UAE Absorbs 35% of Gulf Cyberattacks as GISEC Global Closes Out a Record Year

Week of 28 September 2026 | Compiled by Team Paringa

GISEC Global 2026 wrapped in Dubai with hard numbers on the Gulf's cyberattack surge — and a UAE Cyber Security Council moving fast to convert conference-week momentum into standing partnerships.

What Happened This Week

🔴 UAE takes 35% of all Gulf cyberattacks; combined with Saudi, that's half the region

A Positive Technologies report released at GISEC Global 2026 (16–18 September, Dubai) found the UAE accounted for 35% of all cyberattacks across the Gulf in H1 2026 — the highest of any regional state — with the UAE and Saudi Arabia together absorbing roughly 50% of the total. Iran experienced 17% of attacks and Saudi Arabia 15% individually. Notably, 96% of all H1 incidents occurred in Q1 2026, coinciding with the escalation of regional conflict. Government agencies were the most-targeted sector at 27% of successful attacks, followed by sector-agnostic campaigns (23%) and industrial targets (17%, half of which hit Saudi organisations). Vulnerability exploitation (38%), malware (31%) and social engineering (27%) were the dominant attack methods; Positive Technologies' lead analyst Darya Lavrova noted that motives extended beyond financial gain to disinformation.

Separately — and less independently verified — Dr Mohamed Al Kuwaiti, head of the UAE Cyber Security Council, has repeated across three separate public appearances since early September (Khaleej Times' FutureSec conference on 3 September, the Arab Media Summit on 15–16 September, and again around GISEC) that the UAE recorded a single-day peak of 640,000 cyberattacks, up from a 200,000–300,000 daily baseline, and attributed a significant share to Iran's Islamic Revolutionary Guard Corps. One outlet (Daily Independent) explicitly flagged that this attribution "remains the position of UAE officials" with no independent corroboration from international security researchers cited alongside it. Al Kuwaiti also disclosed two specific incidents: a private-sector ransom demand of $5 million following exploitation of an unpatched vulnerability, and a deepfake-bullying case that cost a child a year of schooling.

Sources: Khaleej Times | Gulf News | The National | Khaleej Times — 640,000 figure

The Positive Technologies figures are solid — independently matched across Khaleej Times and Gulf News with identical numbers — and they're the ones worth quoting to clients without caveat. The 640,000-attacks-a-day figure and the Iran/IRGC attribution are a different story: it's a Tier-1 source (the Cyber Security Council's own head) repeating the same claim at three events, which makes it authoritative as a UAE government position but not independently verified as fact. Advise clients to cite Positive Technologies for sector risk-scoping conversations, and to treat the geopolitical attribution as context, not evidence, in any board-level threat briefing.

🟡 UAE Cyber Security Council signs MoUs with Visa and Cyble at GISEC

During GISEC Global 2026, the UAE Cyber Security Council signed two notable memoranda of understanding. With Visa (23 September), the council will nominate government employees for Visa's Payments Cybersecurity I and II courses, certified through Visa University, targeting payments-specific risk management skills across government entities. With Cyble (21 September), the council secured access to the Cyble Vision threat-intelligence platform, integrating unified visibility across digital, physical and brand-risk signals — explicitly framed by both parties as a shift "from reactive incident response toward proactive threat detection."

Both deals were announced with direct quotes from Dr Al Kuwaiti and counterpart executives (Visa's Joanne Kubba; Cyble's Beenu Arora), making them Tier-1/2 primary announcements rather than PR speculation, though the substantive impact of either partnership won't be measurable for months.

Sources: TechAfrica News | GlobeNewswire — Cyble

Two MoUs in one week signals the Cyber Security Council is treating GISEC as a deal-closing venue, not just a showcase — worth watching for whether this becomes an annual pattern. For clients selling into UAE government cyber programmes, the read-through is that skills-partnership and threat-intel-platform models are both currently in favour over pure staff-augmentation deals.

What Gulf CISOs Are Dealing With

The underlying trend is a region absorbing disproportionate attack volume relative to its size — driven by rapid digital transformation widening the attack surface faster than defensive maturity can close it — while simultaneously running one of the world's most conference-dense cyber calendars (GISEC's 15th edition drew 182 countries and 60%+ AI-assisted ransomware discussion) without yet showing whether that activity converts to measurably lower breach rates. The UAE's own officials note that over 85% of cyber threats still originate from user error rather than sophisticated tooling — a stat repeated across this week's coverage that undercuts some of the AI-threat-hype framing also present in the same conference sessions.

Three Things Worth Watching Next Week

1. Whether the Visa and Cyble MoUs produce measurable output — training completion numbers or specific threat detections attributable to Cyble Vision integration would validate the partnership model over pure PR.

2. Independent verification (or rebuttal) of the Iran/IRGC attribution — an international security vendor or CERT corroborating Al Kuwaiti's claim would materially change its evidentiary weight for client risk assessments.

3. H2 2026 Positive Technologies data — if the Q1 spike doesn't recur, it would support the "conflict-driven anomaly" reading over a "new baseline" reading for GCC threat modelling.

Could not verify: CNN's video interview with Dr Al Kuwaiti (16 September) could not be fetched — blocked by the source's robots.txt rules. The Iran/IRGC attack attribution is single-sourced to UAE Cyber Security Council statements repeated across multiple events, with no independent international corroboration located.

Questions? hello@paringa.ai

Paringa's Gulf-market practice separates verified threat-intelligence data (Positive Technologies, GISEC) from government messaging (attribution claims, round-number attack tallies) when advising clients on GCC cyber risk posture — the distinction matters for board-level reporting credibility. | 28 September 2026 | © Paringa Ltd