UAE Reports 800,000 Daily Cyberattack Attempts

The UAE Cyber Security Council reported more than 800,000 attempted cyberattacks a day, while security executives warned that autonomous AI agents can open new paths for criminals when organizations deploy them without adequate governance. The Council logged 128 confirmed incidents involving ransomware, data leaks and website defacement.

Attack attempts have climbed sharply. Daily breach attempts on UAE infrastructure ranged from 90,000 to 200,000 early in the year, then rose past 800,000, according to the Council. Positive Technologies put the UAE’s share at 35 per cent of attacks in the region.

The UAE’s Cyber Threat

Dr Mohamed Al Kuwaiti, head of the Council, said, “AI has accelerated the cyber attacks dramatically.” Global losses from cyberattacks reached $10.5 trillion, or Dh38.6 trillion, in 2024. Forecasts put the figure at $15.6 trillion, or Dh57.3 trillion, by 2029.

Security executives said autonomous AI agents make decisions, access data and operate across company systems with little human oversight. Salah Suleiman, Managing Director, South Gulf at TrendAI, said agentic AI changes how attackers and companies operate. “Every agent becomes a new identity, entry point, and target,” he said, adding that criminals use AI to launch “faster, more convincing, and scalable attacks.”

TrendAI Vision One uses four principles—visibility, intent, control and oversight—and a dedicated AI security layer to govern models and agents. “Securing agentic AI from the outset is essential to building trust,” Suleiman said.

Alexandre Depret-Bixio, SVP, International at Anomali, asked, “What do we allow machines to decide?” He said data quality is central: “If you can’t trust your data, you can’t trust the decisions AI agents make on your behalf.” He described the resulting risk as “confident but bad decisions,” calling it an untenable cybersecurity risk.

Autonomous Systems and Oversight

DXC research cited by Daniel Churches, Director Cybersecurity, Asia Pacific and Japan at DXC Technology, found that only 47 per cent of organisations have fully integrated governance for agentic AI, even as many deploy autonomous tools. “Organisations are effectively scaling risk as fast as they’re scaling capability,” Churches said. He called for a shift from reactive defence to “intelligent, proactive and increasingly autonomous security.”

Depret-Bixio urged a gradual approach to autonomy. “Autonomy earns trust one governed decision at a time, with human approval and audit where it matters,” he said.

Justin Henkel, CISO at SolarWinds, called machine identities an “enterprise control problem,” rather than an “identity access management (IAM) cleanup exercise.” He said each automated actor needs “a defined purpose, bounded authority, trustworthy provenance, observable behaviour and a tested path to revocation.”

Henkel said leaders should track privilege reduction, owner coverage, credential lifetime, provenance of sensitive actions, stale identity removal and time to revoke. “This is a measurable operating discipline, not a one-time compliance project,” he said.

AI Governance at Public Institutions

Artificial intelligence also featured prominently at the 2026 IMF and World Bank Annual Meetings in Bangkok, where discussions covered economic growth, employment and financial stability. Igor Ujhazi, Global Regulatory Technology Specialist and author of the Times of Israel blog post, attended as head of a firm working across public digital systems, regulation and market access. He said AI’s rapid development had outpaced the legal and administrative foundations needed to govern it.

Public administrations see potential for faster services, improved fraud detection and more careful use of limited resources, Ujhazi said, but they remain uncertain about authority, responsibility and remedies. He described deferred projects, uncoordinated pilot schemes and tools used without proper oversight. Civil servants may be unsure what they can approve, he wrote, while citizens may not know who is accountable when an automated decision goes wrong.

Ujhazi said safeguards should specify who may introduce a system, which decisions require human review, how performance is assessed and how people harmed by errors can seek correction. He also identified privacy, cybersecurity, data retention, vendor access and documentation for independent examination as issues the law should cover.

The report said attackers already use AI at scale and warned that organizations deploying agents faster than they govern them can create new openings for criminals. Depret-Bixio said, “The near-term future of AI will be judged by whether we can stand behind every decision it makes.”