Today's Edition
ISIDORA CIRIC (ABU DHABI)
Material data loss among UAE organisations fell from 77% to 50% over the past year, putting the country below the 53% global rate, according to Proofpoint’s 2026 Voice of the CISO report.
The UAE recorded a 27 percentage-point decline – roughly twice the fall recorded worldwide.
Proofpoint's 2026 Voice of the CISO report surveyed 1,600 chief information security officers (CISOs) across 16 markets, including 100 in the UAE. Censuswide conducted the survey between May 11 and 18 among organisations with at least 1,000 employees.
The improvement extends to expectations of a material cyberattack over the coming 12 months, which fell from 69% to 49% among UAE CISOs, compared with a global rate of 61%. The share saying their organisation is unprepared to cope with a targeted attack stands at 40%, well below the 56% recorded worldwide.
When asked which workplace technologies were introducing the most risk, UAE respondents placed Microsoft 365 and public GenAI tools joint first, at 36% each, followed by Active Directory and identity infrastructure at 35%. SaaS applications, third-party integrations, APIs and automation tools were also among the main areas of concern.
Human risk has become a bigger concern inside UAE organisations even as those incident measures improve, with 73% of CISOs identifying it as their biggest cyber vulnerability, up from 57% last year.
Among organisations that experienced material data loss, careless insiders and malicious or criminal insiders were each cited by 52%, as were lost or stolen devices. Misuse or misconfiguration of artificial intelligence tools, meanwhile, was cited by 46%.
Departing employees played a role in 90% of UAE organisations that suffered material data loss. For companies that did lose sensitive information, the consequences were often commercial. Customer loss affected 52% of UAE organisations with a material data loss incident, while 50% suffered reputational damage.
Regulatory sanctions rose from 36% to 46% year on year, and financial losses doubled from 22% to 46%, although post-attack recovery costs fell from 47% to 34%.
UAE CISOs also report high levels of control over the environments they manage. Eighty-four percent say they have continuous visibility and control over sensitive data across cloud, collaboration tools, endpoints and AI systems, while the same share says data, identity and AI governance are strategic priorities.
AI is also taking up more of the UAE CISO agenda, with 73% now viewing generative AI as a security risk, up 19 percentage points from 2025. Yet 86% say enabling safe use of AI assistants, copilots and automation is a top priority over the next two years, slightly above the 85% global figure.
While 85% say their organisations provide adequate resources to meet cybersecurity goals, three quarters expect to manage AI-related risks without a proportional increase in resources or expertise.
Although 83% believe their controls can effectively mitigate risks introduced by AI, software as a service and modern work patterns, 70% expect employees to use AI in ways that could expose sensitive data, 75% are concerned about customer data leaking through public GenAI tools and 69% block or restrict employee GenAI use.
Board relations have improved at the same time, with 81% of UAE CISOs saying they see eye to eye with their boards on cybersecurity, up from 57% in 2025. Yet 75% say excessive expectations are placed on the role, while 84% believe cybersecurity expertise should be required at board director level.
"The findings make clear that continued progress will depend on security strategies evolving alongside where both work and risk are headed," said Patrick Joyce, Global Resident CISO at Proofpoint.
