Darktrace, Vectra AI, and ExtraHop lead enterprise NDR shortlists in 2026. For GCC firms, the choice depends on whether you require behavioral AI with autonomous response, identity-aware hybrid attack detection, or deep packet forensics with TLS 1.3 decryption. A data-grounded comparison.
JADEPUFFER is the first LLM threat actor to run an autonomous ransomware campaign. Via a Langflow RCE, it stole credentials, pivoted to MinIO using default passwords, took over a Nacos server, and destroyed 1,342 configurations with an irrecoverable AES key.
22% of critical infrastructure firms hit an OT/ICS incident last year. For GCC energy operators in Saudi, UAE, and Qatar, this guide covers threats, NCA OTCC and SAMA compliance, and purpose-built vendors for industrial environments.
Week 25 briefing: Showboat Chinese espionage in Middle East telecoms, FortiBleed at 110M credentials, Check Point VPN zero-day, Chrome exploited, SocGholish dismantled, Riyadh named UNITAR cyber HQ, and 20+ stories from a packed week in GCC and global security.
A secure high-security data centre corridor with blue-lit server cabinets, representing the revelation that Anthropic's Mythos model identified vulnerabilities in classified US government systems during a Project Glasswing testing exercise
Trend Micro has officially launched TrendAI in the UAE, rebranding its enterprise cybersecurity division to reflect AI as the central threat and defence layer, as 67% of organisations report pressure to deploy AI despite unresolved security concerns.
The UAE Cyber Security Council and Commvault have launched a dedicated Innovation Centre of Excellence in Abu Dhabi, bringing live cyberattack simulation, recovery training, and talent certification to UAE government and enterprise teams.
International law enforcement has dismantled the SocGholish malware network, seizing 106 servers and 101 domains, and remediating nearly 15,000 infected WordPress sites globally. The operation is part of the ongoing Operation Endgame, targeting Evil Corp-linked infrastructure.
Israeli AI cybersecurity startup Dream has raised $260 million at a $3 billion valuation. The company counts Gulf governments among its customers and has opened an office in Abu Dhabi.
Azure dominates UAE and Saudi enterprise cloud deployments, but most GCC organisations lack a governance layer. This guide covers five specific controls, from identity and PIM to Defender for Cloud and Sentinel, to turn a standard Azure deployment into a properly secured one.
Weekly Briefing (Week 24): Saudi NCA expands mandatory compliance. INTERPOL arrests 201 in Operation Ramz. Critical Veeam CVSS 9.4 flaw found. "The Gentlemen" ransomware gains worm-like speed. MuddyWater exploits Langflow zero-day. Microsoft sets record with 200 fixes. Stay tuned to MENA Cyber Wire.
Oman's cybersecurity market will grow from $135M in 2025 to $214M by 2031, driven by Vision 2040, Hadatha, and a strategic shift from defensive spending to sovereign economic capability. The GCC's Tier 1-ranked nation is building to export.
The GCC has invested billions in digital transformation but still lacks a coordinated, EU-style cyber intelligence sharing structure. A leading UK cybersecurity academic warns this gap is now a strategic vulnerability. AI, ransomware and critical infrastructure exposure are the pressure points.
Help AG’s 2026 State of the Market Report shows a machine-speed era for GCC cyber threats. DDoS attacks rose 857% since 2019, with UAE incidents peaking at 700,000 daily during tensions. Attacks now reach impact in under 40 hours, a 65% speed increase that outpaces traditional defenses.
Mastercard's inaugural Cyber Pulse report, released from Riyadh, reveals the Middle East average breach cost at $7.29M, 64% above global. Financially motivated attacks drive 71% of EEMEA cybercrime. Public, tech and financial sectors account for 44% of all targeted activity.
GCC cybersecurity spend is on course to exceed AED 120 billion by 2030. Here is where the region's CISOs are directing budgets in 2026 and the forces driving each allocation.
ESET's SMB Cyber Readiness Index 2026 reveals 45% of small and mid-sized businesses suffered a cyberattack in the past 12 months. AI-powered malware has overtaken all other threats as the top concern, even as overall confidence in cyber resilience improves.
The global cybersecurity market is projected to reach $580.18 billion by 2031, growing at a CAGR of 14.68% from $255 billion in 2025, driven by AI-powered threat detection, zero-trust adoption and surging cloud security demand across enterprise and critical infrastructure sectors.
Ransomware victims surged 58% in 2025. The GCC is not a bystander. UAE ranked 9th globally for cyber incidents. Saudi Arabia saw 32% more ransomware in 2024 alone. Here is what the 2026 threat picture looks like and what GCC enterprise teams must do now.
UAE-headquartered LinkShadow has been positioned in the Visionaries Quadrant of the 2026 Gartner Magic Quadrant for Network Detection and Response, recognised for its AI-driven Intelligent NDR platform combining real-time network telemetry, behavioural analytics, and contextual threat correlation.
Hitachi and Anthropic announced a strategic partnership to bring Claude AI and cybersecurity to critical infrastructure. The deal deploys Claude across 290,000 global employees and launches a new Frontier AI Deployment Center spanning North America, Europe, and Asia.
Verizon's 2026 Data Breach Investigations Report reveals that AI-detected vulnerabilities now account for 31% of all breaches, surpassing stolen credentials as the leading entry vector. Threat actors are using AI to shrink defender response windows from months to hours.
Anthropic has revised Project Glasswing restrictions, allowing partners using its Mythos defensive cybersecurity AI model to share threat findings, vulnerability data, and mitigation tools more broadly across the security ecosystem.
Clyde & Co explores how Middle East businesses face compounding cyber threats from state-linked actors, OT vulnerabilities, and cloud disruption: alongside rising legal obligations around data residency, force majeure, and IT resilience.
An unauthorised actor stole a GitHub access token from Grafana, downloaded its codebase, and attempted extortion. The CoinbaseCartel group has claimed responsibility. Grafana refused to pay the ransom and has revoked the compromised credentials.
US officials suspect Iranian-linked hackers accessed unprotected fuel-level monitoring systems at gas stations across multiple states. No physical damage reported, but the intrusions expose dangerous gaps in critical infrastructure security.
Executives from TechBridge MEA and Cylerian at the announcement of their strategic partnership to deliver unified AI-native cybersecurity across the Middle East and Africa.
The UAE Cyber Security Council and Palo Alto Networks have signed a strategic MoU to develop AI-powered cybersecurity capabilities, establish a Centre of Excellence in the UAE, and strengthen national cyber talent and CERT operations.
The UAE Cyber Security Council and CPX Holding have launched the UAE Cyber Factory, a sovereign AI-powered initiative to design, build and scale next-generation cyber defences as the country records more than 800,000 daily cyberattacks.
New Sophos research reveals that women are playing a growing and diverse role in cybercrime, from social engineering and insider recruitment to ransomware development and hacktivist operations. Security teams that ignore this shift are building incomplete threat models.
Hacking group ShinyHunters has claimed responsibility for a breach of Instructure, the parent company of the Canvas learning management system, taking the platform offline for thousands of institutions globally and threatening to release data unless affected universities make contact before May 12.
ASIC has issued a formal warning to the financial sector regarding cybersecurity risks from frontier AI models like Mythos. With the clock at "a minute to midnight," the regulator urges institutions to immediately strengthen cyber resilience fundamentals to counter these emerging AI-driven threats.
Iranian state-backed group MuddyWater used Microsoft Teams screen-sharing to harvest credentials in a false flag operation disguised as ransomware. Oman's Ministry of Justice lost 26,000 records. The Port of Fujairah in the UAE was breached, leaking 11,000 sensitive shipping documents.
The UAE Cyber Security Council, Cisco, and Open Innovation AI have launched a first-of-its-kind national facility to test, validate, and certify AI models and agents against UAE cybersecurity standards and global frameworks including ISO 42001 and NIST AI RMF.
Rubrik has launched Agent Cloud for Google Gemini Enterprise, bringing real-time AI agent governance, instant action reversal and automated discovery to GCC enterprises deploying autonomous agents, addressing the security gap no existing SIEM or EDR tool was designed to fill.
AmiViz and Acalvio have announced a strategic distribution partnership to bring AI-powered deception technology across the Middle East, exposing advanced threats before they escalate, with a focus on agentic AI risks in GCC enterprise and government sectors.
Infosecurity Europe 2026 runs June 2 to 4 at ExCeL London. With sessions covering AI agent security, ransomware tradecraft, cloud fundamentals, and hybrid infrastructure threats, this year's programme carries direct relevance for GCC enterprise security leaders. Early registration closes May 5.
The FBI warns that criminal groups are systematically compromising freight brokers and carriers to steal high-value cargo. Global losses topped $725 million in 2025. A 60% value increase despite lower incident growth. GCC logistics operators must review these documented attack methodologies.
Trellix, formed by McAfee Enterprise and FireEye, confirmed unauthorized access to its source code repository. Forensic experts and law enforcement are investigating. While no exploitation has been found, GCC enterprises using Trellix products should conduct immediate security reviews.
CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog. This Linux kernel flaw, present since 2017, allows deterministic page cache overwrites to gain root access. Federal agencies must patch the privilege escalation vulnerability by May 15, 2026.
The perimeter security model has been systematically dismantled by cloud adoption, remote work, and supply chain complexity. This deep guide covers what Zero Trust actually means, how to implement it in phases, and what GCC enterprises in government and financial services need to know.
Versions 2.6.2 and 2.6.3 of PyTorch Lightning have been compromised with credential-stealing malware that runs automatically on import. The attack is linked to TeamPCP and LAPSUS$ and targets CI/CD pipelines and GitHub repositories.
Fortinet's 2025 report reveals its role in INTERPOL's Operation Serengeti 2.0, which disrupted over 11,400 malicious infrastructures. The company also expanded post-quantum cryptography across FortiOS and trained over 914,000 people in cybersecurity.
Most GCC enterprises spend their security budgets defending against threats they cannot see. This deep explainer covers how cyber threat intelligence works, what types matter, and how to operationalise it across your enterprise security stack.
Egypt's Communications Minister and Intel MEA GM have agreed to a cybersecurity and AI cooperation MOU, covering workforce training, the Karnak Arabic LLM, and digital transformation strategy.
AmiViz and FrontierZero have announced a strategic distribution partnership to address the growing threat of shadow SaaS, identity blind spots, and unmanaged AI tools across enterprise environments in the Middle East and Africa.
Mozilla's Firefox CTO says Anthropic's restricted Mythos AI model found 271 security vulnerabilities in Firefox 150 simply by analyzing unreleased source code compared to just 22 found by Claude Opus 4.6 a month earlier. The cybersecurity balance may be shifting.
New research across 500 EMEA security leaders finds 94% believe stronger employee awareness directly reduces cyber incidents. Yet 67% say their workforce still lacks sufficient cybersecurity knowledge. For Gulf enterprises, the human layer remains the most underdeveloped defense.
Two of the world's leading cybersecurity firms have appointed senior regional executives in the UAE within days of each other a signal that enterprise security demand across the Gulf is intensifying as AI-powered threats grow in sophistication and scale.
Saudi Arabia accounted for 63% of cyber incidents across the Middle East in 2025. As 2026 is designated the Year of AI and the NCA tightens its licensing framework, the Kingdom's cybersecurity market is entering a new phase of maturity and urgency.
Egypt's cybersecurity startup ecosystem is maturing fast. From AI-powered threat detection and dark web monitoring to mobile runtime security and talent development six Cairo-based ventures are expanding across the Gulf, Europe, and North America.
Google has unveiled an AI-powered cybersecurity platform combining its Threat Intelligence and Security Operations with Wiz's cloud security stack. Its own SOC agents now triage tens of thousands of threat reports monthly cutting mitigation time by over 90%.
KPMG's Cybersecurity Considerations 2026 draws on 20+ global cyber experts to outline eight priorities reshaping enterprise security from agentic AI governance and non-human identity risks to post-quantum cryptography and CISO board-level influence.
OPSWAT and Emerson announce a global reseller agreement embedding OT-native patch management into the Ovation Automation Platform — a critical step for power and water operators facing surging cyber threats.
The UAE Cyber Security Council warns that 25% of public files contain sensitive data and up to 77% of privately shared files remain accessible to unintended users — a critical gap for GCC enterprises relying on cloud storage.
Cisco's inaugural State of Wireless Report finds 83% of UAE organisations suffered wireless security incidents in the past year, with 52% reporting losses above $1M — as AI workloads intensify both opportunity and risk across Gulf enterprises.
As Vision 2030 accelerates Saudi Arabia's digital shift, enterprise security leaders are prioritising Zero Trust, AI-driven detection, and compliance-first architectures. Here's what the evolving KSA threat landscape demands from organisations today.
StarLink, an Infinigate Group company, showcases AI-driven cybersecurity at GITEX Africa 2026, featuring BeyondTrust, Sophos, Tenable, Forescout and more for Africa's digital resilience.
UAE cyber threats are surging, with ransomware up 32% and phishing causing 75% of breaches. Risks now include "Shadow AI" and AI-driven email fraud. The UAE Cyber Security Council warns that the market will hit $1.51B by 2031 as the nation shifts toward mandatory resilience.
Google has released an emergency security update for Chrome addressing an actively exploited zero-day vulnerability. Users and IT teams are advised to update immediately — the flaw allows remote attackers to execute arbitrary code via a crafted webpage.
The Central Bank of Kuwait has launched the first cohort of its Advanced Cybersecurity Leaders Programme, offering experienced Kuwaiti banking professionals advanced training in cloud security, threat detection, and GIAC certifications in partnership with SANS Institute.
A sophisticated Android malware named NoVoice was found hidden in over 50 Google Play apps downloaded 2.3 million times. It roots infected devices and steals WhatsApp session data — a serious threat for GCC businesses that rely on WhatsApp for daily communications.
Iranian state media has named 18 technology companies — including UAE AI firm G42 and US giants Microsoft, Google, and Apple — as targets effective 1 April. Enterprises across the GCC operating on their cloud and AI infrastructure should treat this as an active threat.
Most Gulf companies are pressing ahead with consulting projects despite the Iran conflict, redirecting budgets toward cyber security — forecast to grow 19% to $1.8 billion in 2026.
The alleged mastermind behind LeakBase, one of the world's largest stolen credential marketplaces, has been arrested in Russia as law enforcement secures data on over 147,000 cybercriminals.
New research from HID’s 2026 State of Security and Identity Report reveals a global shift toward unified identity systems, as 73% of organizations move to balance robust security with rising ethical and privacy demands.
Cloudsmith has unveiled threat intelligence enrichment for software packages at KubeCon + CloudNativeCon Europe, enabling DevSecOps teams to automatically assess risk, block unsafe dependencies, and enforce compliance policies across their software supply chains.
The UAE NESA framework is the Kingdom's primary cybersecurity standard. Here's what it requires, who must comply, and where most businesses fall short.
Organisations operating in the Middle East face a cyber threat landscape shaped by regional geopolitics, state-sponsored actors, and rapid digitalisation. This guide covers what MENA-specific cyber risk assessment services include, who needs them, and what to look for in a provider.
Global security agencies warn that state-sponsored actors are increasingly using legitimate system tools to evade detection, forcing a fundamental shift in defensive strategies.
A multinational law enforcement effort has dismantled the backend of the world’s most prolific ransomware-as-a-service operation, seizing servers and recovering decryption tools.
As global threat actors pivot from traditional malware to sophisticated identity-based attacks, GCC enterprises face a critical juncture in securing their digital borders.
New intelligence indicates that threat actors are leveraging localized large language models to bypass traditional security filters across UAE and Saudi financial sectors.