Issuu

TII:

BEYOND THE LINE OF SIGHT

www.cxoinsightme.com ISSUE 90 \ SEPTEMBER 2026

EXCLUSIVE

Globant's Federico Pienovi

Feature

THE QUANTUM DEADLINE

The

frontier du’s Jasim Al Awadi on powering the foundations for the UAE’s AI future

Contents www.cxoinsightme.com

20 COVER FEATURE

THE NEXT FRONTIER

du’s Jasim Al Awadi on the sovereign infrastructure and operational control powering the UAE’s next phase of AI adoption

FEATURE 34 THE QUANTUM DEADLINE Experts explain why cryptographic discovery, data longevity and crypto-agility need attention well before Q-Day

VIEWPOINTS 28 BEYOND THE LINE OF SIGHT TII on turning fragmented security data into coordinated operational intelligence 40 THE NEXT LAYER OF CARE Etihad Salam Telecom Company discusses the infrastructure needed to scale AI across Saudi healthcare 46 THE PRICE OF CONVERGENCE Trellix examines why the IT/OT boundary is becoming a critical point of cyber risk

INTERVIEWS 31 GOVERNING THE AUTONOMOUS ENTERPRISE ADG’s Ricky Mahar on authority, sovereignty and human accountability as agentic AI moves deeper into business operations 50 CHANGING THE PLAYBOOK Globant’s Federico Pienovi explores how Saudi Arabia is connecting infrastructure, data and AI to accelerate new experiences across tourism and sport

WHAT’S NEW 58 The latest gears and gadgets to keep you ahead of the curve

PUBLISHED BY INSIGHT MEDIA & PUBLISHING LLC

SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

EDITORIAL

GROUND CONTROL Technology creates value by extending what organisations are able to do. Cybersecurity increasingly determines how far they can go. That is a meaningful change in the role security plays inside the enterprise. For years, cybersecurity was largely judged by its defensive outcomes: incidents prevented, systems protected and disruption contained. Those remain essential measures, but they no longer capture its full value. As AI, cloud and connected infrastructure become part of core operations, security is moving further upstream, influencing how systems are designed, where data can move, who can act and how much authority can safely be delegated. The more consequential the technology, the more important those decisions become. This month’s cover story with du’s Jasim Al Awadi explores that shift through the UAE’s move towards more autonomous government operations. The discussion goes beyond AI capability to the infrastructure required to support it, where sovereignty, operational control and cyber-first design are becoming central to deployment at scale.

Published by

The change is visible across very different parts of the security agenda. Proofpoint’s latest research shows the CISO mandate expanding across AI, employee behaviour and board-level risk. Elsewhere in this issue, Tenable and SANS make the case that preparing for quantum-era threats begins with something far more immediate: knowing where cryptography exists and what it protects. Trellix and Qualys, meanwhile, examine how connected operational environments and AI-accelerated vulnerability discovery are compressing the time security teams have to understand and act on risk. Cybersecurity’s growing value lies in that wider role. It is becoming part of the organisation’s capacity to move with confidence, giving leaders the control, visibility and trust required to put increasingly powerful technology to work.

Adelle

Adelle Geronimo Managing Editor

Managing Editor Adelle Geronimo adelleg@insightmediame.com +97156 - 4847568

Commercial Director Merle Carrasco merlec@insightmediame.com +97155 - 1181730

Operations Director Rajeesh Nair rajeeshm@insightmediame.com +97156 - 4110215

Production Head James Tharian jamest@insightmediame.com +97156 - 4945966

Administration Manager Fahida Afaf Bangod fahidaa@insightmediame.com +97156 - 5741456

Designer Anup Sathyan

While the publisher has made all efforts to ensure the accuracy of information in this magazine, they will not be held responsible for any errors

SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

IN OUR RADAR

SpaceX clocks 100th mission

LEAP 2026 concluded in Riyadh with nearly $15 billion in investments and agreements, reinforcing Saudi Arabia’s growing position as a global technology hub. The event brought together industry leaders, investors and innovators, with major announcements spanning AI, cloud infrastructure, data centres and emerging technologies.

SpaceX has completed its 100th mission of 2026, sending another batch of Starlink satellites into orbit aboard a Falcon 9 rocket. The milestone highlights the company’s accelerating launch cadence as it continues to expand its global satellite internet network.

Abu Dhabi launches new Digital Skills Card

A new home for AI in Oman

Abu Dhabi has introduced the region’s first blockchainauthenticated Digital Skills Card, offering secure, verifiable records of professional qualifications. The initiative aims to strengthen trust in credentials, simplify verification, and support workforce mobility.

Oman’s first AI-focused special economic zone is expected to attract $275 million in investment across three phases. Spanning 104,000 square metres near Muscat International Airport, the project will bring together AI infrastructure, research, startups, robotics, cloud computing and advanced technology development.

Trellix appoints new security chief

Lenovo deepens Saudi AI push with new R&D lead

Evan El-Amin / Shutterstock.com

LEAP 2026 wraps $15 billion tech haul

Trellix names David Soto as Chief Information Security Officer to lead its enterprise security programme and cyber resilience strategy. The former Amazon security leader brings more than 25 years of experience and will also oversee Trellix’s Customer Zero programme, strengthening security from within. 6

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

Lenovo names Dr Rabeah Alzaidy to lead its R&D initiatives in Saudi Arabia, strengthening its investment in local innovation and AI. With more than 15 years of experience, she will expand research capabilities and deepen collaboration across the Kingdom’s universities, industry and technology ecosystem.

NEWS

John Ternus takes the helm as Apple enters its next chapter

John Ternus has officially taken over as chief executive officer of Apple, succeeding Tim Cook after a 15-year tenure that transformed the company into one of the world’s most valuable technology companies. Cook has assumed the role of executive chairman, marking Apple’s first CEO transition since he succeeded Steve Jobs in 2011, according to reports. Ternus joined Apple in 2001 and most recently served as senior vice president of hardware engineering. During his 25-year career at the company, he led development across several of Apple’s flagship products, including the iPhone, Apple Watch, AirPods and Apple Siliconpowered Macs, and contributed to the Vision Pro headset. He has long been regarded as a leading successor to Cook because of his engineering background and central role in Apple’s hardware strategy. As the leadership transition took effect, reports revealed messages sent to employees by both executives. In his farewell memo, Cook reflected on Apple’s culture, writing: “There is something truly special about Apple. I am most proud of what an annual report could never capture. This place is proof that culture 8

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

I’m honoured to be stepping into this role at what is truly the greatest company in the world, and I am so excited about everything we have in store JOHN TERNUS

triumphs over everything. We share a belief that what we build matters, and that we have both the opportunity and the responsibility to leave the world better than we found it.” Cook also expressed confidence in his successor, writing: “I will miss leading you and being with you for every step, even as I take enormous comfort in handing the helm to someone as brilliant and wonderful and capable as John. Few people understand what it takes to build products that change the world the way John does and I could not be more excited for his leadership.” In his first message as CEO, Ternus thanked employees and praised Cook’s

leadership, writing: “Today, on my first day as CEO, I just wanted to send a quick note to thank everyone for the warm wishes. I also want to extend my deep appreciation to Tim for sharing so much of his knowledge and experience during this transition, and more importantly, for everything he contributed to Apple over the years.” Looking ahead, Ternus added: “I’m honoured to be stepping into this role at what is truly the greatest company in the world, and I am so excited about everything we have in store. “I’m just as excited about what lies beyond that, including the incredible products already in the works and the ones we haven’t even imagined yet that we’ll dream up and create together. There’s no team in the world I’d rather build the future with.” Ternus assumes leadership as Apple faces growing pressure to strengthen its artificial intelligence strategy while maintaining momentum across its hardware and services businesses. Reports suggest the leadership transition is intended to provide continuity while positioning the company for its next phase of product development and AIdriven innovation.

The Next Move In Cybersecurity Starts Here

MEET CYBERKNIGHT AT GISEC GLOBAL 2026

Meet Our Cybersecurity Innovators

16-18 Sept 2026

Dubai Exhibition Centre (DEC), Expo City

Hall 9 | Booth A170 www.cyberknight.tech

NEWS

AMD, HUMAIN plan $10 billion AI infrastructure buildout AMD and HUMAIN, Saudi Arabia’s AI enterprise backed by the Public Investment Fund, have announced plans to invest up to $10 billion to build AI infrastructure across Saudi Arabia and the US. The partnership will deploy 500MW of AMD-based AI computing capacity over the next five years. Under the agreement, HUMAIN will oversee delivery of the infrastructure, including hyperscale data centres, power systems and global fibre interconnects. AMD will provide its AI compute portfolio and ROCm open software ecosystem. “Our investment with Humain is a significant milestone in advancing global AI infrastructure. Together, we are building a globally significant AI platform that delivers performance, openness and reach at unprecedented levels,” said Dr. Lisa Su, Chair and CEO of AMD. The companies are also planning an “AI in a Box” offering for enterprises in Saudi Arabia. The solution is aimed at

This is not just another infrastructure play – it’s an open invitation to the world’s innovators TAREQ AMIN HUMAIN

organisations that want to deploy and test AI applications without hyperscale infrastructure, with reported use cases across oil and gas, financial services and manufacturing. It will be developed by HUMAIN and powered by AMD Instinct GPUs and AMD EPYC CPUs. “This is not just another infrastructure play – it’s an open invitation to the

world’s innovators,” said Tareq Amin, CEO of Humain. “We are democratising AI at the compute level, ensuring that access to advanced AI is limited only by imagination, not by infrastructure.” As part of the broader collaboration, AMD, HUMAIN and Cisco also plan to deploy up to 1GW of AI infrastructure in Saudi Arabia by 2030.

Broadcom introduces VMware Private AI Cloud

Broadcom has introduced VMware Private AI Cloud, a private cloud platform designed to help enterprises build, run and govern AI workloads alongside existing enterprise applications. The platform brings AI models closer to enterprise data, rather than moving data to external models, and is aimed

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

at organisations managing inference workloads, agentic applications and traditional workloads on a single private cloud environment. “VMware Private AI Cloud is the inflection point where enterprise private cloud and private AI infrastructure stop operating as separate disciplines and become

one—enabling production inference workloads and agentic AI with the data sovereignty, compliance posture, and cost predictability their business demands,” said Ram Velaga, president, Infrastructure Software Group, Broadcom. VMware Private AI Cloud is built around VMware Cloud Foundation 9 and includes support for GPUs, CPUs and other accelerators. Features include NVMe memory tiering, cluster-wide storage deduplication, token monitoring, multi-tenant model sharing, GPU and vGPU tracking, and an AI metrics observability dashboard. Broadcom also announced security and agentic AI capabilities, including VMware AI Factory, VMware vDefend enhancements, AgentMinder, and Tanzu Platform agent foundations for controlling AI agents and their access to enterprise systems.

BRIDGING TECHNOLOGY WITH OPPORTUNITY We connect leading global technology brands with local market opportunities.

DRIVING GROWTH TOGETHER We add value at every step, helping partners grow and succeed.

WHAT WE DO

VALUE ADDED DISTRIBUTION

TECHNICAL EXPERTISE

STRONG PARTNER NETWORK

MARKETING & DEMAND GENERATION

AFTER SALES SUPPORT

Delivering a wide range of technology products from leading global brands.

Pre-sales support, product expertise and solution guidance for our partners.

Building long-term relationships based on trust, performance and mutual success.

Supporting partners with marketing tools, campaigns and lead generation programs.

Reliable post-sales support ensuring customer satisfaction and loyalty.

Sales@Digidisti.com

+971 52 209 8485 UAE | KSA | Iraq | Pakistan | GCC

SCAN TO VISIT OUR WEBSITE

Digidisti.com

NEWS

TDRA grants Starlink licence to offer satellite internet in UAE This licence supports the UAE’s ambition to strengthen its position as a regional and global hub for telecommunications and the digital economy RossHelen / Shutterstock.com

The UAE’s Telecommunications and Digital Government Regulatory Authority (TDRA) has granted Starlink Satellite Communications LLC a 10-year General Space Services License to establish, operate and manage a public satellite communications network and provide broadband satellite internet services in the UAE. The licence adds a space-based connectivity layer to the country’s digital infrastructure, complementing existing fibre-optic and 5G networks. TDRA said the service is intended to expand connectivity options, support resilience and continuity, and serve individuals, businesses, government entities, and satellite connectivity requirements in the maritime and aviation sectors. H.E. Majed Sultan Al Mesmar, Director General of TDRA, said, “This licence represents a significant addition to the UAE’s telecommunications sector and reflects the country’s commitment to adopting advanced technologies

and fostering a flexible regulatory environment that supports innovation and investment. The introduction of advanced satellite internet services will expand connectivity options, enhance network resilience and business continuity, and support

the UAE’s ambition to strengthen its position as a regional and global hub for telecommunications and the digital economy.” The services will be subject to UAE regulatory and technical frameworks covering security, information infrastructure protection, service quality, reliability, continuity, consumer rights, data privacy, spectrum-use compliance and technical coordination.

AWS Saudi cloud region set for December 2026 launch builders, from startups and enterprises reimagining industries to public sector organizations deploying AI at scale, and the new AWS Region in the country will help them to continue to innovate,” said Matt Garman, CEO, AWS. The launch will expand AWS’s global infrastructure footprint to 40 regions worldwide.

Amazon Web Services (AWS) has announced that its first AWS Cloud Infrastructure Region in Saudi Arabia is on track to launch in December 2026. The region, first announced in March 2024, represents more than $5.3 billion (SAR19.88 billion) in planned cloud infrastructure investment and will comprise three Availability Zones at launch. AWS said it will allow developers, startups and enterprises to run applications and serve users from data 12

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

centres in the Kingdom. AWS and HUMAIN, a Public Investment Fund-owned company, have also expanded their collaboration to make up to 50MW of capacity available in Saudi Arabia’s first AI Zone by 2028. The AI Zone will include AWS Trainium chips and the latest NVIDIA AI infrastructure for AI training and inference workloads. “Saudi Arabia is home to some of the most ambitious and inventive

US$5.3 billion The value of AWS’s planned cloud infrastructure investment in Saudi Arabia

NEWS

Lenovo unveils first Made in Saudi laptop

Lenovo has unveiled its first laptop manufactured in Saudi Arabia, marking an early output from its new manufacturing presence in the Kingdom. The device, produced in Riyadh, was presented at LEAP 2026 and forms part of Lenovo’s strategic collaboration with ALAT, a Public Investment Fund company. The company said mass production of limited products is expected to begin in late 2026. The announcement follows Lenovo’s wider expansion in Saudi Arabia, including the establishment of its Middle East, Türkiye and Africa regional headquarters in Riyadh and plans to develop local research and development capabilities. Dr Rabeah Alzaidy has been appointed to lead Lenovo’s R&D initiatives in the Kingdom. Tareq Alangari, Senior Vice President and President, Lenovo Middle East, Türkiye and Africa, said, “ At LEAP last year Lenovo

and ALAT announced an ambition to help This announcement is establish Saudi proof of what can be Arabia as a global achieved when long-term technology and investment, local talent, manufacturing hub. Today, we are and ambitious national proud to unveil the goals come together first Lenovo laptop TAREQ ALANGARI manufactured in LENOVO the kingdom. This announcement is proof of what can be achieved when long-term investment, local talent, and ambitious national goals come together. With this in mind Saudi Arabia will play an increasingly important role in Lenovo’s global manufacturing, innovation, and supply chain network.” The Riyadh facility is expected to produce Lenovo’s wider portfolio, including PCs, desktops, Motorola smartphones and servers. Lenovo said the site will add to its global manufacturing network of more than 30 facilities across 11 countries. The company is also working with ALAT, the Human Resources and Development Fund and the Ministry of Industry and Mineral Resources on talent development. Lenovo said the first cohort of Saudi engineers has completed specialised training at its global manufacturing facilities.

MDart10 / Shutterstock.com

Oracle to bring Gemini models to enterprise customers

Oracle and Google Cloud have expanded their partnership to bring Google’s Gemini models to Oracle’s enterprise applications. The agreement builds on customers’ existing access to Gemini models 14

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

through Oracle Cloud Infrastructure Enterprise AI. Oracle plans to make the models available in Oracle AI Agent Studio for Fusion Applications, its platform for building and running AI

automation and agentic applications using Oracle, partner and external agents. Oracle also plans to use Gemini models for embedded AI use cases in Oracle Fusion Applications and Oracle NetSuite. “Organisations around the world trust Google Cloud’s full AI stack to power critical enterprise workflows and agents,” said Satish Thomas, Vice President, Google Cloud. “Our expanded partnership with Oracle is designed to make it easier for organisations to use Gemini in the applications and agentic workflows they rely on to automate workflows, accelerate decisions, and drive outcomes.” Customers and partners are expected to access Gemini 3.1 Flash Lite and Gemini 3.5 Flash, alongside models from other providers. Oracle said the models will support use cases including complex reasoning, video and presentation creation, and Fusion-native agents.

QUOTEWORTHY

“DUBAI CONTINUES TO STRENGTHEN ITS POSITION AS A GLOBAL HUB FOR THE WORLD’S MOST AMBITIOUS IDEAS AND FUTUREFOCUSED VISIONS – A PLATFORM WHERE IMPACTFUL PARTNERSHIPS AND INITIATIVES TAKE SHAPE, AND A DESTINATION FOR LEADING MINDS, EXPERTS AND FUTURE SHAPERS FROM AROUND THE WORLD” HH Sheikh Hamdan bin Mohammed bin Rashid Al Maktoum, Crown Prince of Dubai, Deputy Prime Minister, Minister of Defence, and Chairman of the Board of Trustees of Dubai Future Foundation

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

“AGENTIC AI IS THE NEW PHASE IN OUR JOURNEY OF DEVELOPING THE GOVERNMENT OF THE FUTURE” HH Sheikh Mansour bin Zayed Al Nahyan, Vice President, Deputy Prime Minister and Chairman of the Presidential Court

SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

REPORT

BEYOND DEFENCE:

THE NEW WEIGHT OF CYBER LEADERSHIP U AE CISOs are entering 2026 with greater confidence in cyber resilience, even as responsibility for AI, employee behaviour and board-level risk stretches the role far beyond its traditional boundaries. Proofpoint’s 2026 Voice of the CISO report points to a security function becoming more embedded in the

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

mechanics of the business. Expectations of a material cyberattack in the UAE have fallen to 49 percent, from 69 percent in 2025, while reported material data loss has also declined. Yet 40 percent of CISOs still say their organisation is unprepared for a targeted attack, suggesting improved resilience has not removed the underlying complexity. Risk is becoming more distributed

across identities, cloud services, applications and the everyday decisions employees make. AI is accelerating the change. For security leaders, the issue is no longer confined to protecting new tools after deployment. CISOs are increasingly expected to influence how AI is introduced, who can access it, what information can move through it and where responsibility sits when something goes wrong. Proofpoint found 86 percent of UAE CISOs see safe use of AI assistants, copilots and automation as a priority over the next two years, while 75 percent expect to take on AI-related risk without a proportional increase in resources or expertise. Pressure is also building around employee behaviour as human risk is now identified as the biggest cyber vulnerability by 73 percent of UAE CISOs, up from 57 percent a year earlier. Public GenAI tools make an old security problem harder to contain because employees can move, summarise and expose sensitive information through services sitting outside conventional controls. Even with 83 percent of respondents expressing confidence in their defences against risks introduced by AI, SaaS and modern work patterns, 70 percent believe employees are likely to use AI in ways capable of exposing sensitive data. Greater boardroom alignment adds another dimension with 81 percent of UAE CISOs say they now see eye-toeye with their boards on cybersecurity, compared with 57 percent in 2025. The closer relationship brings more commercial scrutiny, with cyber risk increasingly discussed in terms of downtime, enterprise value, reputation, operational disruption and data loss. Three quarters of CISOs say excessive expectations are placed on them, while 84 percent believe cybersecurity expertise should be required at board level. Patrick Joyce, global resident CISO at Proofpoint, says AI is “fundamentally changing the CISO mandate”, with security leaders expected to protect the business from technology risk while helping it embrace new technology safely and rapidly. CISOs are now expected to shape how the business uses AI, manages data and governs access, while still carrying responsibility for resilience. If the remit keeps growing without the authority or resources to match, the weakness will sit as much in the operating model as in the technology.

73%

The proportion of UAE CISOs citing human risk as their biggest cyber vulnerability

86%

The share of UAE CISOs prioritising the safe use of AI assistants, copilots and automation

81%

The percentage of UAE CISOs who say they now see eye-to-eye with their boards on cybersecurity

SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

COVER FEATURE

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

THE NEXT FRONTIER

Jasim Al Awadi, Chief ICT Officer, du, discusses how sovereign infrastructure, operational control and cyber-first design are becoming central to the UAE’s next phase of AI adoption

SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

COVER FEATURE

he UAE’s next phase of AI adoption will be defined not only by how quickly autonomous systems are deployed, but by where they run, who controls them and how securely they can operate across critical public services. As Agentic AI moves deeper into government workflows, questions around data residency, sovereign compute, operational control and long-term security are becoming inseparable from the technology itself. In this conversation, Jasim Al Awadi discusses what that means for the infrastructure beneath AI, why sovereignty can no longer be reduced to where data is stored, and the role du Tech sees for itself as the UAE moves towards more autonomous government operations. AI adoption is accelerating across the UAE, but moving from experimentation to deployment at scale raises a different set of demands. Where do you see the biggest gap between the ambition to scale and organisations’ ability to do so securely and responsibly? The biggest gap lies in the conflict between national data gravity and the rapid countdown of federal computational demands. The UAE is undergoing a historic evolution; we are no longer just exploring AI, we are governed by a strict mandate to convert 50 percent of all federal government operations and services to autonomous Agentic AI models within the next two years. This aggressive timeline creates an immediate friction point: public sector bodies must scale highly autonomous workflows rapidly, yet they cannot expose sensitive citizen data or breach national residency frameworks. To bridge this gap, du launched du Tech National Hypercloud powered by Oracle Alloy, anchored within du Tech’s expanded Data Centre portfolio. By embedding advanced AI-as-a-Service (AIaaS) and GPU-as-a-Service (GPUaaS) capabilities natively within a sovereign environment—which is officially certified by the UAE Cyber 22

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

As the UAE evolves into the world’s first AI-run government, true sovereignty dictates that the operations, maintenance, patching, and keys are held exclusively by a national entity

Security Council—du provides government entities with the hyperscale infrastructure needed to meet the 50 percent mandate without compromising public trust or federal compliance through du Tech’s comprehensive services and solutions portfolio. AI agents move beyond assisting people to making decisions and executing tasks, the question of autonomy becomes much more consequential. How should enterprises decide how much authority to give them without introducing a new layer of operational and security risk? Autonomy must be directly proportional to the absolute local custody of the underlying infrastructure. Under the UAE’s new government framework, AI agents are transitioning from basic passive assistants into systems that independently analy ae data, make decisions, and execute authori aed background tasks. You cannot grant that level of operational agency to a system if its data pipelines span

international borders or exist in unverified public clouds. To safely fulfil the 50 percent integration mandate, government organisations must anchor their autonomous workflows inside a fully ring-fenced environment like du Tech National Hypercloud. Because this platform is officially certified by the UAE Cyber Security Council under the National Cloud Security Policy, public sector leaders retain absolute, accredited visibility over their agents’ reasoning cycles. The National Hypercloud, backed by du Tech’s robust AI-as-a-Service framework, provides the secure

Alexandre.ROSA / Shutterstock.com

ecosystem required to confidently delegate authority to AI agents, knowing the boundaries are tightly secured in-country by du Tech. Data residency has long been central to discussions around digital sovereignty, but AI introduces questions that go well beyond where information is stored. At what point does AI sovereignty become a question of operational control? Sovereignty shifts from data residency to absolute operational control the moment an Agentic AI system begins driving public

infrastructure. Storing citizen records on a local server is meaningless if the code updates, LLM checkpoints, or operational remote access of that platform are controlled by an external third party outside our borders. As the UAE evolves into the world’s first AI-run government, true sovereignty dictates that the operations, maintenance, patching, and keys are held exclusively by a national entity. This is the core philosophy behind du Tech National Hypercloud. Through Oracle Alloy, du Tech doesn’t just host the cloud; we run the cloud with absolute

operational control. Because our infrastructure is rigorously certified by the UAE Cyber Security Council, government bodies leveraging du Tech’s GPU-as-a-Service or AI-asa-Service are guaranteed a platform that is entirely insulated from global technical or geopolitical disruptions. With “Cyber First” as the theme of GISEC 2026, what should organisations be doing differently as they deploy AI into increasingly critical systems and services? Being “Cyber First” in the age of Agentic AI means shifting from defensive firewalls to active, SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

COVER FEATURE

Being ‘Cyber First’ in the age of Agentic AI means shifting from defensive firewalls to active, sovereign infrastructure-bydesign

sovereign infrastructure-by-design. Historically, security was an afterthought layered onto a finished digital service. Today, with the UAE’s mandate pushing AI agents into core public services like visa renewals, business registrations, and payments, your data is the government infrastructure. If the data layer is exposed during training or execution, the autonomous model itself is poisoned. Doing things differently requires public sector entities to completely bypass unverified public infrastructure. Workloads must be built directly on the National Hypercloud managed locally by du Tech, which stands as the first sovereign cloud platform officially certified and endorsed by the UAE Cyber Security Council. Being cyber-first means using du Tech’s certified AI-as-a-Service and GPU-as-a-Service blueprints to guarantee that as we automate 50

percent of the state’s operations, the foundational intelligence remains implicitly protected under national security frameworks. Sovereign infrastructure has historically been associated with some compromise in scale, performance or access to the latest capabilities. Can enterprises maintain greater sovereignty and control without giving up the pace of innovation they expect from cloud infrastructure? Absolutely—and du Tech National Hypercloud proves that the compromise between national security and technological speed is dead. In the past, a government department choosing a “sovereign cloud” meant accepting limited tools, slower compute, and lagging innovation cycles compared to global hyperscalers. du has shattered that barrier at a time when the UAE’s 24-month clock leaves zero room for compromised performance. By marrying Oracle’s worldclass cloud tech stacks with du Tech’s local operational custody, du Tech National Hypercloud delivers identical performance, hyperscale capacity, and cuttingedge autonomous tools as any global public cloud. Furthermore, because it is certified by the UAE Cyber Security Council, government departments can immediately deploy locali aed GPU-as-a-Service and AI-as-a-Service models, accelerating past regulatory bottlenecks to meet their national targets at uncompromised speeds. Where does the National Hypercloud fit into this, and a year on, what has its evolution told you about what UAE organisations need from sovereign cloud infrastructure? du Tech National Hypercloud has evolved into the absolute engine room of the UAE’s national AI strategy. Over the past year, it has become clear that UAE entities do not just want basic passive data hosting; they demand turnkey, sovereign Agentic AI-readiness.

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

Our recent successful deployment by du Tech for the Dubai Taxi Company (DTC) is the definitive blueprint for this shift. As the transport sector ’s first full-scale modernisation on a sovereign cloud, du Tech migrated DTC’s mission-critical core operations completely onto the National Hypercloud. Backed by our UAE Cyber Security Council certification, this deployment eliminated legacy technical debt and optimi aed performance while keeping them 100 percent compliant with national cloud policies, showcasing exactly how du Tech scales critical national infrastructure. Post-quantum security can still feel like a longer-term concern, even though the data organisations are protecting today may need to remain secure for many years. How early should organisations start preparing, and what needs to happen first? Government organisations must act immediately, because the 50 percent Agentic AI mandate accelerates our exposure to nextgeneration threats. Sophisticated threat actors are actively employing “Harvest Now, Decrypt Later ” tactics—intercepting and storing encrypted public sector data today with the intention of breaking it the moment quantum computing matures. Because the UAE is consolidating its public workflows into autonomous agents, the first line of defence is migrating national data architectures to platforms that are actively building post-quantum cryptography (PQC) into their roadmaps. du Tech is already evaluating and embedding quantum-resistant frameworks within the National Hypercloud and our wider portfolio. By transitioning sensitive workloads, state models, and citizen data pipelines to du Tech’s UAE Cyber Security Councilcertified environment today, government entities ensure their AIaaS and GPUaaS environments are insulated against quantum vulnerabilities well before they arrive.

As AI becomes more deeply tied to public services, national infrastructure and cybersecurity, what role does du Tech see itself playing in the UAE’s next phase of adoption? du, through its operating sub-brand ‘du Tech’, is firmly establishing itself as the ultimate sovereign custodian of the UAE’s digital future, driven by du Tech National Hypercloud. Simple connectivity is a baseline capability of the past. As the UAE aggressively moves into a new era where Agentic AI runs half of the state’s operations, du Tech’s role is to provide the secure, authenticated foundation upon which the

country’s digital economy and public infrastructure survive. Through du Tech National Hypercloud, our robust AI-as-aService and GPU-as-a-Service frameworks, and large-scale public modernisations like Dubai Taxi Company, du ensures that our nation never has to choose between hyper-innovation and absolute digital sovereignty. Having our platform officially endorsed and certified by the UAE Cyber Security Council cements du as the trusted national partner enabling the UAE government to confidently lead, execute, and win the global AI race safely. SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

VIEWPOINT

DEFENCE YIELDS DISRUPTION By Mortada Ayad, VP Sales – META, Delinea

or decades, security teams have operated under a single governing assumption that with privileged access, anything that isn’t airtight, is a liability waiting to be exploited. Eliminate shared accounts. Standardise credentials. Rotate everything on a fixed schedule. The underlying logic has always been clear. If access is loosely governed, an attacker who gets in has nowhere to hide, and everywhere to go. That logic holds for good reason. In 2019, the LockerGoga ransomware spread through Norsk Hydro’s network using compromised credentials, forcing the aluminium producer to switch dozens of plants worldwide back to manual operation for weeks. In 2021, an attacker gained remote access to a water treatment plant in Oldsmar, Florida, through a shared TeamViewer password, and briefly increased the sodium hydroxide levels in the water supply before an operator caught it. Both incidents reinforced the need to govern privileged access tightly and accept that one compromised credential can reach further than anyone intended. And yet, walk around most OT environments and you’re likely to see a shared administrator password taped inside a control cabinet; a service account credential nobody has changed since the system was commissioned over a decade

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

ago; a vendor’s remote access left standing open because closing it once triggered two days of downtime. The reflex would be to call these failures of discipline, as if the people who implemented and follow them simply stopped caring about security. In truth, they never stop caring. They’ve simply been prioritising something else that, in their world, matters just as much – keeping the plant running. The collapse of the standardisation assumption

Enterprise IT can often move fast. Systems get patched on a schedule, workflows get redesigned, and access models get standardised across the business with relatively little friction. Operational technology rarely offers that flexibility, and the reasons aren’t cultural. They’re structural. OT environments on the other hand are built from long-lived assets, vendor-locked systems, segmented networks, and maintenance windows measured in hours per year rather than hours per week. A locked-out account in enterprise IT is an inconvenience. A locked-out account in OT, during an incident, can mean a production line stays down, a safety system can’t be reset, or a technician can’t respond to a fault before it cascades. That single difference is why shared administrator accounts, long-lived service credentials, and

standing vendor access persist for years after security teams have flagged them. They are not evidence that OT stopped caring about security. They are evidence that OT has been solving for continuity in a way that enterprise identity standards were never asked to. The risk of getting the fix wrong

This is usually where things go wrong. A new access control model shows up promising to eliminate the shared account, force individual logins, or rotate every credential on the same schedule, and when the operations team pushes back, that gets written off as resistance to change. However, if a workaround existed because the alternative created downtime, removing it without replacing the underlying capability

In OT, an availability failure isn’t a lesser evil than a security gap

doesn’t eliminate risk. It relocates it. Pull a shared break-glass account without a faster alternative in place, and the next emergency response is slower, not safer. Force credential rotation on a service account without first mapping what depends on it, and the process that account was quietly protecting can break instead. In OT, an availability failure isn’t a lesser evil than a security gap. It can be a safety incident. Trading

one for the other isn’t modernisation. It’s a different kind of risk, arriving on a different day. Governing access without breaking continuity

The way through this isn’t to remove persistent access and hope operations adapt. It’s to make each access path faster to govern than it is to work around. That starts with credentials. Static passwords sitting in a spreadsheet or a technician’s memory should instead be vaulted and rotated on a schedule built around actual maintenance windows, not a generic IT policy. Done well, the account stops being a liability without anyone losing the fast access they relied on it for. Remote access follows the same logic. Rather than stripping out vendor and engineer connectivity

outright, sessions should be brokered through a controlled path that is proxied, monitored, and recorded. This way, access stays as fast as it was, but every connection now has a clear record of who connected, when, and what they touched. Speed and accountability stop being a tradeoff. On the endpoint, the goal isn’t to strip local admin rights and create a new bottleneck every time a technician needs to run a diagnostic tool. It’s to replace standing privilege with controlled elevation, so that approved work still moves forward, but full administrative access isn’t sitting open by default, waiting to be misused. And underneath all of it, service and technical accounts get discovered and assessed rather than left untouched out of fear. Visibility doesn’t require immediately changing how those accounts work. It just means someone finally knows they exist, what they touch, and who’s responsible for them. Crucially, none of this requires flattening the segmentation, separate directories, or sitespecific identity models that OT environments depend on for good operational reasons. The goal is governance that fits the structure already in place, rolled out one access path at a time rather than a single mandate applied everywhere at once. Continuity first, then control

Prevention still matters, and the instinct to tighten privileged access in OT is the right one. But prevention that arrives as a blank slate, indifferent to why the old model existed, tends to get quietly reversed the first time it causes downtime. Success has less to do with the elegance of the access model and more to do with sequencing: understand why the old workaround existed before touching it, and then build something that earns operations’ trust by proving it can do the job the workaround was doing, only better. SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

VIEWPOINT

BEYOND THE F LINE OF SIGHT By Dr. Chaouki Kasmi, Chief Innovation Officer, Technology Innovation Institute (TII)

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

or decades, organisations have responded to evolving security threats by adding more cameras, more sensors and more surveillance technology. Yet despite these investments, many security operations continue to face the same fundamental challenge, not detecting incidents, but understanding them quickly enough to respond effectively. The challenge is no longer visibility, it is interpretation. Most organisations already collect vast amounts of information from video surveillance, access control systems, perimeter detection, screening technologies and environmental sensors. Yet these technologies frequently operate

Intelligent security operations do not replace human judgement, they strengthen it independently, leaving operators to piece together fragmented information across multiple interfaces while managing an increasing volume of alerts. This approach is becoming increasingly difficult to sustain.

Critical infrastructure is more connected, operational environments are more complex and security teams are expected to make faster decisions under greater pressure. Simply adding another camera or another detection system does little to solve the underlying problem if the information remains disconnected. Monitoring alone no longer delivers effective security. What organisations increasingly need is the ability to turn scattered signals into coordinated action. The next step in the evolution of security is not collecting more data but creating a shared operational picture that brings together information from existing systems, helping authorised personnel understand what is happening as events unfold rather than after they have occurred. This is where artificial intelligence is emerging as the operational layer that connects existing security technologies. Rather than replacing cameras, sensors or screening systems, AI correlates information across multiple sources in real time, providing context, identifying

relationships between events and helping operators focus on the incidents that require immediate attention while ensuring humans remain central to operational decision-making. Detecting an incident is only the beginning. Effective security depends on helping operators understand what has happened, determine what matters most and coordinate an appropriate response across multiple teams. Without context, alerts remain isolated notifications. With context, they become operational intelligence that enables faster, more coordinated and betterinformed decisions. Supporting operators in this way is becoming increasingly important as organisations seek to strengthen resilience without replacing existing infrastructure. The focus is shifting towards intelligent platforms that integrate with established security investments, reinforce existing operational procedures and provide authorised teams with a common operational view. This enables security, operations and emergency response personnel to work from the same understanding of an incident rather than reconciling partial views from separate systems. This represents a broader shift in how organisations think about security. Success will no longer be measured by the number of cameras deployed or the volume of data collected, but by how effectively information, people and operational processes are connected to enable timely action. Intelligent security operations do not replace human judgement, they strengthen it. By providing context, prioritising what matters most and helping teams coordinate more effectively, AI has the potential to improve resilience across increasingly complex operational environments. The future of security will belong not to the organisations that collect the most data, but to those that can transform information into coordinated response. SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

INTERVIEW

GOVERNING A THE AUTONOMOUS ENTERPRISE

Ricky Mahar, UAE Country Manager, Accelera Digital Group (ADG), explores why enterprises will need a more deliberate approach to authority, data sovereignty, and human judgement as AI moves deeper into business operations

sk any CIO or CTO what they want from a graduate today and technical skills still feature high on the list. Increasingly, though, they are no longer enough. Agentic AI raises a harder enterprise question than whether the technology works. Once a system can initiate transactions, alter workflows or make decisions with financial, regulatory or customer consequences, leaders have to decide how much authority it should have. “The line should be drawn based on risk and consequence, not the sophistication of the technology. I have spent much of my career in financial services and insurance, where organisations have always had to balance automation with judgement. The SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

INTERVIEW

principle is straightforward: the greater the financial, regulatory, reputational or customer consequence of a decision, the stronger the oversight should be,” says Ricky Mahar, UAE Country Manager, Accelera Digital Group (ADG). Routine information processing can tolerate more freedom than moving money, approving credit or making an underwriting decision. Autonomy can also expand as confidence builds. “I think about this as progressive autonomy. Initially an agent observes and recommends. Then it acts within defined parameters. As the organisation builds evidence around its performance, controls and reliability, those parameters can expand,” says Mahar. Human involvement still has to be placed carefully. Requiring approval for every action risks preserving the friction automation is meant to remove. “However, human involvement should not mean requiring somebody to approve everything an agent does,” says Mahar. “That simply recreates the old operating model with another technology layer on top of it. The objective is human judgement at the points where judgement creates value, and autonomy everywhere else where it can safely improve speed, consistency and unit economics.” Sovereignty in the architecture

Gulf organisations often operate across jurisdictions, while government, financial services, healthcare and energy manage highly sensitive information under specific regulatory requirements. Data location, access and processing therefore have to be designed into the environment from the outset. “Sovereignty has to become an architectural principle, rather than a compliance exercise performed after an AI solution has been built,” explains Mahar. “Enterprises need to know where their data originates, how it is classified, which agents and models can access it, where 32

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

Sovereignty has to become an architectural principle, rather than a compliance exercise performed after an AI solution has been built inference and processing take place, what can cross jurisdictions and what cannot.” One model, cloud or environment is unlikely to suit every task. Enterprises may need to route workloads across models, data sources and infrastructure according to sensitivity, risk and jurisdiction. For Gulf organisations, that is also a commercial question, given the valuable proprietary data they hold across sectors from finance and energy to aviation, healthcare and government. “The question is whether organisations simply use generic AI capabilities or combine those capabilities securely with their own

proprietary data, workflows and institutional knowledge,” says Mahar. He adds: “Because as foundation models become increasingly accessible, access to the model itself becomes less differentiating. The competitive advantage moves towards the proprietary context around it: your data, customer relationships, workflows, domain expertise and the ability to connect AI safely into the systems where work actually happens.” In financial services, new platforms can combine behavioural, financial and market data in ways individual institutions historically could not, making proprietary context a potential economic moat rather than simply a regulatory obligation. From pilots to operating model

The region already has much of what it needs to move quickly. The harder question is how enterprises convert that momentum into something repeatable across the organisation. “The Gulf already has many of the ingredients: ambition, capital, infrastructure and strong government support for AI adoption.

The next challenge is execution. I see five things coming together: strategy, data, technology, operating model and people,” says Mahar. The numbers underline the gap between adoption and value. A recent study by McKinsey shows that 84 percent of GCC organisations are already using AI and 60 percent are using AI agents to some extent. However, it also revealed that only 31 percent have scaled or fully deployed AI, while just 11 percent are generating material value. Part of the difficulty lies in creating an environment where individual projects do not have to resolve the same fundamental questions every time they move towards deployment. “We shouldn’t assume that speed and control are opposites,” says Mahar. “In fact, poorly designed governance often slows organisations down because every AI initiative has to negotiate the same questions around data, security, models, approvals and accountability from scratch.” Enterprise-wide rules can give teams clearer parameters within which to move, while keeping decisions around data access, approved infrastructure and accountability consistent across the organisation. “The better approach is to establish the enterprise guardrails once: approved models and infrastructure, identity and access controls, data classifications, auditability, monitoring, escalation rules and clearly defined boundaries around what agents can do. Teams can then innovate rapidly inside those boundaries.” The economic case for getting this right is already becoming visible. McKinsey has found AI-led transformations delivering 20–40 percent reductions in customer onboarding costs, alongside 10–20 percent improvements in insurance agent productivity. The bigger opportunity, however, is not simply doing today’s work faster. As AI reduces the marginal cost of intelligence and execution,

it has the potential to change the economics of processes that have historically scaled with headcount. Technology alone, however, will not close the gap between experimentation and enterprisewide deployment. AI has to become part of how the organisation operates, rather than remain a programme owned primarily by the technology function. Who remains accountable?

Human oversight becomes more nuanced as autonomy spreads across different kinds of work. A single model of intervention makes little sense when one agent may be processing routine information while another is involved in decisions carrying significant financial, regulatory or customer consequences. “There are really three models. Humans can be in the loop, approving high-consequence decisions before they occur,” says Mahar. “They can be on the loop, monitoring agents operating autonomously within predefined tolerances and intervening when something falls outside those boundaries. And senior leadership must remain above the loop, defining objectives, permissions, risk appetite and ultimately determining how much autonomy the organisation is willing to grant.” UAE regulation is already putting clearer expectations around where that responsibility sits. The Central Bank of the UAE’s 2026 guidance on responsible AI adoption in financial services places responsibility and accountability for AI systems and their outcomes with senior management and boards. The UAE AI Charter also puts human oversight, transparency, governance and accountability at the heart of responsible AI, while the National Cyber Security Policy for AI calls for governance frameworks, visibility over AI assets and human oversight for critical decisions. DIFC has gone further in addressing autonomous systems directly. Its Data Protection Regulation 10 covers personal data

processed through autonomous and semi-autonomous systems as its regulatory framework evolves alongside its ambition to become an AI-native financial centre. “Accountability has to remain with the organisation and ultimately with human leadership. Delegating a decision does not delegate accountability,” says Mahar. As agent populations grow, enterprises will need a much clearer picture of what is operating across the business and who owns the outcome. “As organisations deploy hundreds or eventually thousands of agents, I expect enterprises will maintain something resembling a digital workforce register: which agents are operating, who owns them, which systems and data they can access, what decisions they are permitted to make and how their performance is monitored,” says Mahar. Visibility must also extend to what autonomous systems actually do, with a clear audit trail of the data used, systems accessed and points of human intervention. “You cannot govern an autonomous enterprise if you cannot see the autonomous systems operating inside it,” says Mahar. “Organisations also need to redesign work rather than simply layering AI onto existing processes,” says Mahar. “The question leaders should be asking isn’t ‘Where can we add an AI agent?’ It is: ‘If we designed this process today, with humans and AI working together, what would it look like?’” As adoption accelerates, the bigger opportunity is to turn the region’s momentum into a model for how autonomous enterprises are built, governed and scaled. “The Gulf has an opportunity to move from being one of the world’s fastest adopters of AI to becoming a global proving ground for the autonomous enterprise,” says Mahar. The foundations are already in place. The challenge now is orchestration, turning the Gulf ’s AI ambition into sustainable enterprise value. SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

FEATURE

THE QUANTUM DEADLINE Quantum computing may still be some distance from breaking today’s encryption, but the preparation window is already narrowing. Experts discuss why cryptographic discovery, data longevity and crypto-agility need attention well before Q-Day arrives

uantum security is moving from long-range concern into enterprise planning. There is still no reliable date for when a cryptographically relevant quantum computer will be capable of breaking widely used public-key encryption, but the work required to prepare is becoming clearer. “Quantum shouldn’t be the priority today. Knowing where your cryptography lives is,” says Gavin Millard, VP - Intelligence at Tenable. “That holds whether the hardware

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

arrives in 2030 or 2040. Nobody credible will give you a date. But the estimates only move one way. Six years ago, researchers thought breaking today’s encryption would need a quantum computer twenty times larger than the one they now think would do it. The machine still doesn’t exist. The bar keeps dropping.” Standards and migration timelines are already taking shape, but Millard argues that the larger challenge comes before any organisation starts replacing

algorithms. “The standards aren’t the blocker either. NIST finalised the first three in August 2024. The UK’s NCSC wants migration plans in place by 2028 and the job finished by 2035,” he says. “Ten years sounds generous. It isn’t. The first task is the one almost nobody has finished: find every place cryptography is used, including the parts you inherited and the parts you bought. You cannot migrate what you cannot find.” Jan D’Herdt, SANS Certified Instructor at SANS Institute, sees

the migration period itself as the more meaningful deadline. “Migration (inventorying crypto, replacing it across every system, vendors) takes a bit of time and planning. It is not something that can be done in a day,” he says. “That migration is the real deadline we as companies face, not ‘Q-Day.’” The deadline before the deadline

The timetable becomes more pressing for information that needs to remain confidential for many years. Harvest now, decrypt later assumes an attacker does not need to break the encryption today. Capturing the data and retaining it may be enough if it remains valuable by the time the technology catches up. “Adversaries (especially state actors) are already capturing encrypted traffic and storing it, knowing that a cryptographically relevant quantum computer will

eventually let them decrypt it,” D’Herdt says. “If your data needs to stay confidential for 10 years or more (e.g., IP, health records, government communications), the attack has effectively already started even though the decryption hasn’t. In other words, you are too late if the time your data needs to stay secure and the time for migration is longer than the time until a quantum computer can break current crypto.” How long the data remains sensitive will determine where some organisations need to act first. “I believe this depends on your data’s lifecycle, and that’s exactly what most organisations haven’t mapped. If the data is still sensitive and valuable in 10 years or more, harvest now, decrypt later is your big-ticket item. That data is being stolen right now, in encrypted form, for a decryption that hasn’t happened yet,” D’Herdt says. “If the data’s value decays fast (transactional data, session tokens, most day-to-day business traffic), the harvesting risk is lower. Now it shifts to legacy systems, because these systems you can least afford to touch: end-of-life hardware, embedded crypto in appliances, vendor black boxes.” Millard places more emphasis on the exposure organisations can still address. “Of those three, harvested data gets the headlines and is unfortunately the one you can do least about. You have to assume some data has already left. You can’t unsend it, so the only useful question is how long it stays sensitive,” he says. “If your data outlives your migration to quantum-secure encryption, you’re already late.” Data classification and cryptographic discovery have to happen together. Knowing which algorithm is in use is only useful if the organisation also knows what it protects, how long that information must remain secure and whether the cryptography can be changed. Where control ends

Enterprise systems contain far more cryptography than the certificates

Quantum shouldn’t be the priority today. Knowing where your cryptography lives is GAVIN MILLARD TENABLE

and applications directly managed by security teams. Algorithms can be embedded inside commercial software, appliances, firmware, libraries and third-party services, with customers having little or no control over how they are changed. “Now even if you know your own data’s sensitivity, it is possible that a share of your crypto exposure sits inside vendor products, embedded libraries, third-party services and you can’t directly patch,” D’Herdt says. “What if you have a vendor product and the vendor is out of business or the equipment is end of life but you still want to use it? Can you actually change the crypto? The honest answer is, it depends on your organization and your risks. Different organizations have different risks and you will need to SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

FEATURE

do a bit of risk management.” Millard considers those dependencies the more serious blind spot. “The dangerous blind spot is the cryptography you don’t control. Third-party libraries, vendor appliances, embedded firmware, a SaaS platform terminating TLS somewhere you’ve never looked,” he says. “When you can’t migrate it, you can only ask. So ask. ‘Which algorithms do you use, and when will you move to quantum-secure encryption?’ belongs in every contract renewal from now on.” Supplier timelines will become part of the enterprise migration timetable. Unsupported products may need to be replaced earlier than expected, while procurement teams will need greater clarity on the cryptographic roadmaps of vendors whose technology sits inside critical environments. Millard draws a line between having a roadmap and knowing what the migration actually involves. “A roadmap is a document. Readiness is an inventory,” he says. “The test is simple but hard for most to pass. Can you say today which systems use RSA or elliptic curve, where the keys live, who issued them, and which suppliers have committed to a date? If assembling that takes weeks, you have a roadmap.” Regional initiatives are already placing greater emphasis on discovery. Millard points to the UAE Cyber Security Council’s agreement with the Advanced Technology Research Council, whose centrepiece is a national crypto discovery tool. “The region has already grasped this,” he says. “In May the UAE Cyber Security Council signed an agreement with ATRC whose centrepiece is a national crypto discovery tool, not a new algorithm. That’s the right order of operations.” D’Herdt describes the same foundation as a Cryptographic Bill of Materials, or CBOM. “Readiness is being able to answer where your cryptography exactly is and how you change it. The first step is developing a Cryptographic Bill 36

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

The dangerous blind spot is the cryptography you don’t control JAN D’HERDT SANS INSTITUTE

of Materials (CBOM), because organisations cannot protect or replace what they have not inventoried,” he says. “This means understanding which algorithms, key lengths and protocols are in use across systems, applications and third-party products.” Built for the next algorithm

An inventory does not make the cryptography itself easier to change. Post-quantum cryptography includes different standards for different functions, rather than one algorithm replacing everything enterprises use today. “Organisations need to build crypto-agility rather than approach PQC as a one-time replacement exercise. PQC is not a single algorithm that can simply be dropped in,” D’Herdt says. “FIPS 203 (ML-KEM) addresses key

exchange, while FIPS 204 (MLDSA) and FIPS 205 (SLH-DSA) address digital signatures, and they solve different problems. Genuine readiness therefore means having the ability to swap algorithms without re-engineering systems or applications each time a standard evolves.” Millard sees the same issue in the way much of the existing technology estate has been designed. “Most systems have their encryption welded in,” he says. “The organisations that migrate calmly by 2035 will be the ones who spend the next two years making algorithms a configuration choice rather than a rebuild.” The migration will also need clear priorities. “The transition should also be risk-based, with the CBOM linked to data classification so that long-lived, highly sensitive data and critical systems are prioritised, while lower-risk, short-lived data can follow later,” D’Herdt says. “Organisations need a clear migration plan with defined owners, milestones and vendor responsibilities, including contractual pressure for their own PQC timelines.” Testing will form part of that work as post-quantum algorithms introduce different key sizes and performance characteristics, with interoperability and performance needing to be validated before wider deployment. For D’Herdt, “Ultimately, preparedness, rather than the arrival of a quantum computer itself, will be what separates organisations that can make the transition effectively from those that cannot.” The date on which quantum computing can break today’s encryption remains uncertain. The migration window is easier to see. Organisations that use the intervening years to make cryptography visible and easier to replace will have more room to respond as standards mature and quantum capability advances. Those that wait for certainty over Q-Day may find there is too little time left to move.

Distributing Outcomes

Turning obstacles into opportunities

VIEWPOINT

THE NEXT LAYER OF CARE By Abdullah Al Khorami, Chief Business Officer, Etihad Salam Telecom Company

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

audi Arabia has already moved the numbers that matter most in healthcare. Life expectancy reached 79.7 years in 2025, close to the Vision 2030 target of 80, and primary healthcare now covers 97.5 percent of population clusters across the Kingdom. The Sehhaty app has passed 31 million users, and the Seha Virtual Hospital has served more than 365,000 patients through 241 connected facilities. The ambition is set, and the early results are real. The pressure behind those numbers keeps rising. Non-communicable diseases now cause about 74 percent of all deaths in the Kingdom and cost it an estimated SAR 91.6 billion a year, close to three percent of GDP, according to a Ministry of Health, UNDP and WHO study. A growing, aging

5G SPEED. WI-FI 6. ONE POCKET-SIZED CONNECTION Stay connected wherever life takes you with the D-Link DWR-500V 5G Mi-Fi. Enjoy fast, reliable internet in a compact device that’s easy to take with you—perfect for home, work, travel, or wherever you need a connection. Connect multiple devices and stay online for longer with its powerful built-in battery.

5G High-Speed Internet Wi-Fi 6 for up to 32 Devices USB-C Charging

6000mAh Long-Lasting Battery

DWR-500V 5G Mi-Fi

Connect More. Simply.

Switch to Speed. Scale Without Limits.

Meet the SwitchBlade x908 GEN3 The SwitchBlade x908 GEN3 is our most advanced modular switch, delivering blazing speed and scalable growth for future-ready enterprise and data center networks. 

Blazing Bandwidth: Up to 400G connectivity for high-performance workloads.



Scale Without Limits: 12.8 Tbps of power in a compact 3U chassis.



Flexible & Modular: Compact chassis with versatile interface options.



Smart Management: Zero-touch provisioning and centralized control with AlliedWare Plus™.

Whether you’re scaling a data center or optimizing enterprise networks, the SwitchBlade x908 GEN3 keeps your network fast, flexible, and fail-proof.

Take control. Stay ahead. Transform your network today. For more information, please contact one of our Allied Telesis Account Managers today.

+971 +97144454 4548740 8740 | | AlliedTelesis.com AlliedTelesis.com

VIEWPOINT

population adds demand every year. Chronic disease at that scale is where AI earns its place in care: earlier detection from imaging and lab data, risk scoring that flags patients before a crisis, and remote monitoring that keeps people out of hospital beds. Those are the tools that move patient outcomes, and each one depends on data infrastructure that works reliably. The next set of gains is harder to reach. Cutting diagnostic wait times, catching disease earlier, and personalising treatment at population scale all depend on artificial intelligence applied inside clinical workflows. The market is moving quickly. Saudi Arabia’s AIin-healthcare sector is projected to grow from USD 87.5 million in 2025 to USD 638 million by 2034, a compound annual rate of 24.7 percent, according to IMARC Group. That growth will improve patient outcomes only if the technology behind it is deployed, secured, and run reliably across hundreds of facilities. This is where the constraint sits. AI in a hospital is not a single application. It is a chain of dependencies: high-bandwidth, low-latency connectivity between sites, cloud and edge compute to run models near the point of care, data pipelines that move imaging and records securely, and cybersecurity strong enough

A diagnostic model is only as useful as the network carrying the scan and the compute returning the result. Each link has to work, at scale, every day

to protect patient data under regulation. A diagnostic model is only as useful as the network carrying the scan and the compute returning the result. Each link has to work, at scale, every day. Telecom operators already own most of that chain. Saudi Arabia ranks among the global leaders in 5G, with average download speeds of 314 Mbps in 2025, according to GSMA Intelligence. The operators that built that network also run national data centres, security operations centres, and managed-service teams that keep critical systems available around the clock. The shift underway across the industry is from selling connectivity to delivering the full technology stack that sits on top

of it: AI, 5G, cloud, cybersecurity, and managed services under one accountable operator. That model matters because the real risk in the Kingdom’s digitalhealth agenda lies in execution. The strategy and the funding are already committed; delivery is the variable. McKinsey’s global research across industries found that fewer than one-third of large-scale transformations succeed, and that even successful programs capture only about 67 percent of the value they targeted, while the average company realises just 37 percent, according to McKinsey & Company. Value leaks at every stage, from targetsetting through implementation. Healthcare has less tolerance for that leakage than most sectors, because a failed rollout there is measured in patient care, and the cost compounds quickly. Fragmented procurement is how that value leaks in practice. When connectivity comes from one vendor, cloud from another, security from a third, and integration from a fourth, accountability dissolves. If a diagnostic platform underperforms, a hospital cannot afford four suppliers pointing at each other while patients wait. It needs one operator answerable for the network, the compute, the security, and the uptime, with service levels tied to clinical continuity rather than component delivery. Saudi Arabia has the strategy, the funding, and the infrastructure base. The execution question across healthcare institutions is one of who can take an AI ambition and stand it up across a region, keep it secure, and keep it running over time. Operators that have already built and managed national-scale networks are well positioned to answer it, particularly those that move toward end-to-end delivery rather than component supply. AI ambition in healthcare is not in short supply. Better patient outcomes tend to follow from organisations that can execute at scale and be held accountable for results. SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

BRAND VIEW

Building for AI:

The changing economics of data centre power

As AI drives data centre density and power demand higher, operators are rethinking how efficiency, resilience and cost are managed across the power chain By Huawei

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

he rapid expansion of AI infrastructure is forcing data centre operators to revisit assumptions that have shaped power design for decades. Much of the industry discussion has centred on GPUs, compute capacity and rising rack densities. Yet the implications for electrical infrastructure are just as significant. As individual racks move towards 100 kW and large AI campuses scale into hundreds of megawatts, relatively small inefficiencies in the power chain can translate into significant operating costs, additional cooling demand and greater pressure on supporting infrastructure.

In markets like China, the rapid expansion of AI and high-density computing infrastructure is pushing operators to examine not only how much power a data centre can secure, but how efficiently that power can be converted, distributed and protected. Similar questions are becoming more pressing across the Middle East as Saudi Arabia, the UAE and other regional markets expand sovereign cloud, hyperscale and AI infrastructure. For operators planning facilities that may consume hundreds of megawatts, the efficiency of the power architecture can no longer be treated as a secondary engineering consideration.

Rethinking the efficiency trade-off Traditional uninterruptible power supply systems have typically relied on online double-conversion architectures. Incoming AC power is converted into DC and then converted back into AC before reaching the IT load. The approach provides high power quality and isolates critical systems from fluctuations in the utility supply, which is why it has remained a standard choice for mission-critical environments. The trade-off is that every conversion introduces electrical losses and generates heat. These losses may appear relatively small at system level, but their financial impact changes considerably as facilities become larger. A one percentage-point difference in efficiency across a 100 MW environment represents a very different cost equation from the same difference in a conventional enterprise data centre. Additional heat also has to be removed, creating a secondary effect on cooling requirements and power usage effectiveness. ECO operating modes emerged as one way of reducing these losses. When utility power meets the required quality thresholds, the UPS bypasses the rectifier and inverter stages and supplies electricity directly to the load. The efficiency gain comes with engineering compromises that have limited the use of conventional ECO modes for highly sensitive environments. If utility power becomes unstable, switching back to inverter power can introduce an interruption measured in milliseconds. That may sound negligible, but high-value computing infrastructure can be sensitive to even extremely short disturbances. Power quality presents another concern. AI data centres are not made up solely of servers and accelerators. Cooling systems, fans and other mechanical infrastructure introduce nonlinear loads that can generate reactive power and harmonic distortion. In

a traditional bypass configuration, these harmonics may not be actively compensated. Large facilities also tend to operate multiple UPS systems in parallel. Small differences in components, cable lengths and electrical impedance can produce uneven current distribution, leaving one UPS carrying more load than another. At sufficient scale, that imbalance becomes a reliability issue rather than simply an engineering inconvenience. From conventional ECO to adaptive power These constraints are leading power infrastructure vendors to rethink the traditional distinction between high-efficiency bypass operation and double-conversion reliability. Huawei Digital Power’s Adaptive S-ECO architecture is one example emerging from this shift. Proven against the requirements of increasingly dense computing environments, the system focuses on three areas that have historically constrained ECO operation: transfer interruption, harmonic distortion and current imbalance between parallel UPS systems. Its hardware clamping architecture keeps an inverter in hot-backup mode at a voltage slightly below the utility supply. If utility voltage falls below the required level, the inverter can take over without the startup delays associated with a conventional ECO design. Huawei reports a transfer time of 0 ms and system efficiency of up to 99.1 percent, with the system designed to meet Class 1 dynamic response requirements under IEC 62040-3. The inverter also remains active in managing power quality. Rather than allowing harmonics generated by nonlinear loads to pass back through the system unchecked, it analyses load current and generates compensating current in the opposite phase. Huawei’s testing found that input current distortion exceeding 70 percent THDi under a specified nonlinear-load condition could be reduced to below 10 percent, and to below five percent at full load. SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

BRAND VIEW

For parallel UPS installations, the system monitors current across individual bypass paths and adjusts the firing angle of the siliconcontrolled rectifier to influence their effective impedance. Huawei reports that, under its test conditions, current imbalance could be held within five percent for resistive loads and within 10 percent for nonlinear loads even where cable lengths differed substantially.

As AI pushes compute density higher, data centre design will increasingly be judged by how effectively the entire infrastructure supports that density

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

What this means for Middle East operators The engineering detail matters because efficiency at this scale has a direct relationship with operating economics. Huawei estimates that a 100 MW data centre using Adaptive S-ECO could deliver significant annual electricity cost savings compared with traditional doubleconversion operation. Actual savings will vary depending on electricity tariffs, utilisation, facility design and operating conditions, but the underlying economics become increasingly important as Middle East operators build larger, more power-intensive campuses.

The region’s data centre market is moving into a phase where capacity is being planned not in individual megawatts but, increasingly, in hundreds of megawatts across large sites and clusters. At those levels, operators have to account for the cumulative cost of every conversion loss across the power chain. Efficiency also influences how much of the available electrical capacity ultimately reaches revenuegenerating IT equipment rather than being consumed by supporting systems. Component life adds another dimension to the calculation. Traditional double-conversion architectures keep power components under continuous electrical and thermal load. Huawei says operating components in a lower-stress hot-standby state for much of their service life could potentially extend equipment life from approximately 10 years to 15 years. That claim will depend on operating conditions and individual deployments, but it highlights a broader issue for data centre owners. Power architecture affects not only monthly electricity consumption, but maintenance cycles, asset replacement and the long-term economics of the facility. As AI pushes compute density higher, data centre design will increasingly be judged by how effectively the entire infrastructure supports that density. The industry has already invested heavily in improving server utilisation, cooling technology and facility design. Power conversion represents another area where incremental efficiency gains can become substantial once they are multiplied across hundreds of megawatts. For Middle East operators building the next generation of AI infrastructure, experience from high-density markets, including China, provides a useful reference. The objective is no longer simply to maximise available power capacity. It is to ensure that more of that capacity reaches the computing infrastructure reliably, with as little lost along the way as possible.

VIEWPOINT

THE PRICE OF CONVERGENCE By Vibin Shaju, VP, EMEA Solutions Engineering, Trellix

n today’s threat landscape, operational technology (OT) environments are prime targets. Trellix research recorded 1.3 million detections across 155 unique campaigns targeting OT and industrial control system-linked environments between October 2025 and March 2026. More significantly, over 1,600 OT-impacting ransomware attacks were observed during the period, accounting for 29.5 percent of all ransomware activity. These are not attacks on peripheral systems. They 46

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

are targeting the backbone of national stability, particularly at a time when geopolitical tensions in the Middle East are placing extraordinary strain on supply chains, energy security, and infrastructure continuity. Even in more stable times, defending these environments has been a complex challenge. OT systems were not designed with modern cybersecurity threats in mind, and their integration with IT systems has historically been cautious. Today, that has changed dramatically. Faced with

disruption, from rerouted shipping lanes to fluctuating energy demand and supply shortages, organisations across these sectors have been forced to accelerate digital transformation in a bid to enhance efficiency and resilience. Resilience-driven transformation

This has triggered a wave of ITdriven innovation across traditionally isolated OT environments. Remote access solutions have been expanded to maintain operations across distributed sites. Enterprise resource planning systems are being more tightly integrated with manufacturing execution systems to optimise production in real time. Cloud platforms and data analytics are being deployed to improve visibility and decision-making across the value chain. The paradox at the IT/OT perimeter

But here lies the paradox. The very measures designed to enhance resilience are inadvertently introducing new vulnerabilities. The convergence of IT and OT is expanding the enterprise attack surface and, more critically, shifting

Enterprise Security, Continuously Managed. Monitor

Adapt

Detect

Cyber Resilience CONTINUOUS OUTCOME

Optimize

Hunt

Respond

We don't just monitor your security tools. We continuously improve your ability to withstand, respond to and recover from threats. 24×7 threat monitoring & response

Always-on visibility across your environment, with rapid action when it matters.

Threat hunting & risk intelligence

Proactively surfacing hidden threats and emerging risk before they become incidents.

Integrated security operations

Unified tooling and workflows that close the gap between detection and action.

Compliance & security assurance

Continuous validation against the frameworks and regulations you are held to.

Continuous security optimization

Ongoing tuning of controls, detections and response, driven by real outcomes.

www.teksalah.com UAE | QATAR | INDIA

VISIT US AT GISEC 2026 Hall No: 3 | Stand No: C36

VIEWPOINT

the battleground to the boundary between these two domains. This IT/OT interface has become the most strategically significant, and most vulnerable, layer in modern industrial environments. Threat actors have recognised that directly targeting low-level controllers within OT environments is both difficult and high risk. Instead, they are focusing on Level 3 and Level 4 systems. These are the IT-facing layers that bridge enterprise and operational networks. These systems run on more familiar technologies, often carry IT-like vulnerabilities, and provide a far more scalable entry point. Yet, once compromised, they offer a direct pathway to highly kinetic outcomes, including the ability to manipulate production data, disable safety systems, or disrupt operations at scale.

Integration: the new pivot point

Equally concerning are the integration points that underpin modern efficiency initiatives. Software that connects ERP systems to manufacturing execution systems (MES) has become a high-privilege pivot point into core OT environments. These platforms are designed to enable seamless data flow between business and production layers. But in doing so, they create a direct bridge that attackers can exploit. A vulnerability in an enterprise application, or a remote code execution flaw in a connected system, can quickly escalate into control over operational processes. To address this, organisations must fundamentally rethink how they secure these integration layers. Network segmentation must be rigorously enforced, with

Virtual attacks, real-world impact

The techniques being used reflect this shift. Trellix recorded 9,705 PowerShell detections during the reporting period, alongside widespread use of techniques such as scheduled tasks, system discovery, file deletion and the disabling or modification of security tools. These are not bespoke OT exploits. Instead, they are standard IT attack techniques now being repurposed to devastating effect. Often, the pivot from IT into OT begins with something much more conventional. Attackers exploit public-facing applications such as VPN appliances and web servers, or establish an initial foothold through spearphishing. From there, stolen credentials and familiar tools enable lateral movement and reconnaissance as attackers identify OT-adjacent systems and cross network boundaries. Once inside OT environments, legitimate industrial protocols such as Modbus and IEC-104 can then be abused to manipulate operational systems. This makes detection particularly challenging because attackers are increasingly using technologies and pathways that already exist within the environment.

The fundamental point is this: resilience and security can no longer be treated as parallel priorities. Nor can either be achieved through speed alone clearly defined security zones and tightly controlled access points between IT and OT environments. Industrial firewalls and data diodes can help prevent unauthorised lateral movement, but they must be complemented by continuous monitoring that understands both IT and OT protocols. The goal is not to add another layer of tools, but to reduce complexity. Standardising on better-integrated, correlated monitoring closes the gaps between systems that attackers currently exploit. Securing access in a hyperconnected environment

Remote access, in particular,

demands a zero-trust approach. Every connection, whether from an internal user, a thirdparty vendor, or a long-standing systems integrator, should be treated as untrusted by default. Multifactor authentication, timebound credentials, and full session monitoring are essential to reduce the risk of compromise. In an environment where remote connectivity has become critical to resilience, it cannot also remain the easiest path for attackers. This is precisely where an AI security fabric built to work across cloud, on-premises, air-gapped, and OT environments earns its place, giving security teams the visibility and context to catch anomalous access before it escalates, wherever that access originates. Supply chain dependencies add another layer of complexity. OT environments rely on a diverse ecosystem of vendors, each introducing potential vulnerabilities through software updates, remote maintenance, or embedded components. Requiring software bills of materials, validating digital signatures, and enforcing strict vendor accountability are no longer best practices, but baseline operational necessities. As organisations expand their supplier networks to mitigate disruption, they must ensure that security standards extend beyond their own perimeter. Resilience and security: Two sides of the same coin

The fundamental point is this: resilience and security can no longer be treated as parallel priorities. Nor can either be achieved through speed alone. Defence at machine speed is only effective when it is intelligence-led, as speed without context creates noise, not resilience. The IT/OT boundary is no longer just a point of integration. It is the frontline of cyber risk. At a time when attackers are more incentivised than ever to translate digital compromise into physical disruption, defending that boundary has never been more critical. SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

INTERVIEW

CHANGING THE PLAYBOOK

Federico Pienovi, CBO and CEO – APAC & MENA, Globant, discusses why Saudi Arabia’s ability to build infrastructure, data systems and AI together could compress years of integration, and what that means for tourism, sport and the technology services industry

everything is still being built on top of those systems. Saudi Arabia, especially, is building a lot of this from scratch. You have a unified government that aligns very well with the initiatives being laid out, so the capability to deliver AI systems across the board is much faster than you would find in many other markets. When you have to align private companies to do one thing, it can take years. When you have to align governments, provinces and local authorities around initiatives involving data sharing or agentic systems talking to each other, it can also take years. Saudi Arabia has been investing heavily across the different layers required for AI. You have investment in energy, models, applications, infrastructure and chips. Those different layers come together to support the wider AI market. Tourism is one of the sectors where Globant sees a significant role for agentic systems. What changes when those experiences are connected rather than built in isolation?

uch of the enterprise AI debate has centred on models, compute and deployment. A more practical constraint sits underneath all three: the systems AI has to work with. In established markets, decades of enterprise technology investment have created deeply embedded architectures, leaving organisations to layer new capabilities onto legacy applications and fragmented data estates.

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

Saudi Arabia is investing across multiple layers of the AI stack. What gives the market an advantage in moving from ambition to deployment?

The reality is two things: time to market and speed. You go to very traditional markets like the US or Europe, and everything has been built for the enterprise on top of legacy systems. Even though the US is leading on AI, on models and implementation, the reality is that

There are very few places in the world where you can look at the experience of a guest arriving in a country and see so many parts of that journey connected across government and companies linked to the government, such as PIF companies. From the airline that brings you to Riyadh, to the airport, the destinations you visit and the way you move around the country, the value of connecting all of that is tremendous. The number of people visiting, the amount of data and the level of connectivity involved are significant. If you try to do all of that in the traditional software engineering way, you could be talking about integration for the next 10 years. One of the biggest problems in technology has always been integrating systems that do not talk to each other. Here, there is an opportunity to create an ecosystem of data that can communicate through agentic systems.

HOSTED BY

OFFICIAL GOVERNMENT CYBERSECURITY PARTNER

OFFICIALLY SUPPORTED BY

MIDDLE EAST AND AFRICA’S LARGEST CYBERSECURITY EVENT

SCAN HERE

GET FREE VISITOR PASS

SPONSORS & PARTNERS

#gisecglobal gisec@dwtc.com

INTERVIEW

Hospitality and tourism still depend heavily on human service. Where does AI add value without weakening that experience?

We have had this narrative for a long time that AI is replacing jobs in every industry. The areas where we are collaborating are about creating a more personalised and unique experience, one that previously only VIP customers might have received. With AI capabilities, you can extend those tailored experiences much more broadly, whether someone is going to a concert, watching a football match or staying at a hotel in the Red Sea. What we are doing is moving people away from the back office, from crunching numbers and looking at spreadsheets or dashboards, and bringing more of them in front of customers. AI agents can provide staff with information that would otherwise sit across different systems, giving them more context to tailor the experience to the individual. It allows people who would otherwise be working behind the scenes to spend more time directly with customers. Sport faces a different challenge: fragmented attention. How is data changing the way organisations think about fan engagement?

Engagement is becoming increasingly important for the sports industry

For sports organisations, the fan experience is becoming increasingly important, but the bigger challenge is making sense of the data generated across an increasingly fragmented fan journey

because the way people consume sport has changed. I used to watch football on TV with my father and my grandfather, and we watched the game from beginning to end. Today, the fight for attention is much harder. You see younger fans watching a match while they are also on TikTok, posting online or following a streamer who is watching and commenting on the same game. For sports organisations, the fan experience is becoming increasingly important, but the bigger challenge

is making sense of the data generated across an increasingly fragmented fan journey. When FIFA approached Globant, they had a lot of data, but it was disconnected. You could not necessarily identify the same fan from one digital environment to another. It is difficult to understand what someone is interested in when you only have disconnected pieces of their interactions. The work is about creating a more unified understanding of the fan across FIFA’s digital properties, including FIFA.com and FIFA+, so those interactions are no longer treated separately. From there, you can understand the fan much better. That can improve the experience for the individual, but it can also give companies investing around major tournaments better insight into audience interests. Those kinds of scenarios create an ecosystem where the industry can develop revenue streams that did not previously exist. The objective is a more loyal fan and a more engaged fan. AI is also changing the economics of the technology services industry itself. How much does that alter Globant’s own model?

We are part of a very traditional industry: professional services and IT professional services. It has existed for many, many years. As much as we talk to our clients about disrupting their own industries, our own industry is being disrupted too. The way you create software, the way you code and the way you build businesses out of digital systems are all changing. With Glob.AI and AI Pods, our intention is to reinvent professional services. At the same time, we are investing heavily in building AI capabilities in the Kingdom and training engineers to supervise agentic systems. You can do business, buy something and leave. But leaving something behind means creating jobs, creating opportunities and training people in what is happening. SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

VIEWPOINT

THE NEW SPEED OF RISK By Hadi Jaafarawi, Regional VP – Middle East & Africa, Qualys

he release of Claude Mythos proved that a frontier AI system could autonomously find and exploit vulnerabilities in production software at machine speed and depth. Soon after, we saw what happens when that capability isn’t fully contained. In July 2026, an OpenAI model being evaluated inside a sandbox, broke out, exploited a zero-day in a thirdparty package registry, and chained it with stolen credentials to reach remote code execution on Hugging Face’s production infrastructure. Two labs, two unrelated incidents, in less than six months. Taken together, that is not a coincidence, but rather a gamechanging trend: AI-accelerated vulnerability discovery is no longer a future risk. For years, vulnerability management has run on the same rhythm: scan, score, ticket, patch — a model that assumes defenders have time to work through a queue after something is disclosed. That assumption was already under strain before this year. Mandiant’s M-Trends data puts the average time-toexploit at roughly negative seven days, meaning many flaws are weaponised before a patch is even available. Our own analysis of over a billion CISA KEV remediation records, spanning more than 10,000 organisations, found the 54

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

Manual patch cycles simply cannot move at the pace AIaccelerated discovery now demands volume of vulnerability events being closed grew 6.5 times between 2022 and 2025. Despite that, the share of critical KEV vulnerabilities still sitting open a week after disclosure actually went up over the same period, from 56 percent to 63 percent. Teams are working harder and falling further behind at the same time. Trying to out-patch that gap doesn’t work either. By our estimation, fewer than 1 percent of vulnerabilities marked critical are ever actually exploited in the real world. AI accelerates both sides of the problem at once. On the discovery side, Chainguard’s Athena coalition processed tens of thousands of AI-surfaced opensource vulnerabilities in its first three weeks alone, a meaningful share of which never received a CVE identifier because the

underlying flaw had already been silently patched upstream. On the offense side, Qualys’s threat research has tracked real exploit chains where two individually moderate flaws combine into full remote code execution, a combination no single CVSS score would ever flag as urgent. More findings, more sophisticated chaining, less time to react: the old model simply doesn’t work under that combination. A three-part response

The industry is converging on three capabilities that need to work together, not in sequence. • Detect what impacts risk at AI speed, CVE or not. Detection needs to cover misconfigurations, identity exposures, and vulnerabilities

operational impact, for zerotouch automatic patching. But changes on higher-risk, critical systems get staged, wave-based rollouts, with automatic rollback if something starts to break. The operational answer: a Risk Operations Centre

that never got a CVE assigned, which is a real and growing share of total exposure. Attackers using AI don’t wait for an identifier before they act, and leading detection platforms are increasingly building out proprietary signature libraries, often numbering in the tens of thousands, specifically to close that gap. • Hyper-prioritise based on your organisation’s unique environment. A “critical” severity score describes theoretical danger, not whether something is reachable, internet-facing, tied to a business-critical asset, or already blocked. The most effective programs layer dozens of threat intelligence feeds alongside business context, then validate exploitability directly

against real controls before anything reaches a remediation queue. Applied at scale, that funnel can be dramatic — realworld deployments have shown pools of tens of millions of raw findings narrowed to tens of thousands of confirmed, worth-fixing exposures, cutting projected remediation costs by more than 99 percent. • Remediate autonomously, but with solid guardrails. Manual patch cycles simply cannot move at the pace AI-accelerated discovery now demands, but blanket automation is similarly risky. The answer is graduated autonomy: reliability scoring built from crowd-sourced deployment signals across the internet can clear software like browsers, with a low-risk of causing

The fix isn’t another dashboard. It is an operating model that treats every risk source — vulnerability management, cloud and container posture, identity, applications, OT/IoT — as input into a single, ranked, validated view, instead of leaving each program to produce its own list of criticals. We call this the Risk Operations Centre (ROC). Where a Security Operations Centre (SOC) responds after something becomes an incident, a ROC is designed to work proactively and pre-emptively. A ROC unifies assets and findings from across the environment, prioritises using threat intelligence and business context, validates what’s genuinely exploitable, and drives confirmed risk to remediation. Under that model, reporting can shift from activity metrics, such as CVEs found or patches shipped, to outcomes that matter to a board: value at risk, dollar exposure eliminated on confirmed threats, and how quickly the gap between “exploitable” and “fixed” closes. A new remediation paradigm

Mythos was the moment AIaccelerated vulnerability discovery stopped being theoretical. The OpenAI-Hugging Face incident, months later, was the moment it stopped being a frontier-lab problem. Both point to the same conclusion: patching harder/ faster inside the old model isn’t a viable strategy anymore. Detecting exposures that cause cyber risk to the business, risk-based prioritisation on true exploitability rather than theoretical severity, and remediating autonomously with real safety guardrails — that combination is what keeping pace with AI-driven threats actually requires. SEPTEMBER 2026 | CXO INSIGHT MIDDLE EAST

Arnold O. A. Pinto / Shutterstock.com

BLOG

A NEW AGE OF CYBER Sunil Paul, Co-Founder and MD, Finesse, looks at the forces redefining cybersecurity and why GISEC GLOBAL 2026 remains an important barometer for the industry

ybersecurity is no longer being discussed in the same terms as it was five years ago. Digital infrastructure now carries more of the economy and business operations, while AI is accelerating both defence and the speed at which threats emerge. A serious cyber incident can become an operational, financial or even national problem. GISEC GLOBAL has evolved with that reality. In its earlier years, much of the conversation around cybersecurity was still centred on defending networks, endpoints and users. Over time, the event has broadened as the remit of security itself has expanded, bringing in questions around cloud, critical infrastructure, sovereignty, resilience and AI. Now in its 15th edition, the event moves to Dubai Exhibition Centre at Expo City in 2026, reflecting both the scale it has reached and the much larger role cybersecurity now plays

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

across enterprise and government. This year’s theme, “Cyber First: The New Digital Order,” gets to the heart of where the industry needs to go next. Security cannot remain something organisations address after important technology decisions have been made. Infrastructure, cloud and applications have often been deployed before security considerations were fully integrated, leaving organisations with security debt and layers of compensating controls. As autonomous AI agents become part of enterprise environments, questions around identity, permissions, data access, monitoring and human oversight need to be resolved at the design stage. Security cannot be added as an afterthought once these systems are already operating. Cyber First should therefore be treated as a design principle, bringing security into decisions around infrastructure, identity, data, AI and

operations while those decisions can still be shaped. Most large organisations already have substantial security investments, and many are trying to simplify rather than add another layer. Security leaders want technology that improves visibility, reduces operational friction and makes a measurable difference under pressure. That is also where GISEC GLOBAL continues to earn its relevance. It offers a useful reading of how the market is changing, which technologies are gaining substance and where security priorities are moving next. For Finesse, Cyber First is closely aligned with how we see the market evolving. Capabilities such as Cyberhub, our 24×7 Cognitive SOC, bring together continuous monitoring and governance including for AI Agents, AI Infrastructure, platforms & applications, threat detection, investigation and response, helping security teams move beyond fragmented alerts towards a clearer understanding of what is happening across their environments. It is one example of how the industry can help organisations strengthen resilience while keeping pace with wider digital transformation. GISEC GLOBAL 2026 reflects an industry with far greater influence than it once had. The challenge now is to use that influence early enough to make a difference.

THE WORLD'S LARGEST TECH, AI & STARTUP SHOW 200,000+

6,800+

400+

2,200+

1,300+

1,184

TECH EXECUTIVES FROM 180+ COUNTRIES

STARTUPS

EXHIBITING COMPANIES

INVESTORS WITH $1 TN AUM

GOVERNMENT ENTITIES

SPEAKERS

Scan the QR code to

#GITEXGLOBAL | gitex.com

GET INVOLVED

WHAT’S NEW

DYSON: CameraJet

APPLE: iPhone Duo

Apple has unveiled the iPhone Duo, its first foldable smartphone, featuring a 7.6-inch inner Super Retina XDR display and a 5.4inch outer screen. Both panels support ProMotion, Always-On functionality and up to 3,000 nits of outdoor brightness. The device is powered by Apple’s A20 Pro chip, built on a 2nm process, with a 6-core CPU, 7-core GPU and dual 16core Neural Engine. A custom vapour chamber manages heat, while a dual-battery architecture supports all-day use. The camera system includes 48MP Fusion Main and 48MP

Fusion Ultra Wide cameras, with 2x optical-quality telephoto capability, macro photography and 4K 120fps Dolby Vision recording. Apple has equipped the phone with a grade 5 titanium frame, Ceramic Shield protection and an IP68 rating. iOS 27 adds foldablespecific features, including Split View multitasking, dualapp layouts and adaptive controls across both displays. Pre-orders begin October 16, with availability from October 23. Apple Pencil support follows later.

Dyson has introduced CameraJet, an electric toothbrush combining an integrated camera, sonic brushing and targeted liquid cleaning. The toothbrush uses a 100,000-pixel macro camera with Dyson’s Gap Optical Targeting system, capturing 28 images per second to identify interdental gaps and trigger a cleaning jet within 100 milliseconds. A 12.5ml internal tank supplies mouthrinse through a conical jet designed to reach between teeth while brushing. CameraJet uses a dual-bristle head with sonic oscillation approaching 1,000 movements per second. Each brush head also includes an RFID tag to track usage and replacement intervals. Connectivity includes Wi-Fi and Bluetooth, with the MyDyson app providing live camera viewing, coverage mapping, cleaning guidance and personalised feedback. Dyson says captured images are not stored on the toothbrush or in the cloud. A charging dock can refill the mouthrinse tank in around three seconds, while a travel case is also included.

DELL TECHNOLOGIES: DELL 14S Dell Technologies has announced the Dell 14S, a 14-inch Windows laptop aimed at students and everyday users, with a focus on portability and battery life. The system is powered by Intel Core 5 or Core 7 Series 3 processors and offers two 16:10 display options: a 2.8K panel with a 120Hz refresh rate and a 2K panel running at 60Hz. The aluminium chassis measures 13.5mm thick and weighs from 1.15kg. Dell rates battery life at up to 21 hours of video streaming, using a 750ED PNCM high-energy-density battery. The laptop also includes an FHD webcam, farfield dual-array microphones, stereo speakers and Wi-Fi 6E connectivity. Ports include two USB-C connections with power delivery, HDMI and a 3.5mm audio jack. Windows Hello is included for biometric sign-in. The Dell 14S will be available in Linen, Dusty Rose, Washed Denim and Velvet Green. Fast charging is supported across configurations for shorter charging sessions.

CXO INSIGHT MIDDLE EAST | SEPTEMBER 2026

EVOTEQ isn’t just a partner in digital transformation; it’s a partner in creating a connected, resilient world where traceability is not only a feature but a necessity. Together, we secure tomorrow, one transparent decision at a time. Connect with us and learn more about traqpharma, a solution revolutionizing the supply chain in the pharmaceutical industry.

Near real-time supply chain visibility is now at your fingertips. Secure every dose, every shipment, every patient with the power of traceability. From production to patient: 100% transparency, zero compromises.

traqpharma

traqfood

traqlogistics

Pharmaceutical & Medical Supply Chains

Food & Beverage Traceability

Retail, Manufacturing & Transportation

End-to-end traceability for medicines, raw materials and medical products ensuring safety, compliance and trust.

Ensure food safety and quality with farm-to-fork traceability and recall readiness.

Real-time visibility across shipments, warehouses and distribution networks to improve efficiency and performance.

traqpart

traqluxury

Automotive Manufacturing & Dealerships

High-Value Assets Luxury Goods & Electronics

Track parts, assemblies and vehicles across the manufacturing lifecycle and dealer network.

Protect high-value products with digital provenance, authenticity and lifecycle transparency.

Pharma today. Food tomorrow. Resilience always. www.evoteq.com

@Evoteqme |

Evoteq