GCC Cybersecurity — Weekly Market Intelligence Brief

Week of 28 June 2026 | Compiled by Team Paringa

A weekly digest of significant regulatory, technology, and market developments affecting enterprise cybersecurity across the UAE, Saudi Arabia, and Gulf region. For technology leaders, security teams, and boards in GCC regulated industries.

SECTION 1 — What Happened This Week

🔴 Saudi Arabia Retains World's #1 Cybersecurity Ranking for Third Consecutive Year (18 June 2026)

Saudi Arabia's National Cybersecurity Authority (NCA) confirmed on 18 June 2026 that the Kingdom has maintained first position in the global ranking of the IMD World Competitiveness Yearbook's cybersecurity index for the third consecutive year. The Kingdom was also classified as Tier 1 — "Role-Modelling" — in the Global Cybersecurity Index 2026, published by the International Telecommunication Union (ITU).

This is not merely a reputational milestone. The NCA's top ranking reflects a sustained investment programme in national cybersecurity infrastructure, workforce, and regulatory enforcement — and its most significant practical consequence for 2026 is the expansion of mandatory NCA compliance frameworks to all private-sector organisations in Saudi Arabia for the first time.

The Extended Cybersecurity Controls (ECC 2:2024), now in effect, reach every private-sector company in the Kingdom. All cybersecurity roles must now be held by qualified Saudi nationals. Compliance verification applies to organisations of all sizes.

For enterprises operating in Saudi Arabia, this is a structural change in the compliance environment. Organisations that have treated NCA compliance as a government-sector concern need to reassess that position.

Sources: Saudi Press Agency — Saudi Arabia Maintains Leadership in Global Cybersecurity Ranking | NCA — Saudi Arabia Maintains its Leadership in Global Cybersecurity Index | Arab News — Saudi Arabia maintains leading cybersecurity ranking for third consecutive year

The NCA's mandatory expansion to private-sector organisations is the most significant compliance change in Saudi Arabia's cybersecurity landscape since the original ECC framework in 2018. The practical starting point for most organisations is a structured assessment of their current cybersecurity posture against the ECC 2:2024 controls — understanding where you stand before the NCA asks. Organisations that approach this proactively are significantly better positioned for compliance and for the commercial conversations with clients who will increasingly ask for NCA compliance evidence from their supply chains.

🔴 UAE Sustains 800,000 Daily Cyberattacks — GCC Threat Volumes Remain Elevated

The UAE Cybersecurity Council has confirmed that since the escalation of regional tensions in early 2026, daily cyberattack volumes have surged from a baseline of 90,000–200,000 to a sustained level of 600,000–800,000 daily breach attempts. The UAE is absorbing approximately 15 times normal attack volume; Saudi Arabia, 25 times normal.

The UAE Council has identified at least 350 organised threat groups and 320 independent hackers as actively targeting UAE infrastructure. Financial services, government administration, banking, and telecoms account for the highest proportions of targeted attacks. The character of attacks has shifted from denial-of-service demonstrations toward intrusion attempts, credential theft, and data compromise — a more serious category of threat with greater potential for sustained damage.

The Head of the UAE Cybersecurity Council, Dr Mohamed Al Kuwaiti, has described the threat as including state-sponsored advanced persistent threat groups alongside hacktivist collectives and organised cybercriminals.

For GCC organisations in financial services, energy, logistics, and government supply chains, this is not a temporary spike. The threat intelligence indicates a sustained period of elevated risk.

Sources: Gulf News — UAE faces 800,000 cyberattacks daily despite lull | Akin Gump — Safeguarding Data During Uncertain Times: Cybersecurity Priorities for the GCC

The most consistent finding across Akin Gump's April 2026 GCC cybersecurity advisory, the UAE Cybersecurity Council's own disclosures, and the WEF's 2026 Global Cybersecurity Outlook is the same: governance gaps — not tool gaps — are what make organisations vulnerable at scale. Board-level accountability for cyber risk, documented incident response frameworks, and third-party risk management are the controls that the UAE Cybersecurity Council and NCA are both emphasising. If your organisation has invested in security technology but hasn't formalised its governance framework, that is the gap to close first.

🟡 FortiBleed Campaign: 86,000+ Fortinet Devices Compromised — GCC Enterprises Should Act Now

Crowe UAE's Cybersecurity Bulletin published on 22 June 2026 flagged an active global threat campaign — "FortiBleed" — which has reportedly compromised credentials from over 86,000 Fortinet devices globally. Fortinet equipment is widely deployed across UAE and Saudi enterprise, government, and financial services environments.

The same bulletin identified multiple high-risk remote code execution (RCE) vulnerabilities in Oracle enterprise systems and a critical OS command injection vulnerability in the Splunk AI Toolkit — both tools with significant deployment across GCC banking and government infrastructure. Cisco Identity Services Engine (ISE) vulnerabilities were also flagged, alongside a supply chain attack against Klue that impacted multiple cybersecurity firms.

For organisations running Fortinet security appliances or Oracle and Splunk platforms, the recommended immediate actions are: credential rotation for all administrative accounts on affected systems, urgent patch verification and remediation for the Oracle and Splunk vulnerabilities, and heightened monitoring for signs of lateral movement.

Sources: Crowe UAE — Cybersecurity Bulletin (15–21 June 2026)

🟡 GCC Identity Security: Credential Theft Has Replaced the Network Perimeter as the Primary Attack Surface

Gulf Business published a feature drawing on the views of six regional cybersecurity leaders. The consensus: credential theft has become the dominant attack vector across GCC organisations, displacing network perimeter breach as the primary point of failure.

Three compounding factors are driving this: AI-generated phishing at scale, which can bypass traditional security awareness training; the proliferation of machine identities — service accounts, API keys, and bot credentials — which are often inadequately managed; and legacy password infrastructure that remains in production despite its known weaknesses.

The regional security leaders are unanimous: organisations in the GCC are not being "hacked in" in the traditional sense — they are being "logged in" through compromised legitimate credentials. Microsoft's June 2026 Entra updates, which extended phishing-resistant MFA and passkey support to GCC environments, reflect the same direction of travel at the infrastructure level.

For GCC organisations, the implication is a shift in where security investment needs to be prioritised: identity and access management, machine identity governance, and MFA enforcement are more important than perimeter defences for the current threat environment.

Sources: Gulf Business — The end of the password? GCC cybersecurity leaders sound the alarm on identity's new frontline

SECTION 2 — The GCC Cybersecurity Landscape

UAE Government OT/ICS Strategy: National Capability Building at Scale

The UAE Cybersecurity Council has been investing at scale in operational technology (OT) and industrial control systems (ICS) security capability. Through partnerships established in May 2026 with Dragos (an OT Cybersecurity Centre of Excellence under the Make it in the Emirates initiative) and Nozomi Networks (an OT and IoT security collaboration), the UAE is building national practitioner capability in defending critical energy, utilities, transport, and manufacturing infrastructure.

The Head of the UAE Cybersecurity Council, Dr Al Kuwaiti, framed the rationale directly: "Industrial and critical infrastructure in the UAE and the broader Gulf region faces real and growing threats, and the same threat groups we track globally are active here."

Threat intelligence on the 2026 regional conflict confirms that Iranian-affiliated actors — including OilRig, MuddyWater, and CyberAv3ngers — have been actively targeting Gulf OT environments, including PLCs and SCADA systems in energy and utilities sectors.

For enterprises operating industrial, energy, or critical infrastructure in the GCC, the government's OT investment programme is the clearest signal of where the national threat assessment is pointing.

Sources: Industrial Cyber — Dragos, UAE Cyber Security Council launch OT cybersecurity Centre of Excellence | CloudSEK — ICS/OT Targeting in the 2026 Iran-US Conflict

The UAE Cybersecurity Council's investment in OT/ICS capability — alongside the NCA's expanded mandatory compliance framework in Saudi Arabia — points to a GCC security environment where critical infrastructure protection is becoming as regulated as financial services. Organisations in energy, utilities, transport, and manufacturing that have historically treated OT security as operationally separate from their enterprise IT governance now face a more unified regulatory expectation. The governance architecture that addresses both is not more complex — it is simply one that maps controls to risk at the system level rather than the network boundary.

Three Things Worth Watching

1. NCA mandatory compliance expansion enforcement timeline — Saudi Arabia's NCA has extended its mandatory cybersecurity controls to all private-sector organisations for the first time. Watch for the NCA's first public enforcement actions under the expanded regime and sector-specific guidance on compliance timelines for smaller organisations.

2. UAE Cybersecurity Council's response to the elevated threat environment — With attack volumes sustained at 15x normal and 350+ organised threat groups confirmed targeting UAE infrastructure, watch for the Council to publish updated national threat advisories or sector-specific guidance. Any such guidance will create immediate compliance demand for UAE enterprises.

3. UAE CBUAE AI Governance deadline — 79 days remaining — The CBUAE's September 16, 2026 deadline for licensed financial institutions to establish documented AI governance frameworks is approaching. This remains the most time-sensitive compliance deadline in the UAE financial sector. Institutions that have not yet started formal AI governance work are in the most compressed timeframe.

Questions about GCC cybersecurity compliance, NCA requirements, or the UAE threat environment?

hello@paringa.ai

Paringa specialises in AI governance, data privacy, and security for enterprise organisations, including those operating across the UAE, Saudi Arabia, and Gulf markets. We work with regional partners to help enterprises navigate GCC cybersecurity frameworks, the NCA's Extended Cybersecurity Controls, and the UAE regulatory environment. If this brief connects to a challenge you're working through, we'd be glad to have a conversation.