#UAE #AIsecurity - Microsoft, G42-owned cybersecurity company CPX and research firm IDC have published Securing AI in the UAE Enterprise, a study of 175 senior security and technology executives. The research finds 98 percent of security teams have encountered at least one real AI security risk in production, while 80 percent of CIOs are confident their AI investments will deliver results within two years. Only 15 percent of CISOs have mandatory approval authority over AI deployments, and 43 percent of CIOs say staff regularly use unapproved AI tools.
SO WHAT? - UAE enterprises seem to be deploying AI faster than anywhere else in the world. However, they also deploying it fastr they can secure it. Security is often brought in after strategic and deployment decisions are made, and only 10 percent of organisations define security requirements before evaluating an AI solution. With one of the highest rates of AI tools among office workers, shadow AI adds a second problem for the UAE, with data already leaking through unsanctioned tools. The study’s conclusion is consistent with other recent UAE surveys: policies exist, but control still lags.
KEY POINTS:
Microsoft, CPX and IDC released Securing AI in the UAE Enterprise, timed with Cyber Security Awareness Month. It surveyed 175 senior security and technology executives across UAE enterprises.
80% of CIOs are confident their AI investments will deliver results within two years. Yet 98% of security teams report at least one real AI security risk in their production environment.
92% of security leaders say AI systems process sensitive data. 54% have faced a case where an AI system’s decision couldn’t be explained or audited in a compliance context.
43% of CIOs say employees regularly use AI tools their organisation hasn’t approved. 52% of security teams have identified real data leakage through unsanctioned tools.
More than half of organisations have AI agents deployed or in active development. Only one in 10 considers itself fully prepared to deploy agentic AI safely.
Only 15% of CISOs have mandatory approval authority over AI deployments, and just 10% of organisations define security requirements before evaluating an AI solution.
Only 30% use a structured method to assess AI security posture, while 40% rely mainly on reactive assessments, vendor reviews or third-party audits. 87% of security teams aren’t fully comfortable with AI security topics.
The study recommends a formal security role in AI decisions, audits of existing AI systems, policies on unapproved AI and permission limits for agents. Two-thirds of UAE security teams already use AI for defence, and the rest plan to within 12 months.
ZOOM IN - Consistent with other recent research, the IDC study fonud that more than half of UAE enterprises have AI agents in production or development, yet only one in ten considers itself fully prepared for agentic AI. Controls exist: 69 percent have automated alerts for agents acting outside their workflow, and 60 percent have run a formal incident response simulation for agent failure. Even so, 52 percent have already identified an agent acting beyond its authorisation. The study blames undefined permission boundaries, with 44 percent yet to define and enforce maximum permissions for each agent role. IDC concludes that this as a governance question with business risk attached, rather than a technical challenge.
[Written and edited with the assistance of AI]
Source: IDC, CPX, Microsoft
DOWNLOAD
Read more about AI security and governance:
75% of UAE AI incidents escalated to board or C-suite (Middle East AI News)
98% of UAE firms report AI accessing data beyond its task (Middle East AI News)
UAE firms run AI agents at massive scale (Middle East AI News)
Saudi Arabia, UAE AI spend surges, execution lags behind (Middle East AI News)
IBM: Middle East’s average data breach cost reaches $8M (Middle East AI News)