AI Racing Ahead of Rules as UAE Faces 800,000 Attacks

The UAE Cyber Security Council reported more than 800,000 attempted cyberattacks a day, up sharply from the 90,000 to 200,000 range early in the year. Those figures framed a week dominated by artificial intelligence discussions at the 2026 IMF and World Bank Annual Meetings in Bangkok, where security experts warned that the same technology is giving attackers new tools.

The Security Picture

The Council logged 128 confirmed incidents involving ransomware, data leaks and website defacement. Positive Technologies put the UAE's share at 35 per cent of attacks in the region. Dr Mohamed Al Kuwaiti, who heads the Council, didn't mince words: "AI has accelerated the cyber attacks dramatically." Cyberattacks caused global losses of $10.5 trillion, or Dh38.6 trillion, in 2024; forecasts put the figure at $15.6 trillion, or Dh57.3 trillion, by 2029.

Security executives pointed to a newer problem. Autonomous AI agents make decisions, access data and operate across company systems with little human oversight. Salah Suleiman, Managing Director, South Gulf at TrendAI, put it plainly: "Every agent becomes a new identity, entry point, and target." He added that criminals use AI to launch "faster, more convincing, and scalable attacks."

Rules Before Machines

Igor Ujhazi, Global Regulatory Technology Specialist, attended the Bangkok meetings and argued that the technology has outrun the legal and administrative foundations needed to govern it. He said rules must specify who may introduce a system, which decisions require human review, how performance is assessed and how people harmed by errors can seek correction. Privacy, cybersecurity, data retention and vendor access, he wrote, should all fall under the law. International principles, in his view, can't substitute for operational rules suited to each country's institutions.

Security executives made a similar case from the technical side. Daniel Churches, Director Cybersecurity, Asia Pacific and Japan at DXC Technology, cited research showing that only 47 per cent of organisations have fully integrated governance for agentic AI. "Organisations are effectively scaling risk as fast as they're scaling capability," he said. Alexandre Depret-Bixio, SVP, International at Anomali, posed the question boards now face: "What do we allow machines to decide?"

The Public Sector Dilemma

Ujhazi described public administrations that see real promise in faster services and better fraud detection, yet remain unsure about authority and responsibility. Deferred projects and uncoordinated pilot schemes, he said, signal a warning. Civil servants may not know what they can approve, and citizens may not know who answers when an automated decision goes wrong. Justin Henkel, CISO at SolarWinds, called machine identities an "enterprise control problem" and said each automated actor needs "a defined purpose, bounded authority, trustworthy provenance, observable behaviour and a tested path to revocation."

Ujhazi also warned about the fiscal side. The Fund's financial stability report cautioned that optimistic assumptions about returns could trigger abrupt market corrections, while concentrated exposure could spread a correction well beyond its starting point. Governments that invest little directly in these systems could still feel the effects through tax receipts, pension holdings and borrowing costs.

Why This Matters:

The risk sits in the gap between how fast these systems are deployed and how clearly they're governed. The UAE's cyber figures show attackers aren't waiting for institutions to catch up, and the Council's own chief has said AI is speeding them along. From a center-right standpoint, that argues for clear legal mandates, named accountability and tested recovery plans before automated tools take on consequential public functions. Strong institutions and enforceable rules let a country adopt new technology without handing its critical systems to tools no one is accountable for. When that foundation is missing, the costs of a failure—whether a breach, a faulty decision or a market correction—land on taxpayers and citizens who had no say in the risk being taken.