Defending against a cyberattack can mean the difference between bouncing back or breaking down. For modern organisations, the cost of disruption now extends far beyond operational downtime.

At a time when organisations are operating in an increasingly complex digital threat landscape, resilience is being redefined. It is no longer only about how well systems are protected, but how quickly operations can be restored when disruption occurs, making business continuity a core priority rather than a reactive outcome.

Our research, ‘Risk Ready or Risk-Exposed: The Cyber Resilience Divide’, shows that the impact of a cyberattack goes way beyond the disruption of day-to-day operations – hitting share prices and earnings guidance, exposing businesses to lawsuits and fines, and enforcing budget cuts to divert resources to cyber recovery.

Most organisations recognise just how wide-reaching the consequences of a cyberattack can be. In fact, nearly every organisation we surveyed in the UAE (98 per cent) reported having a cyber resilience strategy in place and almost half 44 per cent said they were confident their strategy could withstand today’s cyber threats. However, moments of disruption act as a real test of these strategies, revealing whether organisations can truly sustain operations and recover quickly when incidents occur.

But is this confidence well-founded?

Here’s the reality: globally just 6 per cent of firms demonstrate peak cyber resilience maturity. The majority of organisations remain underprepared for what happens after a breach – and many underestimate this gap in preparedness.

Interestingly, organisations with the lowest levels of cyber resilience maturity are often the most confident in their preparedness. Around (44 per cent) of less mature organisations believe their strategy requires little or no improvement, while only 37 per cent of mature organisations express the same level of confidence. In fact, 58 per cent of mature organisations acknowledge their strategy still requires improvement, reflecting a more realistic understanding of today’s threat landscape.

This imbalance between perception and preparedness is what turns cyber incidents into business crises. Overconfidence can leave organisations ‘risk exposed’, increasing the likelihood of prolonged disruption and greater damage following cyberattacks.

For the UAE, this confidence gap becomes a business continuity priority rather than strategic exposure. The country’s economic strategy is built on operational stability, service continuity, and digital trust, and as governments and enterprises accelerate AI deployment, cloud-first models, and platform-based services, cyber resilience is no longer an IT outcome, but a core measure of operational reliability and organisational credibility.

True cyber resilience requires a shift in mindset, moving beyond simply protecting backups toward designing recovery environments that are secure, isolated, and verifiably trustworthy before an incident occurs.

Post-attack data recovery remains uncertain for many

Most organisations back up their sensitive data and have basic protection policies in place. However, data protection strategies remain fragmented. While 51 per cent of organisations in the UAE back up sensitive data, only 36 per cent rely on a unified data protection platform, limiting visibility and making response and recovery more complex.

The same pattern appears in post-attack recovery. UAE organisations are taking important steps to secure their backup environments, with 55 per cent now requiring additional authorisation for high-risk administrative actions. This reflects growing focus on protecting backup systems from compromise.

However, security controls alone do not guarantee recoverability. Fewer than half of organisations in the UAE follow the 3-2-1 backup rule (48 per cent), a foundational principle for ensuring clean, reliable recovery. This means that in more than half of environments, recovery copies may not yet be sufficiently isolated, tamper-proof, or verifiably clean.

While many organisations focus on protecting backup systems, fewer are building recovery environments that can confidently restore clean data after a cyberattack.

Threat detection tools get funding, but not full use

UAE organisations have clearly invested in threat detection and investigation. Every organisation surveyed in the UAE reported using structured threat hunting in some form. However, only 21 per cent say they use these capabilities to their full potential, while 79 per cent acknowledge there is still room for improvement.

This highlights a key maturity gap. While detection tools are widely deployed, many organisations have yet to integrate threat hunting into daily security operations or link detection insights directly to response and recovery processes. Without this operational integration, detection capabilities risk becoming reactive monitoring tools rather than proactive defence mechanisms.

Backups not being prioritised according to risk

Another critical observation is that backup strategies are not aligned with actual data risk. While 57 per cent of organisations now use data discovery and classification to identify privacy and security risks and guide response decisions, understanding risk alone is not enough.

Organisations must also prioritise protection and recovery based on data criticality, ensuring that the most important systems and data can be restored first during an incident. When this happens, data risk management moves beyond compliance and becomes a strategic capability that supports business continuity, governance, and long-term digital growth.

The new measure of readiness

Cyber threats will continue to evolve, but leadership expectations must evolve with them. For organisations in the UAE, cyber resilience maturity is increasingly becoming a measure of operational credibility, recovery readiness, and long-term competitiveness.

The organisations that succeed will be those that treat recovery as a strategic discipline, investing in resilience with the same seriousness as growth and demonstrating they can recover quickly when disruption occurs.

Ultimately, the future of cyber resilience in the UAE will be shaped not by who experiences an attack, but by who is prepared to recover from one.

Iran launched missile and drone attacks on US military installations in Bahrain and Kuwait on Tuesday, marking a significant escalation in Gulf tensions after Washington carried out a new wave of strikes against Iranian military targets, Reuters reported. The latest exchange has heightened concerns over regional security, energy infrastructure and global shipping routes through the Strait of Hormuz.

According to Iran’s Islamic Revolutionary Guard Corps (IRGC), the operation targeted multiple US military facilities in Bahrain and Kuwait in retaliation for US attacks on more than 80 Iranian military sites. The strikes were described by Tehran as a response to what it called repeated violations of a recently agreed ceasefire and broader peace framework.

Authorities in both Bahrain and Kuwait activated air raid sirens and air defence systems as the attacks unfolded. Initial reports indicated the strikes were aimed at US military assets rather than civilian infrastructure, although security measures were heightened across both countries. Iran also claimed to have downed a US MQ-9 Reaper drone during the operation, Reuters further reported.

The renewed hostilities follow US military action against Iranian air defence systems, missile sites, drone launch facilities and port infrastructure after Washington accused Tehran of orchestrating attacks on commercial shipping, including vessels transiting the Strait of Hormuz. According to Financial Times, the US has also revoked a sanctions waiver that had temporarily allowed Iran to sell oil on international markets.

Saudi Arabia has introduced a new regulatory framework for businesses seeking to operate around the clock, setting out permit requirements, annual fees and compliance obligations as the kingdom continues to streamline its commercial environment and support economic activity.

The Ministry of Municipalities and Housing has approved regulations governing commercial establishments operating 24 hours a day, implementing a cabinet decision that allows eligible businesses to remain open around the clock in return for an annual fee of up to SAR100,000, a Saudi Gazette report said.

Read more-Saudi Arabia pilots Package Visa to simplify tourist arrivals

Under the new framework, the minister of municipalities and housing has been authorised to determine the applicable fee structure and identify commercial activities that may be exempt from payment based on the public interest and the nature of the business.

Businesses intending to operate beyond standard working hours must first secure approval from the relevant municipality and the police before a 24-hour operating permit is issued. The permit, which is linked to a valid municipal licence, will be issued electronically as an additional authorisation allowing businesses to continue operations between midnight and 5:00am.

The restriction on operating hours will not apply during the holy month of Ramadan or the Eid holidays, when separate seasonal regulations govern commercial activity.

Essential services exempt from annual fee

The regulations also assign the Ministry of Human Resources and Social Development responsibility for establishing employment rules covering staff working extended hours, ensuring compliance with the Saudi Labor Law and related regulations.

Businesses operating under the scheme will be required to pay the prescribed annual fee in line with ministerial decisions. However, several sectors have been exempted in recognition of the essential services they provide.

These include fuel dispensing services at petrol stations, fuel stations and service centres located outside urban areas, hotels, hotel apartments, resorts and similar accommodation facilities, pharmacies, wedding halls, recreational rest houses, medical services and educational institutions.

Municipalities have also been empowered to designate suitable streets and commercial districts where businesses may operate around the clock, provided such activities do not negatively affect nearby residential neighbourhoods or overall quality of life.

The regulations further require businesses to comply with Saudi labour laws, including provisions governing women’s employment, while permit holders must adhere to all applicable laws and directives issued by relevant government authorities.

Businesses will also have the right to appeal decisions related to the implementation of the regulations before grievance committees affiliated with municipalities or other competent authorities, where applicable.

Saudi Arabia has reaffirmed that all real estate transactions across the kingdom are subject to a statutory 5 per cent real estate transaction tax, while certain property purchases by foreign buyers in designated areas will attract an additional 2 per cent fee under existing regulations, as the kingdom continues to refine its real estate investment framework.

Read more-Foreigners owning property in Saudi: The rules you need to know

The clarification was issued by the General Real Estate Authority (REGA), with spokesperson Taisir Al-Mufarrij confirming that the 5 per cent transaction tax applies equally to Saudi and non-Saudi buyers. He added that property transfers involving non-Saudis within designated geographic zones in Riyadh, Jeddah, Makkah and Madinah are also subject to an additional 2 per cent fee in line with the relevant law and its executive regulations, a Saudi Gazette report said.

Market development and investment objectives

REGA said the rules governing non-Saudi property ownership have been tailored to reflect the distinct characteristics and development priorities of each city while supporting the kingdom’s broader real estate strategy.

The authority noted that Makkah and Madinah remain subject to special provisions that safeguard their religious and historical significance, with property ownership in designated areas restricted to Muslims and governed by approved legal procedures.

Meanwhile, REGA said Riyadh and Jeddah, as Saudi Arabia’s leading economic and urban centres, are subject to targeted regulations aimed at supporting urban development, improving quality of life, directing real estate investment and strengthening the long-term sustainability of the property market.

The clarification comes as Saudi Arabia continues to advance reforms across its real estate and investment sectors, alongside broader government initiatives to streamline services and improve the business environment.

Dubai Electricity and Water Authority (DEWA) is encouraging residents to carry out essential pre-travel checks before heading off on their summer holidays to reduce electricity and water waste and identify potential issues early.

As part of its ‘Enjoy Sustainable Vibes This Summer’ awareness campaign, DEWA said customers can remotely monitor their electricity and water consumption through its digital services, allowing them to spot unusual changes while they are away and take prompt action if needed.

DEWA highlighted its Away Mode feature, available on its website and smart app, as a convenient tool for customers travelling during the summer, a WAM report said.

Read more-DEWA develops smart solution to speed up electricity network design

“The feature enables them to track electricity and water consumption from anywhere in the world through daily or weekly reports and graphs sent to their emails, helping them to detect any consumption irregularities and respond promptly.”

Steps to improve efficiency and safety

To improve efficiency and enhance safety before leaving home, DEWA advised residents to switch off the main water supply, inspect internal water connections and arrange regular maintenance of electricity and water systems through specialised technicians.

The authority also pointed customers to the DEWA Store, available through its smart app, which offers access to a list of trusted service providers for maintenance support.

Residents are further encouraged to unplug electrical appliances instead of leaving them on standby, clean air-conditioning filters regularly and keep doors and windows tightly closed to improve cooling efficiency. Where practical, households are also advised to use solar-powered water heaters.

To minimise water waste and avoid potential property damage, DEWA stressed the importance of inspecting water tanks, taps, heaters and internal connections regularly, while repairing any leaks as soon as they are detected.

In addition, DEWA noted that its High-Water Usage Alert, powered by smart meter technology, sends instant notifications when unusual water consumption is detected downstream of the meter, enabling customers to respond quickly to possible leaks.

The authority also encouraged customers to explore its Smart Living initiative, which provides detailed insights into electricity and water bills, tariff slabs and daily, weekly and monthly consumption patterns to support more informed and sustainable usage decisions.