640,000 Attacks a Day, a $5 Million Ransom and a Four-Hour Reporting Clock: GISEC Week Resets the Gulf CISO Agenda

Week of 21 September 2026 | Compiled by Team Paringa

Weekly intelligence for CISOs and IT leaders across the UAE, Saudi Arabia and the wider GCC. This week: the UAE Cyber Security Council puts numbers on the threat during GISEC Global, two new reports quantify the ransomware and state-actor surge against the Gulf, and the Central Bank of the UAE turns cyber resilience into an enforceable regulation with a four-hour incident clock.

What Happened This Week

🔴 UAE Cyber Security Council: 640,000 attacks in one day, a $5 million ransom demand, and a new national threat-intelligence partnership

Speaking at the Arab Media Summit on 15 September and then at GISEC Global, Dr Mohamed Al Kuwaiti, Head of the UAE Cyber Security Council, said the country recorded 640,000 cyberattacks in a single day. The National reported earlier this year that daily hacking attempts had risen to around 800,000 since the outbreak of the regional conflict, up from as many as 200,000 before it, and the Council has in recent months reported thwarting organised attacks on aviation, energy and education, and containing sophisticated attacks against the financial sector.

The detail that should concern every CISO is the case study. Al Kuwaiti described a private-sector organisation where an attacker exploited an unpatched vulnerability, claimed access to its systems, destroyed data and demanded more than $5 million, threatening to publish. Government and private-sector cooperation, with international coordination, contained the attack, but the attacker still published some of the stolen information on the dark web. Al Kuwaiti also warned that threats now extend across electricity, water and operational technology, and that a "lone wolf" with AI tools can now create significant impact.

On 17 September the Council signed a memorandum of understanding with threat-intelligence firm Cyble, formalising delivery of early-warning capability and actionable intelligence on threats to government and critical-infrastructure entities. Al Kuwaiti framed it as part of building "strategic partnerships with world-class technology providers" for intelligence-led defence. GISEC itself, hosted by the Council at Dubai Exhibition Centre from 16 to 18 September, drew more than 25,000 professionals, 750 brands and participants from 182 countries, with post-quantum cryptography migration and security-by-design for smart cities named by Al Kuwaiti as national priorities.

Sources: Khaleej Times, The National, TechAfrica News, Gulf News

The $5 million case is the whole GCC threat picture in one paragraph: a known vulnerability, an internet-facing system, no detection until the extortion note, and a partial leak despite a good national response. Nothing about it required a nation-state. If your organisation cannot say today which internet-facing systems are unpatched against actively exploited CVEs, that is the first thing to fix, ahead of any new tooling. The second is detection that runs 24/7 with someone accountable for the alert at 3am. For most mid-sized UAE and Saudi organisations that is a managed detection and response contract, not a new headcount plan. Ask your provider how they would have seen this attacker before the ransom note.

🟡 Two new reports quantify the surge: ransomware up 20-fold, UAE takes 35 per cent of Gulf attacks

CloudSEK's regional threat report, covered by The National on 16 September, tracked ransomware activity across the Middle East rising from 17 incidents in April 2025 to 357 in June 2026. Threat researcher Anirudh Batra said the Gulf "was, until recently, not a primary ransomware target" and that this "changed in 2025, and it changed fast". Groups including The Gentlemen built databases of compromised network devices and repeatedly attacked Saudi businesses; Nova kept the Gulf as a focus throughout the 17-month period. Unpatched firewalls and VPN gateways remain the common entry point. The report also documents state-linked activity: China-linked groups exploiting network equipment to reach government, telecom and healthcare organisations, and Iran-linked MuddyWater using Google's Gemini to help build attack tools. Tenable's Gavin Millard summarised the defensive posture bluntly: "Compliance is not security."

Positive Technologies, presenting at GISEC and reported by Khaleej Times on 18 September, found the UAE and Saudi Arabia accounted for half of all Gulf cyberattacks in H1 2026, with the UAE the most targeted country at 35 per cent, Iran at 17 per cent and Saudi Arabia at 15 per cent. Ninety-six per cent of H1 incidents fell in Q1, coinciding with the peak of the regional conflict. Government was the most targeted sector at 27 per cent of successful attacks; industrial was third at 17 per cent, half of those in Saudi Arabia. Vulnerability exploitation was the primary vector in 38 per cent of incidents, attributed in part to reliance on legacy SCADA systems, followed by malware at 31 per cent and social engineering at 27 per cent.

Sources: The National, Khaleej Times

Two independent datasets, one conclusion: the entry point is still the edge device and the unpatched service, and the Gulf is now a committed market for organised ransomware crews rather than an occasional target. Boards will read the 35 per cent figure; CISOs should read the 38 per cent vulnerability-exploitation figure and the note about legacy SCADA. For manufacturers, utilities and healthcare groups in Saudi Arabia, the exposure is the OT estate that was never in scope for the IT patch cycle. An external attack-surface review plus a prioritised patch plan for firewalls, VPNs and remote-access services closes more risk per dirham than anything else on the market right now.

🟡 CBUAE resilience regulation goes live: four-hour incident reporting, mandatory external penetration testing, and personal liability

The Central Bank of the UAE's Operational Risk Management and Operational Resilience Regulation (No. C 1/2026) came into effect on 14 September 2026, replacing Circular 163/2018. It applies to every licensed financial institution with legal personality, not only banks, and places ICT risk and cybersecurity at the core of the operational-risk framework rather than as a standalone technical function.

Concrete obligations: an ICT and cybersecurity risk framework covering identification, mitigation, incident response and recovery, patch management and disaster recovery; periodic stress tests including external penetration testing of critical functions with results presented to the board; business continuity exercises under severe but plausible scenarios; mapping of critical operations and third-party dependencies; and a reporting regime requiring notification to the Central Bank within four hours of an event affecting critical operations, a written report within 24 hours, and 72-hour notification of any high-severity incident. Sanctions can reach removal or restriction of senior management and board members, temporary administration and market bans. The same week also marked the close of the one-year reconciliation period under the new Central Bank Law, which Hadef & Partners put at 15 September with no general extension announced.

Sources: Gulf News, Hadef & Partners

A four-hour clock changes what "detection" means. It is no longer enough to find the incident; you must classify it, decide whether it touches a critical operation and get a notification to the regulator inside a working half-day, often overnight. That requires a SOC with a documented severity matrix tied to your critical-operations map, a pre-agreed reporting template, and named individuals with authority to send it. Exchange houses, finance companies, insurers and payment firms are in scope alongside banks and are typically the least prepared. If your incident-response plan does not already reference C 1/2026 timelines, it is out of date as of last Monday.

🟡 GISEC Day 2: OT and critical infrastructure move to the front, and Gulf energy operators talk consequence-driven resilience

Day 2 of GISEC opened with real-world ICS and OT incident analysis, including demonstrations of how poisoned models and manipulated sensor feeds can distort digital twins of physical assets in energy and oil and gas. A live scenario walked participants through a national OT SOC reconstructing an intrusion moving from IT into operational technology. On Day 1, an oil and gas resilience panel cited a 45 per cent surge in attacks on OT and IoT devices and ransomware disruption affecting more than 30 per cent of global utilities. Khaled Al Teneiji, Cyber Security Head at ENOC, rejected the "IT versus OT" framing and argued organisations must map threat paths that cross from IT to OT to create kinetic impact, warning that "accuracy of an asset inventory decays unless continuously maintained". Bahrain's Ministry of Oil and Environment IT chief Ali Abdulla Hasan Salman called full visibility of hardware, software, APIs, certificates and controller behaviour the sector's real early-warning system, and stressed rehearsing crisis response "several times" before an incident.

Sources: Zawya, Gulf News

Practitioners at the sharp end of Gulf energy are saying the same thing as the regulators: know what you have, know what depends on it, and rehearse. The asset-inventory point from ENOC is the one to act on, because most OT inventories were built once for a compliance audit and never maintained. A continuous asset-discovery capability across IT and OT, feeding a single SOC view, is the foundation for everything else, including the CBUAE's dependency mapping for financial firms and the NCA's OT controls for Saudi critical infrastructure.

What CISOs and IT Leaders Are Dealing With

The underlying shift is that Gulf cyber risk has become both quantified and regulated in the same month. National authorities are publishing daily attack volumes, independent researchers are documenting a 20-fold rise in regional ransomware, and the UAE's financial regulator has converted cyber resilience from a set of expectations into a regulation with a four-hour reporting clock and personal consequences for executives. Saudi Arabia's NCA is on the same trajectory, extending baseline controls beyond critical national infrastructure to the wider private sector and conducting unannounced inspections. CISOs are being asked to demonstrate detection, response and reporting capability under time pressure, with evidence, rather than describe a control framework.

At the same time the attack surface is widening in two directions: legacy OT and SCADA estates that were never patched on IT timescales, and AI agents being wired into email, customer systems and payment platforms with credentials that nobody has inventoried. The organisations coping best are those treating continuous asset discovery, prioritised patching of edge devices, and 24/7 managed detection as the baseline, and layering data-level protection and regulatory reporting on top. The ones struggling are trying to build all of that in-house in a market where security talent is scarce and expensive.

Three Things Worth Watching Next Week

1. Post-GISEC announcements from the UAE Cyber Security Council - Al Kuwaiti signalled further partnerships and national programmes, including post-quantum migration. Expect follow-on policy or partnership news that may set expectations for critical-infrastructure operators.

2. First supervisory activity under CBUAE C 1/2026 - With the regulation live and the reconciliation window closed, watch for Central Bank communications on incident-reporting templates, penetration-test evidence or dependency mapping. Insurers, exchange houses and payment firms should not assume they are second in the queue.

3. Saudi NCA guidance and inspections - With the Riyadh UNESCO AI ethics forum concluded and 2026 designated the Year of AI, watch for NCA updates on AI-related controls, OT requirements for industrial operators, and the pace of unannounced compliance inspections.

Questions? hello@paringa.ai

Paringa delivers cyber and data-privacy managed services that give Gulf organisations continuous asset visibility, 24/7 detection and response, and regulator-ready incident reporting, with data protected at the field level. In the UAE we deliver with CNS Middle East, part of the Ghobash Group. | 21 September 2026 | © Paringa Ltd