- Danny Jenkins, Co-Founder and CEO of ThreatLocker, has warned UAE organisations to strengthen their cyber defences
- This follows fresh concerns raised by the UAE Cyber Security Council
- Jenkins said the Council’s findings should serve as a wake-up call for businesses across the country
Danny Jenkins, Co-Founder and CEO of ThreatLocker, has warned UAE organisations to strengthen their cyber defences following fresh concerns raised by the UAE Cyber Security Council over rising identity fraud.
To rehash: The UAE Cyber Security Council issued a warning over weaknesses in everyday cybersecurity practices, linking routine user behaviour not only to data exposure but also to a rise in digital identity theft.
It warned that as many as one in three individuals could be exposed to digital identity theft, driven by the increasing volume of personal information shared across online platforms and social media.
Speaking to Tahawul Tech, Jenkins said the Council’s findings should serve as a wake-up call for businesses across the country, particularly as cybercriminals increasingly target social media users and exploit weak authentication measures.
He reiterated the Council’s warning that more than 60 per cent of financial cyberattacks begin with stolen login credentials, highlighting how identity fraud is growing as attackers harvest and reuse personal data from online platforms.
“The recent warning from the UAE Cyber Security Council that more than 60% of financial attacks begin with stolen login credentials should concern every boardroom in the country,” Jenkins said.
According to Jenkins, credential theft remains one of the most effective ways for attackers to gain access to enterprise systems. Once valid login details are obtained, cybercriminals can enter networks undetected, often appearing as legitimate users.
He added that advances in artificial intelligence are accelerating the threat. Attackers are now able to create highly convincing phishing emails, fake login portals and even cloned voice messages in a matter of minutes. This has made large-scale, targeted attacks far easier to execute.
Jenkins also pointed to human behaviour as a persistent vulnerability, with employees remaining the most common entry point for attackers. Social engineering tactics that exploit urgency and authority remain highly effective, making it critical for organisations to build security frameworks that account for human error.
While multi-factor authentication is widely used, Jenkins cautioned that it is not a complete solution. Attackers have developed methods to intercept credentials and authentication codes in real time, allowing them to bypass these protections.
However, he stressed that multi-factor authentication still plays an important role in reducing risk, particularly as identity fraud linked to social media users continues to rise.
“A password and a one-time code are not enough if the device itself isn’t verified through a secure network,” he said.
Jenkins urged organisations to adopt stronger controls, including device verification and Zero Trust security models, where access is continuously validated rather than automatically granted.
He said measures such as least-privilege access and tighter web controls can help limit the impact of a breach, even if credentials are compromised.
Looking ahead, Jenkins said 2026 should mark a turning point for identity security in the UAE. With identity fraud increasing and attackers using more advanced techniques, businesses must move beyond basic protections.
He concluded that combining multi-factor authentication with device-level verification and Zero Trust principles will be essential to counter evolving cyber threats.
