The cybersecurity gaps threatening the Middle East’s digital ambitions

The Middle East is accelerating its digital transformation, bringing cybersecurity higher on corporate agendas. Yet, as organizations invest in new technologies and expand their digital capabilities, questions remain over whether security measures and specialist expertise can keep pace with the region’s ambitions. 

According to the Heidrick & Struggles CEO & Board Monitor Report, 49% of Middle East leaders identify cybersecurity risk as a top challenge for 2026, the highest share globally and well above the worldwide average of 31%.

Meanwhile, nearly half of organizations in the region are concerned about hack-and-leak operations, compared with a global average of 38%, according to Security Middle East Magazine. 

AMBITION VS READINESS

Philippe Vallée, Executive Vice President of Cybersecurity and Digital Identity at Thales, says the Middle East is experiencing strong business growth, alongside a push to close gaps in cybersecurity readiness.

The region’s digital ambitions are driving organizations to accelerate their transformation, making it increasingly important for cybersecurity capabilities to develop at the same pace. Vallée says the shift is reflected in the greater attention companies are paying to security as part of their digital strategies.

“Cybersecurity is becoming much more central to how companies think about their digital development, because the more connected and digital an organization becomes, the more important it is to build security and resilience into that transformation from the beginning.”

However, several challenges continue to affect the region’s cybersecurity readiness, including a growing shortage of specialized talent.

“This is a challenge everywhere, because digitalization is only accelerating as we see, and the need for specialized cybersecurity skills continues to grow.”

Vallée mentions talent shortages as one of the main challenges, adding that the region needs to continue investing in local talent and expertise, creating opportunities for professionals to develop specialized skills while ensuring cybersecurity capabilities grow alongside its digital ambitions. 

Although competition for cybersecurity talent is a global challenge, he notes that the pace of digital development in the Middle East makes addressing the shortage particularly pressing.

THE ADDED LAYER OF AI

Vallée says the rise of AI agents requires organizations to strengthen identity verification and authentication to prevent synthetic identities, deepfakes, and identity theft.

“We need to put AI in motion to help us detect a real voice versus a copycat or synthetic voice. We also need to detect identity theft by improving the quality of authentication.”

Thales is also incorporating behavioral analytics into authentication to verify both users and the websites they access. Vallée highlights the growing adoption of FIDO technology, which uses passkeys instead of passwords and stores authentication credentials, such as biometrics or PINs, on local devices.

Beyond human identity verification, Vallée says Thales is developing ways to monitor AI agents by tracking who created them, their roles and permissions, their operating boundaries, and their activity history. This would help organizations investigate security incidents by reviewing the steps an agent took.

He also points to the potential of combining identity management with application security. Thales’ Web Application Firewall (WAF), part of its Imperva portfolio, filters web traffic to help prevent distributed denial-of-service (DDoS) attacks, monitor application programming interfaces (APIs), and detect malicious bots.

Vallée says similar filtering principles can be applied to AI agents accessing web applications, combining identity verification and application security to give organizations greater control over agent activity.

The company has begun implementing this approach on Google Cloud Platform, leveraging its traffic interception capabilities, with plans to extend it to Microsoft Azure and Amazon Web Services (AWS). The goal, he says, is to provide a unified control system for AI agent traffic across cloud platforms.

Vallée says Thales is contributing to discussions around agent protocols and registries, advocating for industry-wide standards rather than proprietary systems. He points to the company’s work with organizations including GSMA, ETSI, ISO, and the FIDO Alliance as examples of its involvement in standardization across telecommunications, payments, and digital identity.

“We have a team dedicated to contributing to standards within my activity, and our intent is also to contribute to standards when it comes to agents because we strongly believe in something that is as standardized as possible. It may not get to that point quickly, but the DNA, the bread and butter of Thales’ proposition, is to work with its clients on standards.”

He adds that Thales is following a proposed Google standard for AI agents and plans to contribute to its development. For Vallée, the aim is to support interoperable approaches rather than develop proprietary implementations.

More broadly, Vallée argues that regulation can help establish the conditions for trust in the digital economy, provided it strikes a balance between oversight and business activity.

“No regulation creates chaos, too much regulation creates no business. So, the thing is to have a good in-between.”

Vallée also emphasizes information-sharing between organizations and national cybersecurity agencies as a way to improve preparedness. Sharing details about breaches, attack methods, and vulnerabilities can help other organizations identify emerging threats and strengthen their defenses. He points to cooperation between corporate incident response teams and national cyber agencies in Europe as a model other markets could consider.

QUANTUM THREATS

Vallée says CEOs should start by building a complete inventory of cryptographic processes across on-premises systems and cloud infrastructure, then assess whether their systems can be upgraded to support post-quantum cryptography (PQC).

He notes that organizations should prioritize cryptographic systems vulnerable to quantum attacks, including those using RSA, and evaluate algorithms tested by independent bodies such as the US National Institute of Standards and Technology (NIST).

Rather than trying to predict when quantum computing will become mainstream, Vallée says businesses should establish which systems need to be upgraded and ensure their infrastructure can accommodate stronger cryptographic algorithms.

ENABLING BUSINESSES

Vallée also talks about how cybersecurity is becoming a business enabler, noting that until very recently, cybersecurity has always been an optional cost.

“Now, we think that it’s important to do cyber-by-design at the very early stage of the design of the software.”

He cites Thales’ work on banking card tokenization as an example of how this approach can support new business opportunities. The service connects banks issuing payment cards with Apple Pay, allowing cards to be tokenized on iPhones. Given the sensitivity of the process, he says demonstrating that security was built into the solution from the outset was important in gaining banks’ trust. 

He points to secure development practices, including training engineers to build security into software and using a Software Bill of Materials (SBOM) to track software components, particularly open-source dependencies. This allows organizations to identify whether their systems contain a vulnerable component and determine what action is needed.

Vallée says these practices are becoming more important as developers increasingly use AI tools. Thales uses a gateway to monitor employees’ access to large language models (LLMs), track token consumption and assess associated carbon emissions. He adds that AI-generated code must be tested before being incorporated into software.

He also highlights the EU’s Cyber Resilience Act as an example of regulation encouraging stronger security practices in software development, with lessons that other markets could consider.

PREPARING FOR THE FUTURE

As cyber threats evolve alongside new technologies, the challenge for organizations is not just keeping up, but knowing where to focus their efforts and how to measure progress.

Vallée says organizations can assess their cybersecurity readiness through audits that identify vulnerabilities across their networks, applications, internet-facing systems, identity management, and data protection. These assessments help companies set clear improvement targets and decide where to focus their resources.

He highlights identity management and data protection as key priorities, given the continued risks of phishing, identity theft, and sensitive personal data being exposed without encryption.

Looking ahead, Vallée expects securing AI agents to remain high on the cybersecurity agenda as more organizations adopt autonomous systems. The challenge, he says, is understanding how to protect against emerging threats and how security measures need to evolve alongside the technology.

“Cybersecurity is a permanent race between the thickness of the wall and the power of the bullet. It has been the same story for the past 100 years, okay? Still the same. Now AI is just accelerating the pace; the rhythm of the race.”

As for whether AI has levelled the playing field between cybercriminals and defenders, Vallée says attackers were already skilled at exploiting identity weaknesses before generative AI became widespread. AI gives them new tools, but it also gives security teams new ways to detect threats and protect their systems.

“The good news is that we all have access also to those LLMs, so we can also protect. It’s a question of—now we have AI on both sides of the race.”