2,197 Attacks a Week: UAE Attack Volumes Held High All Through H1 2026, and AI Is Now the Force Multiplier

Week of 3 August 2026 | Compiled by Team Paringa

Two data sets landed in the last ten days that should change how GCC security budgets are argued. Attack volume is now sustained rather than spiky, and AI has measurably improved the attacks that lead to ransomware.

SECTION 1 - What Happened This Week

🔴 UAE organisations averaged 2,197 weekly attacks in H1 2026, with no quiet month

Check Point published its first-half 2026 numbers for the UAE on 30 July. Between January and June, UAE organisations experienced an average of 2,197 cyber attacks per organisation every week. January recorded 1,966, February 2,277, March 2,217, April 2,392, May 2,198 and June 2,135. Every single month posted double-digit year-on-year growth, peaking at 35 per cent in February and holding at 11 per cent even in the quietest month.

Ram Narayanan, Check Point's Middle East country manager, made the point that matters more than the April peak: five of the six months recorded more than 2,100 weekly attacks per organisation. A quieter month is campaign reorganisation, not reduced risk. The global picture tracked the same shape, rising from 2,090 weekly attacks in January to 2,270 in June, the highest level of the half-year.

Ransomware kept pace. Publicly reported incidents hit 707 globally in April, May grew 48 per cent year on year and June remained 33 per cent higher than the prior year. The ecosystem also rotated mid-period, with Qilin dominant for much of the half before The Gentlemen took the leading position in June. That churn is the operational lesson. Ransomware pressure does not fall when a group is disrupted, because a replacement operator absorbs the capability within weeks.

Generative AI added a second exposure surface. Across H1, organisations worldwide were regularly running between seven and eleven GenAI platforms per month, and between one in every 25 and one in every 31 prompts submitted from enterprise environments carried a high risk of exposing sensitive information. Customer data, financial records, internal documents and source code were all in scope. No attacker is required for that loss to happen.

Check Point researchers also observed cyber activity targeting exposed internet-connected devices in the region, including surveillance infrastructure, alongside campaigns aimed at cloud environments and organisational accounts, as Middle East tensions rose. Manufacturing, government, energy and utilities, financial services and healthcare stayed under the heaviest pressure globally.

Sources: Security MEA

Stop presenting attack volume as a threat statistic and start presenting it as a capacity problem. At 2,197 events per organisation per week with no seasonal relief, a business-hours SOC and a patch cycle measured in months are structurally inadequate, and no board approves the fix on a scary number alone. The specific gap most GCC enterprises have is exposure management, meaning a continuously updated view of internet-facing assets, cloud accounts and third-party access rather than an annual scan. One in 25 enterprise prompts leaking sensitive data is the number to take to your CFO, because it is a loss event with no adversary and no incident report attached to it.

🟡 83 per cent of UAE ransomware victims say AI made the attack more effective, and 81 per cent paid

Proofpoint's 2026 AI-Era Ransomware Report, released on 23 July, surveyed 953 cybersecurity professionals across 12 countries including the UAE, all from organisations that had experienced a ransomware attack. UAE respondents reported the highest rate of AI-enhanced attack effectiveness in the study. Thirty-six per cent said AI significantly increased effectiveness and another 47 per cent said it somewhat increased it, giving a combined 83 per cent. Only 9 per cent found no evidence of AI use.

The entry vectors were overwhelmingly human. Phishing and email-based social engineering was the initial vector in 30 per cent of incidents. Malicious attachments were the most common initial threat at 57 per cent, followed by QR code phishing at 55 per cent and telephone-oriented attack delivery at 45 per cent. When asked why controls were bypassed, 36 per cent said employees did not suspect the attack because it appeared authentic and 30 per cent attributed it to users interacting with malicious content.

The payment data is the part to take to a board. Eighty-one per cent of affected UAE organisations paid a ransom, and 47 per cent of those that paid faced a second extortion demand. Eighty-three per cent confirmed data was stolen during the incident. Encryption is no longer the endgame. Attackers are acquiring data, identities and persistent access, then monetising them repeatedly.

The findings land against escalating warnings from the UAE Cyber Security Council, which confirmed on 3 July that the national cybersecurity ecosystem had contained a wave of sophisticated attacks on the financial sector delivered through advanced phishing campaigns, vulnerability exploitation and malicious software, with attackers using AI to develop more advanced techniques. The Council has reported that daily attack attempts on the country's digital infrastructure have roughly tripled this year to more than 600,000 amid heightened regional tensions.

Sources: Security MEA | The National | Gulf News

An 81 per cent payment rate with a 47 per cent re-extortion rate is a governance failure, not a technology one. It means incident response plans in this region are still written around restoring encrypted systems rather than around a data theft that has already happened, and the money is being spent at the worst possible moment for the worst possible reason. The controls that move these numbers are unglamorous: phishing-resistant authentication so stolen credentials cannot be replayed, egress and data movement monitoring so exfiltration is detected before the demand arrives, and a tested decision framework agreed with the board and legal counsel long before an incident. QR phishing at 55 per cent and voice-based delivery at 45 per cent also mean email gateway controls alone are covering less than half the problem.

🟡 82 per cent fear AI risk, 13 per cent have already been hit through it, and shadow AI is the vector

Kaspersky published a global study on 30 July covering 1,800 IT and cybersecurity decision-makers across 18 countries. Eighty-two per cent voiced concerns about the risks AI poses to their organisation. Among the 87 per cent that faced a cyber incident in the past year, 13 per cent reported threats stemming specifically from AI-related vulnerabilities. Seventy-four per cent believe those risks can be mitigated through responsible employee behaviour.

Adoption is not slowing to accommodate the concern. Sixty-eight per cent would recommend a solution with AI features built in and only 5 per cent would prefer to avoid AI-enabled tools. Employees are already using AI for data analysis and visualisation (54 per cent), project management (49 per cent), information search (47 per cent), department-specific tasks (46 per cent) and text generation (41 per cent).

Brandon Muller, Kaspersky's senior security consultant for META, named the specific threat classes now in play: malware camouflaged as popular AI tools, vulnerabilities introduced through insecure vibecoding, leaked access credentials to corporate AI platforms and malicious skills invoked by AI agents. Shadow IT monitoring is the control he calls out, because employees are adopting third-party AI tools without the security team's knowledge.

In parallel, the UAE is formalising who can be trusted to deliver AI. Help AG was awarded Dubai AI Seal Tier E certification on 30 July under the Dubai Centre for Artificial Intelligence's government-led verification programme, which exists to help national entities identify credible partners for AI initiatives.

Sources: Security MEA | Security MEA

Thirteen per cent of incidents now traced to AI-related vulnerabilities is the number that ends the "AI risk is theoretical" argument in a GCC steering committee. The practical starting point is discovery, because you cannot govern the AI tools you have not found, and a policy that nobody can enforce technically is worth nothing. Credential exposure to corporate AI platforms deserves particular attention, since it converts an AI governance issue into a straightforward identity compromise. Expect government-backed AI assurance marks such as the Dubai AI Seal to start appearing in tender requirements for security and integration work in the UAE.

SECTION 2 - What UAE and Saudi CISOs Are Dealing With

The threat model has broadened past financially motivated crime. Regional tensions in H1 2026 pushed campaigns aimed at intelligence gathering, disruption and strategic influence into the same environments that handle ordinary cybercrime, and Check Point's researchers logged activity against exposed internet-connected devices including surveillance infrastructure. Help AG's State of the Market Report 2026 put numbers on the compression: DDoS incidents rose roughly 857 per cent between 2019 and 2025, with over 371,000 recorded last year, and some incidents in the region now reach operational impact in under 40 hours. GCC organisations are responding by embedding sovereignty and locally governed infrastructure into design decisions rather than treating them as a procurement preference.

The OT side is where the exposure concentrates for Gulf critical infrastructure. The UAE Cyber Security Council has built out public-private capability through a Dragos-backed OT Cybersecurity Centre of Excellence and a Nozomi Networks alliance covering energy, utilities, transportation, manufacturing and smart infrastructure, with Mohamed Al Kuwaiti describing the context as an unprecedented surge in attacks on critical infrastructure. In Saudi Arabia, the NCA's Operational Technology Cybersecurity Controls sit on top of the Essential Cybersecurity Controls for any entity owning, operating or hosting critical national infrastructure. Compliance evidence, not intent, is what gets inspected.

Three Things Worth Watching Next Week

1. Whether Q3 attack volumes break the H1 pattern - Check Point's data showed five of six months above 2,100 weekly attacks per UAE organisation. A July or August figure below that range would be the first genuine sign of pressure easing, and it should be read sceptically.

2. The Gentlemen's operational tempo - The group displaced Qilin at the top of the ransomware ecosystem in June. Watch victim disclosure rates and any GCC-sector concentration in their leak-site postings.

3. UAE Cyber Security Council advisories on financial services - The Council's 3 July statement flagged AI-assisted phishing and vulnerability exploitation against the financial sector. Any follow-up advisory will indicate whether that campaign wave is still active.

Questions? hello@paringa.ai

Paringa is an Infrastructure and AI Security, Cost and Governance specialist working through a regional partner network across the UAE, Saudi Arabia and Europe. We help security leaders find where exposure actually sits across cloud, identity, OT and AI systems, then put managed protection around it. | 3 August 2026 | © Paringa Ltd