2025 was a watershed moment; a year where Artificial Intelligence (AI) proliferated in our daily lives and fundamentally redefined the relationship between personal habits and corporate security. The pace of this adoption is unprecedented. While the telephone took 50 years to reach 50 million users, a leading generative AI tool reached 100 million in just two months. By late 2025, that same tool surpassed 800 million weekly users. AI is no longer a niche technical curiosity; it is an ‘invisible engine’ woven into the fabric of consumer life.
As consumers become accustomed to the speed and efficiency of AI at home, they inevitably bring these tools into the workplace to bypass slow or broken legacy processes. This has fuelled the rise of Shadow AI: the unsanctioned deployment of AI tools by employees without corporate oversight. Recent research highlights that nearly 40% of workers share sensitive corporate data with AI tools without their employer’s knowledge. The risk is evolving beyond simple chat prompts. Employees are now also connecting sophisticated autonomous agents to corporate systems to automate their workloads. These ‘shadow agents’ create uncontrolled pipelines for sensitive data, leading to significant leaks and compliance violations.
The AI advantage
On the business side, many business units are enabling AI features within existing platforms (like CRM or HR tools) without formal security reviews, creating massive blind spots in the attack surface. The Deloitte Tech Trends 2026 report notes that 38% of organisations are already piloting Agentic AI. This number will surge as organisations look to redesign entire processes for an AI-native environment rather than simply trying to automate legacy workflows.
If organisations do not quickly evolve their infrastructure and culture, Shadow AI will become an unmanageable systemic risk. Merely blocking these tools is futile; they ‘sneak back in’ because the efficiency gains are too high for users to ignore. Instead, organisations must build a security-conscious workforce that understands the security risks of AI, while providing enterprise tools that match the speed of consumer applications. Moreover, instead of viewing AI as just ‘software’, companies must start treating AI agents as a new class of digital worker that requires the same oversight and accountability as any human hire.
Basis for breaches?
In practice, AI is a double-edged sword that has collapsed the barriers to entry for sophisticated attacks while serving as a force multiplier for defenders. AI-assisted attacks can now reduce the median ‘time-to-exfiltration’ from two days to just 25 minutes; roughly 100 times faster than traditional methods. Deloitte’s Future of Cyber report found that 40% of organisations experienced between six and ten publicly disclosed breaches in the past year. In response, organisations are increasingly utilising ‘red agents’ to simulate adversarial attacks, identifying failures in ethics, bias and security before they can be exploited.
Beyond AI, we must watch the ‘New Math’ of quantum computing. While full-scale quantum machines are not yet commercially available, as per Deloitte research cryptographically relevant quantum computers (CRQCs) could break current encryption methods as soon as the 2030s. Transitioning to quantum-resistant systems could take a decade, creating a dangerous gap. Attackers are already engaging in a ‘Harvest Now, Decrypt Later’ (HNDL) strategy, posing an immediate risk to data with long-term sensitivity. While we assume that there is some time, organisations should also be ready for a surprise scenario where scalable quantum hardware arrives sooner than expected while the workforce remains undeveloped, leaving organisations at catastrophic disadvantage.
Organisations must begin a cryptographic inventory today to transition toward Post-Quantum Cryptography (PQC). By establishing a ‘crypto-agile’ operating model, companies can ensure the seamless interchange of algorithms as new threats emerge.
Aligning ambition
The Middle East has become the world’s most ambitious laboratory for emerging technologies, driven by national agendas like Saudi Vision 2030 and the UAE Digital Government Strategy. The region is skipping traditional technological stages to build the world’s first AI-native national infrastructures, backed by massive capital like Saudi Arabia’s $100 billion Project Transcendence and Abu Dhabi’s $100 billion MGX fund.
This ambition creates a unique ‘Leapfrog Paradox’: the Middle East is advancing faster than its global peers, leaving less time to bake security into the foundation. Accelerated digitisation, paired with unique geopolitical dynamics, makes the region a prime target for state-sponsored actors and cybercriminal enterprises targeting critical infrastructure. In fact, state-linked hostile operations increased by over 700% during geopolitical friction points in late 2025.
The convergence of IT and OT (Operational Technology) has created a concentrated infrastructure fragility. A single digital breach can now spread across connected layers to cause real-world service outages. Currently, over 50% of cybersecurity incidents involve OT. In the Middle East, threats blocked from email clients on industrial computers are 1.8 times higher than the global average.
We are also seeing a massive growth in ‘machine identities’, the automated keys used by bots, sensors and AI. These machine accounts now outnumber human accounts by a ratio of 45-to-1, creating millions of poorly governed entry points for attackers.
Encouragingly, regional regulators are moving from protecting only government assets to making cybersecurity a baseline requirement for the entire economy. In Saudi Arabia, the NCA’s NCNICC-1:2025 regulations now mandate cybersecurity controls for private sector entities. As the private sector’s contribution to GDP targets 65%, its digital resilience becomes a national priority. However, a governance gap remains; while the region leads in data sovereignty, 62% of organisations in Saudi Arabia still rely on manual processes for compliance evidence.
The evolution of security
To survive this landscape, organisations must move away from a patchwork of disparate tools toward a unified data security platform. Zero Trust must become the architectural foundation, treating every user, sensor and AI agent as a verified entity.
Ultimately, organisations must transition from seeing cybersecurity as a cost centre to a strategic differentiator that enables business agility and builds customer trust. Reflecting this maturity, Deloitte’s Global Future of Cyber report 58% of global organisations now expect cybersecurity spending to be integrated directly into other departmental budgets rather than remaining siloed.
CISOs must also foster a culture of AI Fluency, treating AI agents as digital employees that require formal onboarding, dynamic privilege management and continuous auditing. Moreover, they should move toward Policy-as-Code and automated compliance monitoring to transform their infrastructure investments into a true governance advantage.
The modern CISO must be a business executive who translates complex regulations into the language of risk for the board. The path forward is cyber resilience-by-design a strategy that assumes a breach is always imminent, rooted in Zero Trust Architecture and utilises AI-powered autonomous defense to close the window of opportunity before it’s too late. The organisations that will thrive are those that embed security into their operational DNA rather than retrofitting it as an afterthought.
