As AI adoption accelerates across the Gulf, the cybersecurity conversation is shifting from prevention alone to resilience, governance and the ability to respond at machine speed. For Sultan Mahmood Malik, chief security officer at Huawei Gulf North, the emerging risk is not one technology in isolation but the convergence of AI-powered attacks, cloud expansion, critical infrastructure exposure and increasingly interconnected digital systems.

In this interview, Malik discusses how AI is changing the economics of cyber threats, why boards need to treat resilience as a business responsibility, the growing sophistication of ransomware, and the security implications of the Gulf’s rapid investment in AI, cloud and data centres. He also explains why organisations should already be preparing for quantum-era risks and argues that cybersecurity frameworks will need to become more adaptive as the threat landscape evolves.

As companies across the UAE and Gulf accelerate their adoption of AI, what new cybersecurity risks are emerging that business leaders may still be underestimating?

Malicious actors are already using AI to automate reconnaissance, draft convincing phishing content and scale social engineering that once required real time and skill to execute. That changes the economics of cyber threats: work that used to take a determined adversary days or weeks can now run continuously, against many targets at once. Frontier AI models have shown strong vulnerability discovery capabilities, and on average the newly discovered vulnerabilities can be weaponised within four hours.

At the same time, as organisations deploy AI systems of their own, new categories of risk emerge around the models and data behind them. For example, prompt injection, data leakage and non-compliant outputs are active design considerations.

Huawei addresses these concerns by enhancing our secure-by-design approach with AI capabilities throughout the R&D process, leveraging harness engineering to strengthen our world-class vulnerability management capabilities and increasingly embedding native security capabilities into our solutions; all of these measures significantly strengthen our customers’ overall security posture. This reflects our broader approach of using AI for Security while ensuring Security for AI.

Furthermore, Huawei addresses AI security challenges through layered guardrails covering data security, model security, model risk management, application security and operations, which are built on four roots of trust: encryption engines, confidential computing, trusted computing and trusted interconnection.

This approach is backed by sustained investment. Huawei allocates around 5 per cent of its annual R&D investment to cybersecurity and privacy protection, amounting to approximately $10bn over the past decade. These efforts are supported by more than 3,800 cybersecurity and privacy protection specialists worldwide.

Huawei is talking about moving from cyber defence to cyber resilience. What does that shift mean in practical terms for a CEO or board, and how should companies measure whether their businesses can actually withstand and recover from an attack?

For years, cybersecurity conversations centred on prevention – firewalls, detection tools and patching faster than malicious actors could exploit. That mindset assumed a determined threat could eventually be kept out.

But genuine resilience starts from a different premise: that disruption will happen, and the real test is how quickly the business can detect and contain it while continuing to operate.

For Huawei, built-in resilience means moving from post-incident repair to active architectural defence. Security frameworks must be adaptive and capable of automated evolution, helping critical business operations remain online even during machine-speed attacks.

For a CEO or board, that shifts cybersecurity from a function owned by IT into a governance responsibility owned by the business. It means asking which services genuinely cannot go down, how long the organisation can tolerate an outage before it becomes existential, and whether recovery has actually been tested under realistic conditions. Ultimately, those preparations determine whether an organisation proves resilient or becomes a victim.

Measurement follows from those questions, and it starts before an incident happens. Was the environment secure by design, with native security capabilities rather than added afterwards? How agile are the controls, and can they detect and adapt to new attack patterns? Key indicators include recovery time and recovery point objectives for critical systems, the time required to detect and contain an incident, and the results of regular simulation exercises. Together, these provide measurable evidence of resilience.

Resilience is proven under pressure, and boards that ask for evidence of both preparation and recovery, not just assurance of protection, are asking the right question.

Ransomware remains one of the biggest threats to business continuity. Are attacks in the Middle East becoming more sophisticated, and which sectors are currently most exposed?

The region is not immune to ransomware threats. That is because their nature and sophistication have changed. AI is enabling attackers to automate reconnaissance, craft more convincing lures and move faster once inside a network, while double-extortion tactics that combine encryption with data theft have become standard practice rather than the exception.

Sectors that cannot tolerate downtime, including critical infrastructure, government services, finance, healthcare and oil and gas, are consistently the most exposed, because operational continuity is what ransomware is designed to exploit. Attackers increasingly target backups directly, on the assumption that an organisation without a viable recovery path is more likely to pay.

That’s why we developed the industry’s first Multilayer Ransomware Protection solution, which counters attacker tactics at every stage, from intrusion and spread to infection and compromise of the production system, and ultimately, backups themselves. It works through active collaboration between network and storage, rather than relying on any single control, to achieve zero data loss.

The UAE is investing heavily in AI, cloud infrastructure and data centres. How do you secure this rapidly expanding digital infrastructure without slowing innovation and adoption?

Security and innovation are treated as opposing forces more often than they should be. This happens when security is treated as an afterthought, rather than embedded in the process from the outset. At Huawei, we believe in a secure-by-design approach, where security is considered as part of the innovation process rather than as an item to check off a list.

This is particularly important when building large-scale national or enterprise infrastructure, especially infrastructure supporting sovereign clouds, AI and associated data centres. Security needs to be embedded at every layer: within the cloud platform itself, in the underlying computing infrastructure through approaches such as confidential computing, across data and network security, and through end-to-end monitoring and governance.

Responsible AI governance is also essential as AI moves from generating content to operating through autonomous agents. Security must therefore extend beyond monitoring what AI says to governing what it does, with clear controls over identity, privileges and execution and human oversight retained for high-risk decisions. Huawei’s AI management system achieved ISO/IEC 42001 certification in March 2026, reinforcing our commitment to systematic and responsible AI governance.

What do you see as the biggest cybersecurity threat to the Gulf — AI-powered attacks, attacks on critical infrastructure, supply-chain vulnerabilities, quantum-related risks or something we are not yet paying enough attention to?

If we had to choose a single label, AI-powered attacks would be the obvious answer, with quantum computing also emerging as a significant concern. But that slightly misses the point. The more accurate picture over the next three to five years is convergence.

AI isn’t a new, isolated category of threat; it’s a force multiplier acting on vulnerabilities that already exist across products, identity, and the growing interdependence between cloud, data centres and critical infrastructure. Quantum computing presents a different emerging challenge, particularly to the confidentiality of communications and data.

Organisations should begin preparing now by identifying where legacy cryptography is used, prioritising long-lived sensitive data and building crypto-agile architectures that can accommodate new algorithms as standards and technologies evolve.

As economies across the Gulf become more digitally interconnected, an incident in one system has the potential to cascade into others. That’s why we need to think about security as “Secure by Design, Resilient by DNA”. Organisations need dynamic, evolving and adaptive cybersecurity governance frameworks that can keep pace as technology and the threat landscape evolve, while continuing to support organisational functions and business objectives as paradigms shift.

One person has died and two others have been injured after debris from an intercepted drone fell in Taif Governorate in Saudi Arabia, according to the kingdom’s General Directorate of Civil Defense.

The Civil Defense said its teams responded on Thursday after debris fell following the interception and destruction of a drone that authorities said was launched by the Houthi militia.

A Yemeni resident was killed in the incident, while a Saudi woman and a Pakistani resident were injured. The Pakistani resident is in critical condition, according to the directorate.

The falling debris also caused material damage to civilian buildings and vehicles in the governorate.

The General Directorate of Civil Defense said standard emergency procedures for such incidents had been implemented.

Dubai’s Knowledge and Human Development Authority (KHDA) has introduced four compliance handbooks covering private educational institutions across the emirate, setting out requirements ranging from staffing and permits to learner rights, health and safety and emergency preparedness.

Introduced under KHDA’s Flexible Regulation Framework as part of the Education 33 (E33) strategy, the handbooks cover early childhood centres, private schools, higher education institutions and training institutes.

The new framework is intended to provide institutions with a unified regulatory reference while allowing operators to assess their own readiness, identify compliance gaps and address issues proactively, WAM stated.

The handbooks set out regulatory and operational requirements according to the type of educational institution. These include permits, staffing, educational and training programmes, inclusive education, learner rights, health and safety, facility readiness, emergency preparedness and continuity of learning.

They also cover national identity and Emirati values alongside other operational requirements.

KHDA conducted 1,026 field visits

The launch comes as KHDA steps up compliance oversight across Dubai’s growing private education sector. During the past year, its compliance teams carried out 1,026 field visits, equivalent to an average of 86 visits per month.

The handbooks outline how field visits will be conducted and clarify the respective responsibilities of educational institutions and KHDA compliance officers.

They also provide self-assessment checklists designed to help institutions prepare for compliance requirements and incorporate them into everyday operations.

Fatma Belrehif, CEO of Education Quality Assurance and Compliance Agency at KHDA, said: “The learner journey in Dubai begins with a child’s first steps in an early childhood centre, continues through school and higher education, and extends to training, skills development, and lifelong learning. Every stage of this journey should be built on clarity, quality, and accountability within an integrated framework that protects learners, safeguards their rights, and provides a safe and supportive environment. The four compliance handbooks support the goals of E33, which places learners at the heart of the education ecosystem, by clearly defining the obligations educational institutions are expected to fulfil.”

She added: “The handbooks provide clear requirements that enable institutions to continuously assess their readiness, identify gaps, and address them proactively. This strengthens accountability, supports faster decision-making, and enhances the efficiency and sustainability of education services.”

Focus on learner and parent rights

KHDA said learner and parent rights form a core part of the compliance framework, with the handbooks intended to establish clearer relationships between families and education providers and define institutions’ responsibilities towards learners.

The framework also aims to reduce the time institutions spend identifying and interpreting regulatory requirements by bringing relevant obligations together in a consistent format.

The initiative forms part of E33’s wider objective of ensuring learners have access to high-quality education in safe and supportive environments, while supporting the continued expansion and diversification of Dubai’s private education sector.

The Central Bank of the UAE’s (CBUAE) latest interest rate increase is set to push up borrowing costs for some homeowners and businesses, while potentially delivering better returns for savers, according to UAE-based financial experts.

The CBUAE raised its Base Rate by 25 basis points from 3.65 per cent to 3.9 per cent, effective September 17, following a similar increase by the US Federal Reserve.

The Fed raised its target range by 25 basis points to 3.75-4 per cent on Wednesday, its first increase since 2023. The UAE’s monetary policy closely tracks US rates because of the dirham’s peg to the dollar.

For UAE consumers and companies, the impact could increasingly be felt through mortgages and business loans, particularly borrowing linked to the Emirates Interbank Offered Rate (EIBOR).

Vijay Valecha, chief investment officer at Century Financial, said the CBUAE’s Base Rate influences overnight funding costs, meaning EIBOR is also expected to move higher.

“In terms of impact, mortgages will definitely feel it. Most UAE home loans have a fixed rate for 1-5 years before switching to EIBOR plus a bank margin. Borrowers already on variable rates will see their monthly payments increase when their loans reset,” Valecha said.

The impact will not, however, be uniform across mortgage holders.

Valecha said borrowers coming off fixed-rate deals agreed in 2020 and 2021 could experience a larger increase because they may have locked in significantly lower rates. Those already paying fixed rates of around 5.5 per cent or higher could see little or no immediate change.

New mortgage customers could also face higher borrowing costs.

“New home-loan applicants are also likely to face higher rates, with offers moving above the mid-3 per cent levels seen through much of 2026,” Valecha said.

SMEs face higher financing costs

The impact is also expected to extend to UAE businesses, particularly small and medium-sized enterprises (SMEs) with floating-rate debt.

“Companies and SMEs with EIBOR-linked loans will pay more interest, adding pressure to margins, particularly in sectors already dealing with higher energy and shipping costs,” Valecha said.

Hamza Dweik, head of trading (MENA) at Saxo Bank, said financing costs are likely to remain elevated as the UAE follows the direction of US monetary policy.

“For the UAE, the immediate implication is that financing costs are likely to remain elevated. Given the dirham’s peg to the US dollar, the UAE Central Bank typically mirrors Fed moves, meaning borrowing costs for mortgages, personal loans and business lending are unlikely to ease anytime soon,” Dweik said.

However, he expects the wider UAE economy to be able to absorb the tighter monetary environment, supported by non-oil economic activity, population growth, tourism and continued investment.

“While higher rates may slow some credit demand, particularly among SMEs and highly leveraged borrowers, they are unlikely to materially derail growth. Rather, the impact is more likely to be seen through a moderation in borrowing activity rather than a sharp slowdown in economic activity,” Dweik said.

Madhur Kakkar, founder and CEO of Elevate Financial Services, similarly pointed to the GCC’s underlying financial position as a buffer against higher rates.

“For the UAE and the wider GCC, the impact is largely transmitted through the dollar peg, implying tighter domestic financial conditions and higher borrowing costs. That said, the region remains relatively well positioned given strong banking-system liquidity, healthy sovereign balance sheets and continued support from the energy sector,” Kakkar said.

Personal loans, credit cards and deposits

Existing personal and auto loan borrowers could be less exposed to the latest increase because these products are generally offered at fixed rates for the duration of the loan, according to Valecha.

Credit card rates are also unlikely to change significantly because they are already considerably higher than money-market rates.

Savers, meanwhile, could emerge as beneficiaries if banks respond to higher benchmark rates by increasing deposit rates.

“There is a benefit for savers. Deposit rates, which declined during the previous easing cycle, could now move higher. UAE banks may also see some improvement in lending margins as interest rates rise,” Valecha said.

Dweik added: “Higher benchmark rates support stronger returns on deposits and cash holdings, which has become an increasingly attractive proposition after years of near-zero rates.”

Could UAE rates rise again?

Attention will now shift to how long the higher-rate environment lasts and whether the Fed delivers another increase this year.

Kakkar said the Fed’s accompanying message was ultimately more significant for markets than the widely anticipated 25-basis-point increase itself.

“The Committee is signalling that inflation risks are not yet fully behind it, keeping the door open for further tightening and reinforcing a higher-for-longer rate environment,” he said.

Dweik said another US increase before the end of the year remains possible, which would have implications for borrowers in the UAE.

“The bigger takeaway is that the Fed is signaling inflation remains a concern. US inflation is still running at around 3.4 per cent, well above the Fed’s 2 per cent target, and policymakers have indicated that one additional rate increase this year remains a possibility. If that outlook materialises, UAE borrowers could face elevated financing costs for longer than previously expected.”

For UAE households and companies, Dweik said the key issue has therefore shifted from the latest increase itself to the duration of elevated rates.

“I think the key question for the UAE is no longer whether rates move higher today, but how long they stay at these levels. The Fed has effectively signaled that inflation remains the priority, which suggests borrowing costs across the UAE are likely to remain elevated well into 2027,” Dweik concluded.

Read: Trump challenges Fed rate hike, calls for 1% interest rates

Dubai’s Roads and Transport Authority (RTA) and Dubai Airports are stepping up coordination on future road and public transport infrastructure serving Dubai World Central – Al Maktoum International (DWC), as the emirate prepares for continued growth in aviation, population and development around Dubai South.

Mattar Al Tayer, Director General, Chairman of the Board of Executive Directors of RTA, and Paul Griffiths, chief executive officer of Dubai Airports, discussed future transport plans for DWC as well as traffic projects aimed at improving flows on road corridors leading to and from Dubai International (DXB).

According to WAM, the discussions focused on integrating Dubai’s road and public transport network more closely with its airports, with the aim of improving passenger movement and creating more seamless connections for residents and visitors.

Al Tayer said DWC and Dubai South are of strategic importance to RTA’s future planning due to the rapid urban and economic development taking place in the area.

He said: “Guided by the vision and directives of its leadership, Dubai continues to invest in developing world-class infrastructure aligned with its future aspirations and supporting sustained growth.”

RTA said it is developing an integrated and flexible network of roads and public transport systems to accommodate Dubai’s growing population and visitor numbers and support continued urban and economic expansion.

Improving access to DXB and DWC

During the meeting, RTA and Dubai Airports reviewed planned road and public transport projects intended to accommodate anticipated growth at DWC and Dubai South and improve access to the area from across Dubai.

The two organisations also discussed aligning future transport infrastructure projects with the aviation sector’s expansion plans.

Griffiths said: “Close collaboration with RTA is essential to shaping a seamless, integrated travel experience for our guests, from the moment they set out for the airport and throughout every stage of their journey. As Dubai enters a new phase of growth, the seamless integration of airports with road networks and all modes of public transport is a key element of our vision to reimagine the future of travel in the emirate.”

He added: “We will continue working with RTA to develop a flexible, future-ready mobility ecosystem that raises standards for ease of access, efficiency and passenger service, while supporting the central role of DXB and DWC in strengthening Dubai’s position as a leading global gateway for travel and aviation.”

The two sides will continue coordinating on future projects linking airports with roads and public transport, including measures aimed at improving traffic flow and accommodating population and urban growth around Dubai’s expanding aviation infrastructure.