and visible support from leadership. Threat actors are already using AI to support phishing, reconnaissance and malware development. Looking ahead to 2027, businesses should use AI to help analysts identify meaningful threats and respond faster, with clear human oversight of consequential decisions.”
According to Meriam ElOuazzani, Vice President for Middle East, Turkey and Africa at Censys, no one outside the organisation owns the gap. “This pattern keeps repeating. Middle East boards treat resilience as an internal problem, review phishing reports and patching scores, and then ask why exposure appears elsewhere. Human error still matters, but the gap outside the organisation has no owner. Map every external service and third-party link to an owner, and test whether a supplier compromise reaches customer data. The region is digitising quickly, and exposed surfaces keep growing. Ownership is the practical control, not more tooling. Awareness works when reporting feels safe and reaches security quickly enough to address real exposure. Click tests may miss that. If blame wins over safety, reporting stops being a control. Teams that rush into AI without clear data boundaries learn quickly that speed can make bad assumptions look official. Across the Gulf, the coming year will focus on controlling what data models can access and who directs their actions.”
Mohammed AlMoneer, Senior Director, Regional Sales METAF at Infoblox, says resilience starts with visibility. “One of the most underestimated risks is the gap in visibility across the digital environment. Organisations may secure endpoints and applications, yet still lack a complete view of the devices, workloads and domains connecting to their networks. Attackers exploit that gap, often using DNS and short-lived infrastructure to hide in plain sight. Cyber resilience begins with understanding what is connected, then applying controls early enough to stop threats before they create business impact. Awareness works when it becomes part of how people work, rather than an annual compliance exercise. Leaders also need to reinforce that security is a shared responsibility. At the same time, technology should reduce the room for error through sensible defaults, automation and controls that protect users wherever they connect. Businesses need to combine strong fundamentals with preemptive controls at foundational layers such as DNS, where threats can be identified and blocked early.”
Breaking down silos, building culture
Maan Al-Shakarchi, Regional Director META at Extreme Networks, believes the network can bring security tools together. “The biggest security gap isn’t always a missing piece of technology. Often, it’s the tools organizations already have operating in silos. Many businesses have invested in identity, device management and network security, yet these systems still operate separately. This is where the network has a critical role to play, helping bring these capabilities together to enforce security policies consistently across users, devices and applications. A strong security culture isn’t about expecting people never to make mistakes. It’s about ensuring those mistakes don’t become security incidents. Practical, ongoing awareness training is essential, but it needs to be supported by technology that enforces security policies automatically. Networks need to continuously assess identity, device posture and access requirements, dynamically adapting policies as context shifts. An intelligent network can help security teams detect anomalies and respond faster, while working alongside a broader Zero Trust strategy.”
According to Ashraf Koheil, VP of Sales, META & AUZ at Group-IB, intelligence should help defenders anticipate attacks. “Many companies have invested heavily in cybersecurity, but if tools and teams operate in silos, important signals can be missed. Organizations need to understand their full threat landscape, including who is targeting them, how adversaries operate, and where an attack may come from next. Cybersecurity needs to move from a reactive model toward a Prediction-First, adversary-centric approach, using intelligence to identify threats earlier and give defenders more time to act. Cybersecurity awareness cannot be a once-a-year training exercise. It needs to become part of how people work everyday. Organizations should provide regular, role-specific training, test employees with realistic simulations, and make it easy to report something suspicious. AI is lowering the barrier for cybercriminals while also giving defenders powerful new capabilities. The goal for the coming year should be to fight AI with AI, but intelligence must guide it.”
Sapna Arasu, Channel Manager at ESET Middle East, says social engineering is evolving faster than many organisations realise. “One of the most underestimated risks is how quickly social engineering is evolving. Attackers are combining trusted digital workflows with AI-generated content, QR codes, fake troubleshooting experiences and cloud-account abuse. ESET telemetry recorded a 108% rise in Click Fix detections between H2 2025 and H1 2026, while QR-code phishing reached record levels. Resilience therefore requires stronger technical controls alongside continuous user awareness and verification habits. Awareness needs to become an ongoing business practice rather than an annual training exercise. Organizations should combine role-based education with phishing simulations, clear reporting channels, strong authentication, least privileged access and regular incident exercises. Leadership also matters; employees need to feel comfortable reporting suspicious activity quickly without fear of blame. Businesses should treat AI as both a security tool and a new attack surface. AI can accelerate defence, but resilience still depends on context, verification and disciplined security operations.”
Defending at machine speed
Tony Zabaneh, Director, Systems Engineering, South Middle East at Fortinet, states that speed is the risk organisations underestimate most. “The biggest risk organizations continue to underestimate is speed. AI and automation are enabling attackers to move at machine speed, dramatically shrinking the time between identifying a vulnerability and exploiting it. Fortinet’s threat intelligence shows that attackers are exploiting new vulnerabilities within hours or days rather than weeks, reducing the defender response window. For organisations in the Middle East, where digital transformation is rapidly accelerating, cyber risk needs to be viewed as an industrialized operation rather than a series of isolated attacks. Organizations need to move from awareness to readiness, making cybersecurity part of everyday behaviour rather than an annual training exercise. Businesses should treat AI security as a core part of their cybersecurity strategy rather than treating AI as a separate layer. It is also important that AI augments human expertise, rather than replacing it, and that AI systems operate within established boundaries and remain explainable and auditable.”
As per Prashant Menon, Channel Leader, UAE at Check Point Software Technologies, regional figures show the scale of the challenge. “The risk organisations may still underestimate is the persistence and scale of attacks. In the Middle East, organisations experienced an average of 2,750 cyber attacks per week over the last six months, compared with 2,315 globally. Meanwhile, 84% of malicious files were delivered through email last month, highlighting how attackers continue to exploit trusted communications as an entry point. Security awareness works best when it becomes part of how people work, rather than a once-a-year training exercise. The goal is not to expect employees to be perfect, but to build an environment where informed users and effective protection work together as part of a shared security-first culture. Secure AI adoption needs to happen alongside AI adoption, rather than after it. Check Point Research found that high-risk GenAI prompts doubled from 2% to 4% over the past year, while organisations used an average of 10 AI applications each month.”
The road ahead
Three messages run through all eleven perspectives. Identity and visibility are the foundations, since organisations cannot protect what they cannot see or do not own. Culture only works when reporting feels safe and security controls assume that mistakes will happen. And AI must be governed as carefully as it is adopted, with human judgment kept firmly in the loop. Cybersecurity Awareness Month is a reminder that resilience is built year-round, and this October is a good time to start.