- The United Arab Emirates is facing a sharp rise in cyber threats
- Officials are warning that both individuals and businesses are increasingly vulnerable to sophisticated attacks
- The UAE Cyber Security Council has raised particular concern over the growing scale of phishing
The United Arab Emirates is facing a sharp rise in cyber threats, with officials warning that both individuals and businesses are increasingly vulnerable to sophisticated attacks ranging from email fraud to ransomware.
The UAE Cyber Security Council has raised particular concern over the growing scale of phishing, warning that deceptive emails remain one of the most common entry points for cybercriminals.
According to the Council, more than 75 per cent of cyber breaches originate from phishing emails or fraudulent messages, many of which are designed to steal login credentials or financial information.
The Council estimates that more than 3.4 billion phishing messages are sent every day, targeting users with increasingly convincing tactics that exploit gaps in awareness and digital behaviour.
Officials say these messages often rely on urgency and deception, such as requests for immediate payment, suspiciously attractive offers or prompts to log in via unfamiliar links. Even small details, like spelling and grammatical errors, can be warning signs, though newer attacks are becoming far harder to detect.
The warning comes as the UAE’s rapidly expanding digital economy faces a broader wave of cyber threats.
As businesses across Dubai, Abu Dhabi and the wider Emirates accelerate digital transformation, they are also exposing themselves to more frequent and more complex attacks.
The country’s cybersecurity market, now valued at USD $0.91 billion in 2026, is expected to grow to USD $1.51 billion by 2031, reflecting the increasing cost of defending against these risks.
Ransomware remains one of the most serious threats. Attacks in the UAE rose by 32 per cent in 2024, with little sign of slowing.
Cybercriminals are no longer just encrypting data, as they are also threatening to publish it, increasing both financial and reputational damage for victims.
Financial institutions remain prime targets, but sectors including healthcare, telecoms and government contractors are also under pressure.
Data suggests that 52 per cent of cyberattacks in the UAE are financially motivated, often linked to extortion or ransomware campaigns.
At the same time, phishing itself is evolving.
What was once associated with poorly written scam emails has become far more sophisticated, with attackers now using artificial intelligence to craft highly personalised messages that mimic senior executives or trusted suppliers.
These so-called business email compromise attacks are designed to trick employees into transferring funds or revealing sensitive information.
The Cyber Security Council has stressed that the ‘human element’ remains the most critical vulnerability.
Even the most advanced systems can be undermined by a single click on a malicious link or the accidental sharing of credentials.
The growing use of artificial intelligence tools in the workplace has introduced what experts describe as ‘shadow AI’, where employees deploy unapproved systems that can access sensitive company data.
These tools can create security gaps that traditional protections are not designed to detect.
Meanwhile, critical infrastructure faces heightened risks from more advanced, and in some cases state-sponsored, attacks.
Globally, most major cyber incidents now involve deliberate disruption or sabotage, raising concerns about the potential impact on essential services.
Recent data shows that many hackers can exploit newly discovered vulnerabilities within 48 hours, leaving organisations with very little time to respond.
For smaller businesses in particular, keeping pace with this threat can be difficult.
In response, the UAE government has been tightening its approach.
The National Cyber Security Strategy 2025–2031 introduces stricter requirements and signals a shift towards greater accountability for organisations.
Officials are urging both individuals and businesses to take practical steps to protect themselves, including avoiding suspicious links, enabling multi-factor authentication, regularly updating systems and reporting potential threats immediately.
