GCC Cyber Alert: 200,000 Daily Attacks and What Every Board Must Do Right Now

The scale of the problem is no longer theoretical. According to Dr Mohamed Hamad Al Kuwaiti, Head of the UAE Cyber Security Council, between 90,000 and 200,000 breach attempts strike the UAE's digital infrastructure every single day. That figure, released in February 2026, is not a forecast. It is the current operational reality for every organisation doing business across the GCC.

In a detailed advisory published this week, international law firm Akin Gump Strauss Hauer and Feld has outlined what it describes as a materially elevated cyber-risk environment for the Gulf region, one that demands immediate action at both the technical and governance levels. For GCC business leaders, the message is clear: this is not a technology problem to be delegated to the IT department. It is a business continuity and board accountability issue.

Why this is a business continuity crisis, not just a security problem

The traditional framing of cybersecurity as a cost centre is a liability in 2026. For a GCC logistics operator, a successful cyberattack does not simply compromise data. It halts operations at one of the world's busiest trade corridors. For a financial institution, it triggers regulatory notification obligations, potential liquidity pressure, and reputational damage that takes years to recover from.

The World Economic Forum's Global Cybersecurity Outlook 2026 confirms that geopolitics is now the primary driver of cyber risk escalation globally, with 64% of organisations reporting exposure to geopolitically motivated attacks and 91% of the largest organisations changing their cybersecurity strategies as a direct result. For the GCC, which hosts critical energy infrastructure, global logistics hubs, and rapidly expanding financial centres, this convergence of geopolitical and cyber risk is not a future scenario. It is the present one.

In Saudi Arabia, the National Cybersecurity Authority reported that cybersecurity spending reached SAR 15.2 billion in 2024, contributing SAR 18.5 billion to GDP. But spending figures alone do not capture the full picture. The gap between headcount and skilled capability remains one of the GCC's most acute B2B pain points. Saudi Arabia had over 21,000 cybersecurity professionals as of 2024, yet organisations across the region consistently report that they have the tools but lack the trained personnel to interpret AI-driven telemetry, respond to alerts at speed, and manage incidents with the sophistication that modern attacks demand. Investment without talent is infrastructure without operators.

Five threat trends your board needs to understand

Akin Gump identifies five threat categories that are actively shaping the GCC's risk environment in 2026.

1. State-aligned and politically motivated attacks Sophisticated threat actors are targeting GCC organisations not for financial gain, but for disruption and intelligence. The March 2026 cyberattack on Stryker, in which devices were deliberately wiped and data destroyed, illustrates how state-aligned actors operate. The UAE Cyber Security Council has confirmed that a significant proportion of attacks against UAE entities have been carried out by state-sponsored advanced threat groups and hacktivist organisations, with 128 confirmed cyber threat incidents targeting UAE entities in the first months of 2026 alone.
2. Critical sector targeting Energy, utilities, financial services, and transport and logistics remain the highest-priority targets due to their systemic importance. Government administration and financial services accounted for 9.4% and 9.3% of all UAE cyberattacks respectively in the period reviewed. For B2B vendors supplying these sectors, the attack surface extends to include every third party in the supply chain. The broader vendor risk picture is well illustrated by the recent Trellix source code breach, which placed GCC enterprises using the platform under immediate review obligations.
3. Ransomware and data exfiltration Modern ransomware attacks are not simply about encryption and ransom demands. They involve data theft, extortion, and legal exposure simultaneously. Threat intelligence firm Cyble has documented intensifying ransomware-as-a-service activity targeting GCC nations throughout 2024 and 2025. Remote-work related cyber incidents have increased by over 40% in recent years as attackers pivot to targeting home environments alongside central systems.
4. Supply chain and third-party vulnerabilities GCC regulatory frameworks now treat supply chain risk as a formal compliance requirement, not an advisory concern. Saudi Arabia's NCA Cloud Cybersecurity Controls explicitly require risk assessments and compliance verification for all third-party providers. Bahrain's National Cyber Security Centre imposes detailed third-party risk management obligations including security clauses in contracts, outsourcing risk assessments, and ongoing compliance monitoring. For any B2B organisation supplying government-linked entities, a cyber addendum in every vendor contract is no longer optional. It is increasingly a procurement prerequisite.
5. AI-enabled attack sophistication Threat actors are using artificial intelligence to enhance phishing, credential harvesting, and attack scalability at speed and volume that human analysts cannot match. Deepfake-enabled voice and video impersonation is being used for payment fraud and business email compromise targeting senior executives. In the GCC specifically, attackers are deploying Arabic-language deepfakes and localised social engineering hooks, including fraudulent messages referencing Ramadan bonuses, Ministry of Interior fines, and government benefit disbursements. B2B security awareness training that is not linguistically and culturally adapted for Gulf audiences is leaving a significant gap.

Sovereign data: the compliance dimension your IT team may be underestimating

The advisory's focus on technical controls is necessary but incomplete without the data residency dimension. Regulators across the GCC, including the UAE's Telecommunications and Digital Government Regulatory Authority and Saudi Arabia's SDAIA, are increasingly strict about data leaving national borders. For organisations relying on global cloud infrastructure, this creates a compliance exposure that sits alongside the security risk. An audit of all SaaS vendors for local hosting options is not a future-state consideration. It is an immediate risk management action in 2026.

The insurance gap: coverage is not the only problem

Akin Gump flags "Acts of War" exclusion clauses in cyber insurance policies as a material concern as state-linked incidents increase. But the advisory understates a second dimension that GCC risk officers are actively managing: affordability. With 200,000 daily attacks targeting UAE infrastructure, cyber insurance premiums across the Gulf are under significant upward pressure in 2026. Businesses are not only asking whether their policy covers a given scenario. They are asking whether the premium is sustainable as the threat environment escalates. A review of cyber insurance coverage needs to include not just exclusions but renewal terms and coverage adequacy relative to the current risk profile.

The Vision 2030 procurement gate

For B2B vendors operating in or seeking to enter the Saudi market, there is a dimension of the cyber risk landscape that goes beyond incident management. NCA compliance has become a gatekeeper for procurement. Any vendor supplying government-linked entities, giga-projects including NEOM and the Red Sea Project, or regulated sectors in the Kingdom must now demonstrate cybersecurity maturity as a condition of doing business. Cybersecurity is no longer a differentiator in the Saudi procurement process. It is a baseline qualification.

The 2026 GCC cyber compliance action table

For C-suite and board-level readers, the following maps the most urgent action areas to their GCC-specific regulatory drivers.

Data residency sits at the top of the list for most regulated organisations. UAE TDRA and KSA SDAIA data protection regulations are tightening. The immediate action is a full audit of all SaaS and cloud vendors for local hosting options, with any cross-border data transfers flagged to legal counsel now, not at the next compliance cycle.

Third-party risk is the next most urgent area, driven by NCA Cloud Cybersecurity Controls in Saudi Arabia and Bahrain NCSC baseline controls. Every vendor and supplier contract should carry a cybersecurity addendum. Contracts coming up for renewal without one should not be renewed as-is.

Board liability is increasingly formalised across GCC jurisdictions. Bahrain's NCSC controls explicitly hold senior management accountable for the cybersecurity function, including approval authority over penetration testing scope. The recommended action is a cyber crisis simulation conducted at board level, not IT level, before the end of Q2 2026.

AI defence readiness demands a shift in tooling philosophy. The UAE CSC has confirmed that recent attacks used AI-developed offensive tools, and signature-based detection cannot keep pace with AI-generated malware variants. Organisations that have not yet moved to behavioural-based detection are running a known gap.

Workforce capability rounds out the most urgent areas. The regional gap between certified headcount and operational readiness is well documented. A skills audit mapped against current tooling is the starting point. Headcount numbers and capability levels are not the same metric, and treating them as interchangeable is one of the most common blind spots in GCC cyber risk assessments.

Immediate technical actions

Akin Gump's recommended immediate actions include enforcing multi-factor authentication across all critical systems, strengthening identity and access management controls, accelerating patch management and vulnerability remediation, implementing endpoint detection and response across all endpoints, and engaging specialised cybersecurity support where internal gaps exist. Each of these actions applies regardless of organisation size or sector. For GCC businesses, the question is not whether to implement them. It is whether they have already been delayed long enough to create measurable exposure.