The next frontier of digital trust – building secure, resilient ecosystems

Key findings

• AI is the defining cyber priority

75% of business and technology leaders in the Middle East rank AI among their top five cyber investment priorities, compared with 58% globally.

• AI data protection gap

71% identify data poisoning among the AI-enabled attacks they are least prepared for, but only 23% rank training data protection and integrity among their top five AI cybersecurity investments.

• Trust is setting the pace for AI autonomy

Only 20% of Middle East respondents would allow AI agents full execution autonomy without human approval, in line with 22% globally. Concerns about reliability and maturity are the leading barriers to greater autonomy, cited by 59% in the region versus 55% globally.

• Geopolitics is reshaping technology decisions

59% of Middle East respondents rank stronger threat intelligence, geopolitical monitoring and government or industry collaboration among their top three areas of cyber strategy in response to geopolitics, compared with 47% globally. 

• Investment needs to translate into operational resilience

74% of Middle East respondents expect cyber budgets to rise in 2027 (versus 84% globally), but only 34% have fully formalised and integrated operational continuity plans addressing cyber threats (versus 39% globally).

1. AI moves to the centre of the cyber agenda

Against growing geopolitical sensitivity and a complex threat landscape, AI is emerging as both a new source of cyber risk and a powerful defence tool. This creates two parallel priorities for Middle East organisations: securing AI, which implies securing AI systems, models and data while using AI to strengthen threat detection, response and broader cyber resilience.

Attacks targeting AI systems lead the region's cyber preparedness concerns, with 60% ranking them among the five cyber threats their organisation is least prepared to address, compared with 50% globally.

Third-party risk is another prominent theme, reflecting the region’s reliance on large-scale, vendor-dense transformation programmes and expanding technology ecosystems, which can increase exposure to suppliers, contractors and other external dependencies. Nearly half (48%) of Middle East business and technology leaders identified third-party breaches among the cyber threats their organisations are least prepared to address, compared with 34% globally. Cloud-related threats followed at 35%, slightly below the global figure of 40%.

The AI-specific readiness gap is clearest in data poisoning. A notable 71% of Middle East respondents identify it among the AI-enabled attacks they are least prepared to address, compared with 52% globally (see Figure 1). Yet only 23% rank training data protection and integrity among their top five AI cybersecurity investment priorities. The contrast raises an important question: are organisations directing AI security resources to the risks they find hardest to manage?

Adversarial attacks, which manipulate AI systems by altering their inputs, closely follow data poisoning, cited by 59% of Middle East respondents compared with 52% globally.

Figure 1: Top 5 AI-enabled attack risks

Q. Over the next 12 months, which of the following AI-enabled attacks is your organisation least prepared to address?

^{Percentages represent the proportion of respondents ranking each AI-enabled attack among the five threats.}

These concerns become significant as AI is embedded more deeply in business processes and connected to enterprise systems. Weaknesses in models, training data or access controls can have consequences beyond the AI system itself, increasing the importance of data integrity, model security and AI-specific threat detection as adoption expands.

The scale of AI investment creates an opportunity to address this mismatch. AI leads regional cyber investment priorities at 75%, against 58% globally, followed by cloud security at 60% versus 46% and data protection and data trust at 58% versus 39% (see Figure 2). The priority now is to turn cyber investment into targeted protection and stronger readiness as AI, cloud and data adoption accelerates.

Figure 2: Top five cyber investment priorities

Q. Which of the following investments are you prioritising when allocating your organisation’s cyber budget in the next 12 months?

_{Percentages represent respondents selecting each investment area among their top five priorities.}

AI is becoming part of the defence

Organisations are not only securing AI. They are putting it to work.

Threat detection and alerting is the most frequently selected priority for AI in cyber defence in both the Middle East and globally, at 50%. Regional respondents place greater emphasis on threat intelligence enrichment and malware analysis, both at 48%, compared with 40% and 39% globally (see Figure 3).

In the region, heightened geopolitical tensions are increasing operational and cyber risks, reinforcing the need for stronger monitoring, verification and crisis-response arrangements.^₁ These findings point to a broader regional shift: from reacting to individual incidents, to organisations building AI-enabled cyber capabilities that combine stronger threat intelligence, real-time visibility, governance and coordinated response. Such initiatives are underpinned by national visions and strict governance, such as the UAE’s National Strategy of Artificial Intelligence 2031^₂ and The National Cyber Security Policy for Artificial Intelligence,^₃ and the Saudi Vision 2030^₄ and National Cybersecurity Baseline (NCNICC).^₅ Egypt is approaching the issue from a similar direction, embedding AI governance and cybersecurity within its national AI strategy and linking secure AI adoption to digital sovereignty and national resilience.^₆

A gap, however, remains in AI-enabled cyber defence for the region. Just 23% of Middle East business and technology leaders prioritise AI for phishing detection and response, compared with 42% globally. This highlights an opportunity to strengthen AI-enabled defences against established human-targeted threats, alongside emerging attack vectors.

Figure 3: AI for cyber defence priorities

Q. In which areas is your organisation prioritising AI for cyber defence over the next 12 months?

_{Percentages represent respondents selecting each area among their top five priorities}

As AI takes on a greater role in detecting, analysing and responding to cyber threats, the next question is how much authority organisations are prepared to give it to act independently.

Only 20% of regional respondents would allow AI agents full execution autonomy, in line with 22% globally. Another 37% would permit autonomous execution of lower-risk actions, while an equal percentage would require human approval before execution. This indicates that as adoption grows, clear governance and decision boundaries will be just as important as the technology itself.

The emerging approach is bounded autonomy, with organisations prioritising actions such as malware removal and system remediation (53%), threat-intelligence enrichment (50%) and user account suspension or access revocation (43%). These applications can accelerate response while retaining tighter human oversight for higher-impact actions, including network segmentation and configuration changes.

Trust will set the pace of autonomy

Confidence in AI technology remains the main constraint on greater autonomy. Reliability and maturity concerns lead at 59%, followed by accountability, explainability and liability at 50% (see Figure 4). Adversarial manipulation (43%), regulatory or compliance constraints (42%) and skills gaps in AI oversight and governance (40%) reinforce the need for effective controls and oversight.

This suggests that organisations should adopt a risk-tiered autonomy model, increasing agent authority progressively as confidence, testing evidence and governance mature. Stronger controls around human oversight, explainability, adversarial testing, auditability and clear accountability will be essential to move from AI-assisted operations to a genuinely autonomous security response.

Figure 4: Barriers to increasing AI agent autonomy

Q. What is preventing your organisation from increasing AI agent autonomy for security operations?

This is a notable evolution from last year. The 2026 Digital Trust Insights: Middle East findings highlighted the practical challenges of AI adoption, with 53% citing a lack of knowledge in applying AI to cyber defence and 37% pointing to skills shortages.^₇ This year, the focus has advanced towards securing AI, strengthening accountability and defining the boundaries of autonomous action.

2. Geopolitical risk is reshaping technology and third-party resilience

Geopolitical volatility is changing the way Middle East organisations approach cyber resilience, bringing threat intelligence, technology concentration and critical supplier dependencies into sharper focus.

That challenge is particularly significant in the Gulf Cooperation Council (GCC), where a decade of rapid digital transformation has been driven by national strategies. Greater connectivity, cloud adoption and data intensity have created new opportunities for growth,^₈ but they have also increased exposure to cyber, infrastructure and geopolitical risk.

Regional priorities, therefore, differ from the global picture. Expanded threat intelligence, geopolitical monitoring and government or industry collaboration is the most frequently selected area of cyber strategy changing in response to geopolitics, ranked in the top three changes by 59% of Middle East respondents, compared with 47% globally, where it ranks third (see Figure 5).

Third-party and supply-chain risk management follows at 51%, while cyber insurance, incident response and crisis management rank third at 48%.

Figure 5: Areas where cyber strategy is changing in response to geopolitics

Q. Which of the following areas of your organisation’s cyber strategy, if any, are changing in response to the current geopolitical landscape over the next 12 months?

Resilience is moving into technology architecture

Geopolitical risk is increasingly shaping technology decisions across the Middle East. Some 60% of organisations are adopting multi-cloud or hybrid-cloud strategies to reduce concentration risk, 58% are strengthening in-country or regional data and technology redundancy and 48% are migrating workloads to sovereign or region-specific cloud providers (see Figure 6). These priorities reflect a growing focus on reducing geographic and vendor concentration while building greater flexibility into critical technology infrastructure.

Figure 6: Changes to the enterprise tech stack to address concentration risk

Q. What changes, if any, are you making to your organisation’s enterprise tech stack over the next 12 months to address concentration risk in response to the geopolitical landscape?

Our wider cloud research reinforces these priorities. Middle East findings from PwC’s EMEA Cloud Business Survey show that 51% of respondents already use or plan to adopt sovereign public cloud infrastructure, reflecting growing emphasis on control over critical workloads and infrastructure resilience.^₉

Geopolitical considerations are also shaping CEO-level decisions. Our 2026 Global CEO Survey: Middle East findings show that 32% of regional CEOs plan to reduce reliance on technology providers based in countries they consider less trustworthy, compared with 21% globally. This suggests that technology sourcing is becoming an increasingly important part of managing geopolitical exposure.^₁₀

Regional initiatives reinforce the focus. Abu Dhabi’s Government Digital Strategy 2025-2027 targets full sovereign cloud adoption^₁₁, supported by a unified government data centre and a disaster-recovery site in Al Ain.^₁₂ Qatar also announced an additional dedicated government cloud region in 2026 to strengthen redundancy and geographic resilience.^₁₃

While approaches differ, the underlying priority is the same: resilience depends on where critical technology and data sit, what they rely on, and what alternatives exist if disruption occurs.

Third-party dependency is becoming a resilience issue

Growing reliance on external technology providers is increasing operational dependencies. Almost half of Middle East respondents identify third-party breaches among the threats they are least prepared to address, compared with 34% globally.

The challenge extends beyond supplier security. When managing critical providers, 53% of organisations rank difficulty enforcing service-level agreements or meeting resilience outcomes among their top three challenges. The same proportion identify developing viable exit plans, while 44% cite limited visibility into vendor concentration risk.

Outsourcing provides specialist expertise but can deepen dependency as providers accumulate knowledge of critical systems and operations, making them harder to replace.

Operational responsibility can be outsourced. Accountability for resilience cannot. Traditional service-level agreements, therefore, need to be supported by evidence of recovery capabilities, visibility into critical dependencies, participation in disruption exercises and viable exit plans. These requirements must evolve as services and dependencies change.

Concentration risk can run deeper than the vendor list

Contractual security is the leading cyber supply-chain priority in the Middle East, cited by 48% of business and technology leaders compared with 39% globally (see Figure 7). This suggests a stronger focus on formal accountability with suppliers, particularly where organisations need greater clarity over security obligations, service continuity and responsibilities during disruption.

Visibility into third- and fourth-party dependencies also ranks higher at 43%, compared with 37% globally, indicating a growing need to understand not only direct suppliers, but also the wider ecosystem of subcontractors, technology platforms and service providers on which critical operations depend. In a more volatile operating environment, these dependencies can become important sources of concentration and continuity risk.

Supplier involvement in crisis response is another area of greater regional emphasis, at 35% versus 29% globally.

Figure 7: Top 5 changes to manage supply-chain cyber risk

Q. What changes, if any, will your organisation implement in the next 12 months to manage supply chain risk?

_{Percentages represent respondents selecting each measure among their top five.}

Continuous supplier monitoring, however, receives less attention in the Middle East at 37%, compared with 47% globally, as does software dependency risk management at 33%, against 39%. This highlights a potential gap between contractual assurance and ongoing oversight.

Cloud and managed services add complexity as responsibility for monitoring, incident response and recovery is shared across providers. Clear accountability and tested recovery arrangements are therefore essential.

Regional policy is reinforcing resilience and governance. Saudi Arabia’s Sumood Resilience Index assesses preparedness across risk, emergency and business continuity management^₁₄, while Oman’s 2026 Cloud First Policy links government cloud adoption to cybersecurity, data protection and risk-management requirements.^₁₅

For leaders, resilience means looking beyond individual providers to understand where critical dependencies converge, testing recovery and portability arrangements and building credible alternatives before disruption occurs. The ability to maintain operations when a critical dependency fails is becoming a defining test of technology resilience.

3. Cyber investment remains strong, but resilience depends on execution

Cyber budgets are rising, but the real measure of progress is whether they improve readiness. Our 2026 Global CEO Survey found that 57% of Middle East CEOs expect to significantly improve enterprise-wide cybersecurity over the next three years, compared with 47% globally.^₁₆ That ambition is reflected in near-term spending expectations, with 74% of respondents to our 2027 Global Digital Trust Insights survey anticipating cyber budget increases, including 33% expecting rises of 11% or more. Yet only 34% have fully formalised and integrated operational continuity plans addressing cyber threats. Investment momentum is clear; operational maturity must now catch up.

Investment is targeting emerging risks

The factors influencing cyber spending reflect the changing threat landscape. Securing against AI-enabled attacks is the leading regional driver at 56%, compared with 46% globally, followed by data protection and data trust (50%) and cyber infrastructure modernisation (43%).

Investment priorities reflect these pressures, with AI, cloud security and data protection leading regional cyber spending. Cyber managed services also feature prominently, cited by 45% of regional respondents compared with 31% globally, highlighting the role of specialist external capabilities in supporting cyber transformation.

A closer look at AI cybersecurity investment reveals a focus on securing the environments where AI operates. Platform hardening and firewall implementation and tuning are the most frequently selected AI cybersecurity investment priorities, each ranked among the top five by 45% of Middle East respondents, followed by access controls and authentication at 40%.

Operational continuity remains the critical test

The investment-readiness gap extends beyond AI. Only 34% of Middle East respondents have fully formalised and integrated continuity plans specifically addressing cyber threats, versus 39% globally (see Figure 8). Another 41% are developing formal plans, leaving almost a quarter with informal, minimal or no formalised approach. The priority is to test whether recovery works in practice, not simply to approve budgets or produce plans.

Figure 8: Approach to operational continuity planning

Q: Which of the following best describes your organisation’s approach to operational continuity planning in response to the current cyber threat landscape?

The gap matters because operational resilience is ultimately tested during disruption, not through investment or planning alone. Organisations need to identify the services most critical to their business, understand the technology and external dependencies supporting them and regularly test whether recovery arrangements can meet operational requirements.

Regional policy is reinforcing this focus. Oman’s IT Operations Continuity Policy, issued in April 2026, addresses business-impact analysis, recovery priorities and continuity responsibilities across government units.^₁₇ Bahrain’s National Cyber Security Strategy 2025-2028 also places resilience, incident response and collaboration among its strategic priorities.^₁₈

Turning cyber visibility into operational intelligence

Organisations across the region are increasing their visibility of cyber risk, but integrating risk information remains a challenge. Some 55% have implemented tailored cyber-risk dashboards, compared with 40% globally, while 49% map risks to critical business services, processes and assets (see Figure 9). Yet only 39% integrate cyber-risk data across tools and platforms, broadly in line with 38% globally.

Figure 9: Top five measures to improve cyber-risk data and decision-making

Q: To what extent has your organisation implemented any of the following measures to improve how cyber risk data is contextualised and incorporated into your analysis infrastructure for better decision making?

The distinction is important. Cyber reporting is becoming more business-focused, but connecting risk, asset, vulnerability, incident and third-party information remains the next challenge. A unified view can support faster decisions, targeted responses and a better understanding of potential business disruption.

Managed services can support this shift. AI leads regional managed security service priorities at 58%, followed by cloud security at 55% and threat management at 53%. Specialist capabilities can strengthen detection and response, provided they are integrated into wider resilience arrangements.

4. Stronger foundations need to reach business decisions

Middle East organisations are strengthening the data, governance and skills needed to support digital trust. The next challenge is ensuring these capabilities are embedded within cybersecurity teams, that Chief Information Security Officers (CISOs) can bring them together effectively and that they influence the business decisions shaping technology adoption, cyber exposure and resilience. To do this, organisations are increasingly expecting CISOs and cyber leaders to work across business functions and lines of defence, helping to align cybersecurity, privacy, resilience and AI governance objectives within a broader digital trust agenda. The role of the CISO is transforming into a Digital Trust Ambassador within organisations.

Data foundations are strengthening

Data classification and quality are showing encouraging progress across the region (Figure 10). Enterprise-wide data classification has risen from 39% in the 2026 findings to 57% in 2027, moving the Middle East ahead of the current global benchmark of 49%. Data quality has also increased from 30% to 46%, compared with 40% globally, reflecting greater attention to the reliability of data underpinning AI and advanced analytics.

Progress in technical protection is less consistent. Encryption, tokenisation and anonymisation stand at 39%, compared with 42% globally, while data discovery and cataloguing remain at 37%. As organisations manage increasingly complex environments across cloud, software as a service (SaaS) and AI platforms, gaps in discovery and protection can limit their ability to identify, monitor and secure sensitive information.

The challenge also extends to making enterprise data accessible for AI. Our 2026 Global CEO Survey found that only 22% of Middle East CEOs say their most-used AI tools have access to all relevant documents and data, compared with 29% globally. This reinforces the need to pair stronger data governance with trusted, appropriate access to the information required for AI to deliver value.^₁₉

Figure 10: Enterprise-wide implementation of data-risk measures

Q: To what extent has your organisation implemented any of the following measures to address data risk across the enterprise?

The next priority is to turn stronger data governance into consistent protection across the enterprise. Better discovery, lineage and technical safeguards will help organisations manage sensitive information as AI introduces new data flows and access requirements.

Cyber governance needs to influence decisions earlier

Stronger data foundations are only part of the picture. Their value also depends on whether cyber risk is understood and acted on at the right level of the organisation.

Some 42% of Middle East business and technology leaders strongly agree that executives understand their cybersecurity responsibilities, while 43% say their organisations regularly conduct realistic incident response exercises. Yet only 38% strongly agree that cyber risk is a standing item at executive leadership meetings, compared with 45% globally. More significantly, just 30% strongly agree that business decisions routinely trigger a cyber-risk assessment, against 34% globally.

There’s a gap between recognising cyber risk and acting on it early enough. Security needs to inform technology, sourcing, transformation and investment decisions before commitments are made, rather than assessing exposure afterwards.

AI governance provides a more encouraging signal. In the Middle East, 55% place primary accountability for AI governance and risk with either a chief AI officer or dedicated AI function (34%), or an AI board (21%), compared with a combined 33% globally. This points to more specialised oversight as AI adoption expands.

Figure 11: Primary accountability for AI governance and risk management

Q: Who has primary accountability for AI governance and AI risk management in your organisation?

Regional initiatives illustrate this emphasis on accountability. Abu Dhabi has established chief data and AI officer roles across government entities to oversee AI adoption and governance.^₂₀ Saudi Arabia's AI Ethics Principles also assign responsibility for AI ethics to entity heads or chief data officers, supported by designated compliance roles.^₂₁

No single governance model will suit every organisation. What matters is that accountability is explicit, decision rights are understood and oversight is embedded in the decisions that shape AI deployment.

Cyber talent is evolving alongside AI

Clear governance needs people with the skills and authority to put it into practice. As AI takes on more operational activity, cybersecurity teams will increasingly need to oversee autonomous systems, assess their outputs and intervene when human judgement is required.

The survey findings reflect the importance of developing and retaining these capabilities. Providing growth opportunities is the leading regional talent priority at 63%, followed by supporting a strong cyber culture (54%) and investing in AI-enabled tools and training (51%). Workload management and burnout also feature more prominently in the Middle East at 43%, compared with 36% globally.

Quantum readiness needs to move into implementation

The same need for forward-looking capability extends to emerging technologies. In the Middle East, 21% of organisations surveyed are implementing quantum-resistant security measures, matching the global result, while 31% are piloting and testing and 34% are exploring.

Among organisations that have begun exploring quantum-resistant measures, 41% are tracking and aligning with emerging post-quantum cryptography standards, compared with 33% globally. This points to strong regional awareness and strategic attention. However, progress is less advanced in areas such as dedicated ownership, vendor readiness and pilot implementation, while crypto-agility planning and cryptographic asset inventories remain broadly aligned with global peers.

Figure 12: Maturity of quantum-resistant security measures

Q. What are your organisation’s plans and current progress for the following quantum-related initiatives?

The Middle East remains closely aligned with global progress on quantum-resistant security, with an opportunity to build on existing momentum through clearer ownership, greater cryptographic visibility, vendor readiness and structured migration planning.

Stronger data, governance and skills provide the foundations for digital trust. Their real value emerges when they shape decisions across the business, helping organisations adopt new technologies securely, anticipate emerging risks and act with greater confidence.

Keeping pace when the target moves

The pace of technological change is redefining what digital trust requires. For Middle East organisations, the opportunity is not simply to strengthen cyber defences, but to build the resilience and adaptability needed to adopt new technologies, navigate disruption and sustain growth.

The next phase will favour organisations that can turn investment into operational capability, connect risk intelligence with business decisions and adapt security as technology evolves. Digital trust will be built not through individual initiatives, but through the ability to bring technology, people and risk together, enabling organisations to move forward with confidence.