UAE’s cyber threat is getting costlier and smarter

Cyberattacks are now costing the UAE economy up to USD 2.5 bn a year — and the bill is climbing as threats grow more complex and better organized, a cybersecurity expert specializing in state-level cybersecurity incidents Raed Ahsan tells EnterpriseAM. Costs include operational losses, ransom payments, recovery, lost productivity, regulatory fines, and supply-chain spillovers.

Paying the price for war: The UAE was one of the most targeted countries in EEMEA, alongside Ukraine and Pakistan, with the region seeing a 13% rise in cyberattacks between March 2025 and March 2026, as per Mastercard’s Cyber Pulse report. The UAE experienced “elevated targeting” due to heightened regional and geopolitical tensions as well as its role as a regional financial and digital hub — amplifying attacker interest during periods of instability, per the report. Experts also previously told us that the UAE’s position as an economic and financial hub makes it a prime target for attackers.

REMEMBER- At the start of the month, the country fended off organized cyberattacks targeting the aviation, energy, and education sectors, following another series of attacks in July.

A heavier cross to bear: The cost of data breaches at firms in the Middle East usually averages USD 8 mn per incident; however, some UAE companies regularly surpass that, Ahsan notes. Financial services and tech companies can be prone to face losses exceeding USD 10.6 mn per incident, he tells us.

Attacks are also getting more lucrative for the people carrying them out. Threat actors are combining multiple stages of the cyber kill chain to go beyond causing disruption and target money and data directly, Dmitry Nagibin, founder of Dubai-based cybersecurity firm VXControl, tells EnterpriseAM. VXControl builds open-source autonomous-agent tooling for offensive security teams.

ICYMI- AI is changing the game here too: analysts previously told us that the growing volume of AI-generated and AI-powered attacks is making threats harder to detect and pushing up their frequency.

The downtime tax: Ransomware attacks against core processing systems can cost companies up to USD 10 mn within the first two hours to half a day of an outage, Nagibin says. The bill scales with what's disrupted: “A cyberattack disrupting a Tier-1 UAE bank can cost USD 150-300k per hour, while disruption at ports and logistics hubs can lead to USD 1.5-3 mn in losses per day through cargo delays, demurrage and congestion,” Ahsan says. Airline disruptions can exceed USD 2 mn per hour during peak periods once fleet management, passenger rebooking, cargo, and reservation systems are affected, he adds.

Who foots the bill: Enterprises absorb an estimated 50-60% of the losses, insurers cover roughly 20-30% where policies apply, and the state ends up carrying 10-20% of systemic costs when critical infrastructure is disrupted, per Ahsan.

The spending is rising, but preparedness has gaps: UAE cybersecurity spend is growing 8.7-12.5% annually, Ahsan says, with heavily regulated sectors like banking, energy, and utilities pushing 12-15%. But the money is skewed toward compliance box-checking rather than operational resilience: critical vulnerabilities can sit unpatched for 45-90 days or longer, and rapid digital rollouts are leaving shadow APIs and unauthenticated endpoints exposed. Globally, cybersecurity budgets are projected to grow at a 2.5% CAGR over the next three years, with the share spent on AI solutions expected to more than triple, from about 4% to 15%, per a McKinsey report.

Cyber risk awareness is also spreading into boardrooms, with cyber resilience becoming a financial consideration, says Ahsan. Private equity firms and sovereign investors are now regularly conducting cyber due diligence, as compromised infrastructure or weak controls could potentially trigger 5-15% valuation haircuts or escrow holdbacks, he said.

The boardroom is paying attention: Cyber resilience is becoming a financial consideration, not just a technical one, Ahsan says. Private equity firms and sovereign investors are now routinely running cyber due diligence, and weak controls or compromised infrastructure can trigger 5-15% valuation haircuts or escrow holdbacks.

Insurers are also demanding more guardrails, including multi-factor authentication, immutable backups, endpoint detection and response, and defined patching timelines — making critical infrastructure, energy, healthcare, financial services, and logistics companies among the hardest to insure, says Ahsan.

The weak link is everyone else: A company's cybersecurity is only as strong as the ecosystem it connects to, Nagibin says — and that's not limited to tech firms. Banks, government entities, factories, and retailers all depend on third parties, and vendor and subcontractor access already creates exposure, since those parties “may have access to limited environments of a company's core infrastructure.”

What's next: AI can make that exposure more dangerous, giving insiders or compromised third parties new ways to move through corporate infrastructure — and regulation hasn't kept pace. “There isn't enough regulation to put best practices into the companies,” Nagibin says. As it stands, UAE companies’ AI deployment is currently moving faster than their AI-specific security controls, creating a new challenge for an economy rapidly digitizing its infrastructure and business processes, argues Ahsan.