CodeRED May 2025 Edition

UAE: THE CYBER COMMAND CAPITAL

Safeguard your teams with secured-core Acer TravelMate laptops.

Bring the AI PC to business.

For more information, get in touch with

sales.ame@acer.com

Intel® Core™ Ultra 7 processor powering Intel vPro®

EDITORIAL

Khaled ALMAEENA

The most critical story of our time is cybersecurity.

Not because it is new, but because it is necessary.

It touches every institution, every economy, every individual. Governments are quietly targeted.

Critical systems are breached.

Societies face threats they do not fully understand. Behind these incidents lies structure. A growing network of actors operating with intent and precision.

Cybercrime is no longer a side issue. It is a core challenge to global stability, national governance, and personal freedom.

Much of the narrative remains surface level. But the deeper questions, of responsibility, resilience, and consequence, demand more attention.

That is why TECHx Media exists. Not to echo the noise, but to explore what others overlook. Not to promote, but to investigate. Cybersecurity is not just technical. It is institutional. It is political.

It is human.

CHAIRMAN

Cybersecurity is no longer just a technical issue. It is a shared responsibility. Over the past 30 years, I have seen the industry evolve in ways we could not have imagined. With every leap in innovation, new vulnerabilities emerge, making the need for awareness and resilience more urgent.

Khwaja

.

Cyber threats are not confined to one sector or region. They affect us all, and addressing them requires cooperation and clarity.

SAIFUDDIN

The UAE continues to lead in digital transformation, and with that comes a deep responsibility to protect infrastructure, data, and people.

TECHx Media is committed to creating space for relevant voices and timely insights that matter to the region.

Sharing knowledge is a vital step in building collective readiness.

Cybersecurity is not a one-time effort.

It is a mindset, a habit, and a shared responsibility that must grow with the pace of change.

EXECUTIVE BOARD MEMBER

We are TECHx Media, officially registered with the UAE's National Media Council. As a media platform dedicated to addressing the media and marketing needs of the tech ecosystem, we have built a strong reputation as a trusted partner for leading global vendors, distributors, government entities, and major global tech events. With a proven track record of providing comprehensive industry coverage, our team of seasoned professionals and tech journalists, boasting over 150 years of combined expertise, delivers the latest technology insights, backed by in-depth analysis and creativity.

Let’s be honest, cybersecurity doesn’t always get the attention it deserves. It’s often buried under technical jargon or turned into fear-based headlines. But cybersecurity isn’t just about data breaches, it’s about people, trust, and the systems that keep our world moving.

That’s why we’re launching Code RED, powered by TECHx Media. A new monthly magazine dedicated entirely to cybersecurity.

Sehrish

Inside, you’ll hear from security leaders who’ve reshaped boardroom thinking and innovators who’ve moved beyond buzzwords to deliver real impact.

TARIQ

We’re debuting this with purpose at GISEC 2025, placing cybersecurity where it belongs at the center of every tech conversation.

I joined TECHx with a mission and launching CODE RED is just the beginning. Let’s talk about cybersecurity like it matters. Because it does.

Welcome to Code RED.

CONTENT STRATEGIST

Cybersecurity has become a core business priority.

It defines trust, protects value, and influences critical decisions in today’s digital-first economy.

Sabeel ISMAIL

At TECHx Media, we believe it deserves more attention and stronger representation in the region’s media landscape. Code RED, powered by TECHx was created to deliver exactly that, a dedicated platform for cybersecurity leadership, innovation, and strategy. This magazine connects vendors with decision-makers, aligns technical insight with business relevance, and offers a space for brands to showcase vision, reliability, and impact.

The UAE and Middle East are advancing rapidly in digital maturity, regulatory development, and investment. Code RED, powered by TECHx supports this momentum with content that speaks fluently to both business and technology stakeholders.

For our clients, it’s a platform to lead and influence. For our partners and contributors, it’s a shared mission brought to life. And for our readers, it’s just the beginning of something BOLD.

CHIEF EXECUTIVE OFFICER

Published by: TECHx Media LLC 213, Al Nasr Plaza, Oud Metha, Dubai, UAE

Editorial:

+971 50 100 2275

Sales:

+971 50 300 4450

Events:

+971 50 700 7216

Marketing: +971 50 800 8341

General: info@techxmedia.com Editorial: editor@techxmedia.com

1

CISO CORNER

3

2

COVER STORY

INTERVIEWS

6

5

4

OPINION

7

COVER STORY

Cybersecurity has never been just about keeping the bad guys out. In the modern era, when digital infrastructure underpins everything from national security to the daily commute, cyber resilience has become foundational to sovereignty itself.

In less than a decade, the UAE has transformed its cybersecurity posture from reactive to resilient, climbing 42 places to join the top tier in the United Nations' Global Cybersecurity Index. At the heart of this national transformation is Dr. Mohamed Hamad Al Kuwaiti, the architect of a cyber strategy as forward-thinking as it is formidable.

The global narrative around cybersecurity is often reactive, responding to breaches, plugging gaps, implementing policies only after public fallout. Al Kuwaiti, by contrast, is operating from a different playbook, one that starts with readiness, anticipates disruption, and builds infrastructure that’s resilient by design.

HOW THE UAE SECURED THE TOP GLOBAL SPOT IN CYBERSECURITY

From Awareness to Action

When the International Telecommunication Union released its 2024 Global Cybersecurity Index, few were surprised to see the UAE elevated to Tier One status. For those paying attention, it was the culmination of years of investment, foresight, and execution. But it wasn’t just about firewalls and encryption protocols. It was about building a multi-dimensional ecosystem rooted in legal frameworks, international collaboration, digital literacy, and increasingly, quantum resilience.

As per reports, in the first quarter of 2024 alone, the UAE thwarted over 71 million cyberattacks.

More than 600 of those were advanced persistent threats aimed at critical infrastructure like finance, energy, healthcare, and government systems. The response? A coordinated defense that blended AI-powered analytics, real-time monitoring, and cloud-native architectures built to scale and adapt.

This is not the work of a siloed IT department. This is national strategy in action.

And at its front is Dr. Al Kuwaiti, a leader who understands that cybersecurity is no longer just a technical discipline. It is geopolitical currency.

His strategy hinges on a few key pillars: zero trust architectures, AI-powered threat detection, quantum-ready encryption standards, and what he describes as a “Cyber-Aware Society"

8 6

COVER STORY

Dr. Mohamed AL KUWAITI

Head of Cyber Security UAE GOVERNMENT

www.techxmedia.com

9 7

COVER STORY

Cybersecurity as Nation-Building

Dr. Al Kuwaiti’s approach can best be described as pragmatic futurism. On one hand, he believes in cyber hygiene and zero-trust architectures. On the other, he is keenly aware that the next wave of threats won’t come from ransomware gangs but they’ll come from quantum-powered actors capable of breaking today’s encryption standards in seconds.

His leadership has catalyzed a new national mindset, where cybersecurity is baked into digital infrastructure from the outset. Whether it’s the deployment of post-quantum cryptography protocols or the creation of Cyber Pulse, a public awareness initiative reaching students, parents, and professionals alike, the strategy is clear: empower from the ground up.

Dr. Al Kuwaiti’s visibility on the global stage has also grown. He now regularly engages with international bodies, think tanks, and allied governments, shaping conversations about cybersecurity as a shared global responsibility. In April 2023, he received the Global Leadership Award at GISEC Global. A recognition not just of his individual achievements, but of the UAE’s holistic, collaborative model.

Quantum Resilience

While much of the world is still grappling with yesterday’s threats, the UAE is already preparing for tomorrow’s. This was clear at CyberQ: Security in the Quantum Era, a summit where the future wasn’t hypothetical but it was present.

Quantum computing, with its promise of unprecedented processing power, also brings with it the risk of obliterating current encryption standards. The UAE’s response? Build quantumresilient foundations now.

10 8

COVER STORY

While the private sector may hesitate to invest in long-horizon technologies, the UAE government is moving swiftly, ensuring that critical systems, from aviation to oil and gas, won’t be caught unprepared when quantum capability becomes mainstream.

It would be tempting to view the UAE’s progress as a regional success story. But that would undersell its global relevance. In a hyperconnected world, where supply chain attacks can start in one country and cripple infrastructure in another, the UAE is modeling what it means to operationalize cybersecurity at scale.

Other nations are taking note.

Its cross-sector partnerships, linking government, academia, and industry, are being studied for their agility and effectiveness. Its rapid threat response system, underpinned by cloud-native SIEM platforms and behavioral analytics, has been held up as a benchmark. Its commitment to workforce development, particularly in engaging youth and women in cyber careers, is influencing education policy beyond the Gulf.

All of this flows back to leadership and to a leader who believes cybersecurity is not just a job, but a national imperative.

The Road Ahead

For all the success, Dr. Al Kuwaiti remains clear-eyed about the road ahead. Cyber threats are evolving. AI-generated attacks, supply chain compromise, deepfakeenabled social engineering, the future won’t be easier, only faster.

Yet, the UAE’s strategy stands as proof that nations can adapt, modernize, and thrive, if they view cybersecurity not as a checklist, but as a pillar of economic and digital progress.

And in a time when many governments are still catching up, Dr. Mohamed Al Kuwaiti’s UAE isn’t just catching up. He is charting the course.

www.techxmedia.com

9 11

CISO SPEAKS

Defending a Nation’s

DIGITAL CORE

Innovation, Trust, and Defending a Nation’s Digital Core In the heart of the UAE’s ambitious digital transformation, where smart infrastructure and cutting-edge technologies are rapidly reshaping society, cybersecurity is no longer just a line of defense, it’s a foundational pillar. And at the helm of this mission is Nasser Alneyadi, Head of the Information Security Department at the Ministry of Interior, UAE Cyber Security.

With decades of experience and a deep understanding of both national and global cyber landscapes, Alneyadi stands as one of the key architects safeguarding the country’s digital future. His work is not only about responding to threats, it’s about anticipating them, innovating alongside technological advancements, and embedding cybersecurity as a culture rather than a checklist.

Balancing innovation and risk in the age of AI Few forces are reshaping cybersecurity as profoundly as artificial intelligence. While AI offers new capabilities in threat detection and response, it also introduces complex risks. For AlNeyadi, harnessing AI safely meant careful planning and clear boundaries.

“Innovation without security is a gamble. When we integrated AI into our threat detection systems, we had to balance speed and ambition with deep due diligence.

We ran controlled pilots in isolated environments, then gradually scaled. While AI gave us real-time insights, we made sure every output was vetted and explainable before trusting it in live environments. That’s the balance: move fast, but don’t cut corners on risk.”That calculated approach allowed his team to adopt innovation while maintaining control, a critical skill in a world where AI is often adopted recklessly.

Zero Trust: Not Just a framework, but a philosophy Adopting a Zero Trust model is becoming a global trend, but for Alneyadi, it’s not a buzzword, it’s a core mindset that’s reshaping how security is built into the organization.

“Zero Trust isn’t a product it’s a mindset. We started with identity: strict access controls, MFA

12

CISO SPEAKS everywhere. Then we moved to network segmentation, device health continuous monitoring. The surprise? Cultural resistance.

Getting teams on board was harder than the tech part. We had to communicate the ‘why’, that Zero Trust wasn’t about mistrust, but resilience.”

This insight, placing culture and communication at the center was key to success. The initiative succeeded not just through policy, but through engagement.

The new threat landscape: Deepfakes and quantum on the radar When asked what keeps him up at night, Alneyadi doesn’t hesitate. The immediacy and sophistication of today’s emerging threats demand constant vigilance. “Deepfakes, hands down. The potential for disinformation, political manipulation, and even social engineering is growing fast. We’re working on detection tools and educating staff to verify sources, even internally. Long-term? Quantum computing is a slow-burn concern. We're already exploring quantum-resilient encryption.”

By staying proactive, not reactive, Alneyadi’s team is building resilience against threats that many organizations have yet to fully grasp.

Preparing for generative AI as an offensive weapon One of the most urgent concerns in cybersecurity today is the offensive use of generative AI. Alneyadi is already seeing the threat take shape and warns that organizations must prepare now.

“Generative AI used offensively. We’re already seeing attackers use AI to write phishing emails that are nearly flawless. In 3–2 years, this will only escalate. CISOs should focus on AI hygiene understanding how it can be abused and ensuring their own use of AI doesn’t become a liability.” The message is clear: organizations must not only defend against AI-powered attacks, but also ensure their own tools aren’t creating new vulnerabilities.

Where vendors need to do more Despite billions in cybersecurity spending, Alneyadi points to a critical shortfall in how most tools are built, still rooted in outdated thinking while adversaries are moving into the AI age.

“Vendors still don’t fully address AI-driven threats. Most tools focus on traditional patterns, but attackers are moving faster using LLMs and automation. I’d like to see more innovation in adversarial AI defense tools that can anticipate AI-based attacks, not just react to them.”

His call is not just for better tools, but for a new mindset among cybersecurity vendors, one that prioritizes foresight over forensics.

www.techxmedia.com

If you weren't in cybersecurity, what would your dream job be?

A lawyer. I’ve always been drawn to structured arguments, digging for evidence, and building strong cases. It’s a different battlefield, but the mindset is similar analyzing risk, defending against threats, and staying two steps ahead.

What's one piece of tech gear or gadget you can't live without?

My smartwatch. Not just for fitness—it’s how I track everything: meetings, notifications, even quick calls. It keeps me in sync.

What's your favorite way to unwind after a long day of tackling security challenges?

Gym session, then disconnect. Either a walk or some time with family, no screens, just real conversation.

If you could only use one app for the rest of your life, which one would you choose and why?

X (formerly twitter) It’s my go-to for real-time updates, security news, and thought leadership. It cuts through the noise, if something’s happening, you’ll hear about it there first.

What's a fun or quirky hobby you enjoy when you're not busy with work?

I’m a fan of strategy board games. They keep my brain sharp and honestly, they're a great way to unplug from the digital world.

Making cybersecurity everyone’s job Technical solutions are only half the battle. Alneyadi’s approach to cybersecurity awareness focuses on embedding it into the day-to-day behavior of every employee.

“We made cybersecurity everyone’s business. Not by preaching, but by embedding it in daily workflows, short training modules, real-world examples, and even gamified phishing tests. Leadership support helped, but the real shift came when we tied good security habits to performance metrics across departments.”

This strategy transformed cybersecurity from a siloed function into an organization-wide commitment and it worked.

11 13

The rise of AI has made it clear that cybersecurity is no longer a choice, it’s a necessity. But for cybersecurity leaders like Faisal Khan, progress must be anchored in security and compliance.“Balancing innovation with risk management is like walking a tightrope. You want to move forward with agility while ensuring stability,” says Khan.Z

CISO SPEAKS

Think secure and

BUILD SMART The rise of AI has made it clear that cybersecurity is no longer a choice, it’s a necessity. But for cybersecurity leaders like Faisal Khan, progress must be anchored in security and compliance.“Balancing innovation with risk management is like walking a tightrope. You want to move forward with agility while ensuring stability,” says Khan.

As organizations increasingly adopt cloud technologies and AI-driven solutions, the need to integrate security from the outset becomes even more urgent. Khan emphasizes that at DWTC, security isn’t retrofitted, it’s foundational.

“Innovation thrives when security is built into the foundation, not bolted on later,” he adds.

One notable example he shares is the adoption of AI-driven security analytics in the cloud. DWTC approached it with a riskbased framework, embracing Zero Trust Architecture and aligning with global standards like ISO 27001 and NIST, alongside local compliance measures such as DESC ISRv3 and UAE’s PDPL.

The Zero Trust journey Zero Trust is no longer a buzzword, it’s a necessity. But implementing it is not a flip-of-the-switch task.

“Zero Trust isn’t just a security model, it’s a mindset shift that requires buy-in across the organization,” says Khan. The journey at DWTC began with foundational elements like multi-factor authentication and least-privilege access, gradually expanding to network segmentation, real-time monitoring, and automated threat response.

However, it wasn’t without challenges. “A key challenge was adapting legacy systems to micro-segmentation, as they weren’t designed for such granular control, requiring creative workarounds to maintain security without disrupting operations,” Khan shares.

Tomorrow’s threats, today The future of cyber threats is both exciting and alarming. From quantum computing to deepfakes and AI-fueled attacks, CISOs must constantly stay ahead of the curve.

“The evolving threat landscape is a constant challenge, with AIpowered cyberattacks, supply chain vulnerabilities, and cloud security gaps being top concerns,” Khan explains.

14

CISO SPEAKS

DWTC’s strategy is rooted in proactive defense using AI for early detection, adopting Zero Trust principles, and validating security continuously.

Looking ahead, Khan believes CISOs choosing the right partners and knowing when they fall short selecting a cybersecurity vendor isn’t just about flashy features, it’s about practical integration and sustainable value.

“When evaluating cybersecurity vendors, I prioritize seamless integration, threat intelligence quality, ROI, and scalability,” says Khan.

One vendor fell short by delivering AI-driven tools that overwhelmed their SOC team with false positives. Conversely, another exceeded expectations with “adaptive risk-based access control... enhancing security without disrupting user experience.”

This balance between protection and usability is the holy grail of cybersecurity tools, but many vendors still struggle to find it.

What vendors need to fix fast Despite innovation in the cybersecurity space, Faisal Khan believes many solutions remain stuck in reactive mode.

“One of the biggest gaps in vendor offerings today is the lack of truly proactive security solutions... Vendors need to prioritize better integration across security platforms, reducing alert fatigue through smarter correlation, and improving defenses against advanced social engineering attacks.”

Threats are evolving faster than systems can patch, this kind of intelligent, integrated, proactive defense is no longer optional, it’s vital

Building a Cyber-Aware culture: From IT to everyone Technology can only go so far. At DWTC, driving real security starts with people.

“Shifting cybersecurity from an IT-centric responsibility to a shared organizational culture starts with awareness, engagement, and accountability at all levels,” says Khan.

DWTC moved beyond traditional training by incorporating interactive simulations and realworld case studies. Leadership involvement was a turning point.

If you weren't in cybersecurity, what would your dream job be?

If I weren’t in cybersecurity, I would have been a heart surgeon. Early in my college days, I was fascinated by the idea of saving lives, but my passion for technology took over, and I found myself securing digital hearts instead, keeping data and systems safe from cyber threats. In a way, both fields require precision, attention to detail, and a strong sense of responsibility!

What's one piece of tech gear or gadget you can't live without?

For me, it's definitely my cellphone. It’s the ultimate all-in-one tool for communication, productivity, and entertainment. The next tech gear is a power-bank which keeps this cellphone charged all the time.

What's your favorite way to unwind after a long day of tackling security challenges?

I enjoy meeting up with peers and industry colleagues to exchange insights, share experiences, and learn from their perspectives. It’s a great way to unwind while staying connected with the ever-evolving security landscape.

If you could only use one app for the rest of your life, which one would you choose and why?

If I had to choose just one app for the rest of my life, it would be WhatsApp. It’s not just a messaging app, it’s a lifeline for communication, whether personal or professional. From staying connected with family and friends to managing work conversations and even sharing documents, it covers almost everything.

What's a fun or quirky hobby you enjoy when you're not busy with work?

When I’m off the grid, you’ll likely find me deep in the desert, my feet nestled in the soft dunes, or camping within the rugged beauty of the Hajar mountain ranges.

These moments in nature bring me immense peace and satisfaction, offering a rare stillness that allows me to reflect on life, its purpose, and the privilege of experiencing the world in its purest form.

The result? A culture where cybersecurity is not just an IT issue, but a daily consideration. “The goal is to make security second nature, something ingrained in daily decisions rather than an afterthought enforced by IT.”

“When executives champion security as a business priority, it naturally cascades down to employees,” he adds.

www.techxmedia.com

13

INTERVIEW

YOUR SECURITY TOOLS ARE TALKING BUT IS ANYONE LISTENING?

BILAL

BAIG

Chief Technical Officer, MMEA TREND MICRO

16 14

INTERVIEW In the chaos of cloud sprawl, hybrid networks, and AI-driven attacks, most organizations are drowning in alerts while threats quietly slip through the cracks.

It’s not just about having tools, it’s about connecting the dots. Bilal Baig, Chief Technical Officer, MMEA, at Trend Micro talks about what it really takes to secure modern infrastructure, why thinking in silos is a liability, and how tying together everything from endpoints to OT systems might be the only way to stay ahead in a world where threats don’t wait for your next software update.

How does Trend Micro ensure full lifecycle security for cloud-native applications?

At Trend Micro, we ensure our customers’ cloudnative applications are protected across the entire lifecycle from the moment they’re being developed all the way through deployment and day-to-day operations. We do this through our Cloud-Native Application Protection Platform, or CNAPP, which brings together cloud security posture management, workload protection, and runtime security into one unified approach.

Through Trend Vision One Cloud Secuity, we embed security right into DevOps workflows, so vulnerabilities are caught early, compliance is continuous, and threats can be stopped automatically without slowing teams down. We also make sure APIs are secured to maintain full visibility and governance throughout the lifecycle.

And it’s not just about protecting against threats; it’s also about helping organizations meet critical regulations like GDPR, PCI DSS, and HIPAA. Our goal is to close security gaps in real time, so businesses can innovate faster and more securely without compromising on protection.

How do you combine endpoint, email, and cloud security into a single XDR view?

At Trend Micro, we bring endpoint, email, and cloud security together into a single XDR view through our Trend Vision One platform. The idea is to give organizations one place where they can see everything that’s happening across their environment instead of jumping between different tools.

Vision One consolidates data from endpoints, email systems, and cloud workloads into a centralized platform. This way, we can detect threats more accurately and respond a lot faster. For endpoints, it tracks things like user behavior, file activity, and network connections. For email, it catches phishing attempts, ransomware, and targeted attacks. And on the cloud side, it monitors assets and looks for any unusual activity that could signal a threat.

By connecting all of these pieces, we give security teams a full, unified view so they can spot and respond to threats much more efficiently. We’re also helping to reduce alert fatigue, speeds up investigations, and supports compliance with key regulations. At the end of the day, it’s about making security simpler, smarter, and more connected.

www.techxmedia.com

What makes your threat intelligence ecosystem unique in the market?

What really makes our threat intelligence ecosystem stand out is how comprehensive and proactive it is. At the center of it, we have the Smart Protection Network, a massive global infrastructure that’s constantly gathering and analyzing data to block threats in real time. It’s supported by Trend Micro Research and our Zero Day Initiative, which gives us early insights into new vulnerabilities before they’re widely exploited.

But what really sets us apart is how we integrate all of this intelligence into our Trend Vision One platform. It gives organizations unified visibility and extended detection and response across endpoints, email, networks, and cloud environments.

And with the introduction of Trend Cybertron, our specialized cybersecurity AI, we’re now predicting and preventing threats even faster using advanced analytics and machine learning.

Another big piece is collaboration we work closely with industry partners around the world, which keeps our threat intelligence fresh, actionable, and incredibly effective. It’s all about giving organizations the insights they need to stay ahead of evolving risks.

How are you tackling industrial cybersecurity and OT environments?

Industrial cybersecurity and operational technology (OT) environments present unique challenges due to their specialized systems, interconnected devices, and critical infrastructure. Tackling these areas involves a combination of proactive strategies, advanced technologies, and collaboration with industry leaders. Here is how we are tackling industrial cybersecurity and OT environments: • Identifying vulnerabilities in OT networks, evaluating risks, and implementing tailored security measures.

Regular audits help maintain security as systems evolve.

• Safeguarding industrial endpoints—like PLCs, SCADA systems, and IoT devices through robust defenses, including secure access controls, firewalls, and intrusion detection systems.

• Deploying tools for continuous monitoring of networks and systems to detect anomalies and prevent attacks before they escalate.

• Separating OT networks from IT networks and limiting access based on roles and responsibilities to minimize the impact of potential breaches.

• Adhering to international cybersecurity frameworks which address industrial cybersecurity best practices.

• Training personnel on security protocols and fostering a culture of vigilance to reduce human error, which is often a key vulnerability.

15

INTERVIEW

How do you protect against insider threats and lateral movement in hybrid networks?

What are the biggest lessons you’ve learned from recent global incidents?

We take a proactive, layered approach to protecting hybrid networks from insider threats and lateral movements. Our strategy revolves around clearly defined principles:

Honestly, recent global incidents have been a strong reminder that cybersecurity isn’t just about putting barriers up, it’s about being prepared, staying resilient, and moving fast. We’ve seen how ransomware attacks and breaches in critical sectors can cause real-world disruption, which makes continuous monitoring, strong threat intelligence, and having a solid security framework absolutely essential. Speed has become critical too attackers are moving faster, especially with AI in the mix, so early detection and quick response are more important than ever.

Zero Trust Approach: We never assume trust by default, every access attempt is continuously verified, significantly limiting unauthorized movements.

User Behavior Analytics: By closely monitoring user activities, we swiftly identify and respond to unusual behaviors like abnormal login patterns or unexpected data access that might indicate insider threats.

Real-time Endpoint Monitoring: Our Endpoint Detection and Response (EDR) capabilities allow us to continuously track activities at endpoints, quickly spotting and neutralizing suspicious actions before they escalate.

Strong Privileged Access Controls: We enforce strict controls on sensitive accounts using multi-factor authentication, time-restricted access, and regular audits of user credentials.

Effective Network Segmentation: By dividing networks into isolated zones, we reduce the potential damage of an incident, making lateral movements by threats far more difficult.

16

Another big takeaway is around infrastructure and supply chains. It’s no longer enough to just secure your own environment one weak link outside your walls can create massive ripple effects, so visibility and strong partnerships are crucial. And of course, human error is still one of the biggest risks. That’s why ongoing employee training and building a true culture of cybersecurity awareness really matter.

Finally, I think what stands out most is that cybersecurity today is global. Threats don’t respect borders, and the only way to keep up is through collaboration and sharing intelligence across industries and geographies. At Trend Micro, we’ve taken all these lessons to heart and they’re shaping the way we evolve our technologies, strengthen our partnerships, and help organizations build stronger defenses for whatever comes next.

INTERVIEW

HOW ONE UNIFIED PLATFORM IS CHANGING THE CYBERSECURITY GAME

GAIDAR MAGDANUROV

President, ACRONIS

20 18

INTERVIEW

Traditional approaches that rely on patching together multiple tools often lead to complexity, higher costs, and gaps in protection. That’s where Acronis steps in. We spoke with Gaidar Magdanurov, President at Acronis, to explore how the company is addressing these modern challenges by unifying cybersecurity, backup, disaster recovery, and endpoint management into one powerful platform.understand security risks as Chief Security Advisor. And this year, my seventh book is being published.”

How does Acronis combine cybersecurity, backup, disaster recovery, and endpoint management in a single solution?

Acronis has a unique approach native integration. We provide a single agent, single console, and single protection plan. This means that users don’t have to support multiple agents or learn how to use multiple user interfaces, what they have to do in case of using other vendors that use APIs to combine different products into one platform.

The benefits of native integration are higher productivity and higher reliability. One agent, one console, and one protection plan reduces the time needed to set up and maintain protection, and reduces configuration and maintenance errors.

What makes Acronis Cyber Protect unique in defending against ransomware and zero-day threats?

Native integration of data protection, cybersecurity and endpoint management allows for implementing all stages of protection with one solution. Attacks are prevented with vulnerability assessments, monitoring and patch management. Detection and response using next-generation antivirus and endpoint detection and response. Recovery and forensics with backup and disaster recovery capabilities.

Therefore, Acronis reduces the risk of downtime and allows for quick recovery to productivity in case of a cyberattack, software issue, or hardware failure.

How do you ensure seamless protection across hybrid and remote work environments?

The solution is simple. The Acronis Cyber Protect platform supports multiple workload types workstations, servers, virtual machines, and Cloud applications like Microsoft 365 and Google Workspace. IT professionals get a significant boost in productivity by using one solution for all types of workloads, and the reliability of the protection increases dramatically versus multiple different tools used for different types of workloads.

www.techxmedia.com

In what ways is Acronis leveraging AI and machine learning to enhance threat detection?

AI is used for real-time analysis of events to detect suspicious activity and block cyberthreats. Besides that, AI is used to educate and guide IT professionals about the stages of attack and remediation steps, explaining the attacks in natural human language. In addition, AI is used to help IT professionals to write and update scripts that they use for automation.

AI dramatically increases the effectiveness of the protection and serves as an assistant to IT professionals to increase their productivity. Having more free time, they can dedicate it to learning or spending it on more valuable work, rather than handling minor incidents.

How does Acronis address compliance challenges in industries like healthcare and finance?

The Acronis solution covers multiple compliance requirements. We do mapping of the functionality to CIS Controls framework, NIST framework, and a variety of regulatory requirements like Cyber Essentials, Essential Eight, and so on.

What steps are you taking to simplify cybersecurity for SMBs? Natively integrating cybersecurity, data protection and endpoint management into one single solution, Acronis simplifies the operations for managed service providers and IT professionals working in SMB companies. Having one tool, they get more productivity and reliability, leading to lower risk, lower downtime cost, and higher productivity.

What role do MSPs play in Acronis’ go-to-market strategy, and how are you enabling them?

The Acronis Cyber Protect platform is available through MSPs and directly to corporate IT users for installation on-premises or from the cloud. Most of the usage is through MSPs; the most important part of Acronis's go-to-market. That is why Acronis invests significant resources in enabling MSPs with technology and business training, sales and marketing materials, and a variety of campaigns to recruit and customize end customers and upsell new services to end customers.

While working with MSPs, Acronis is not selling to the MSPs, rather acting as a partner, helping MSPs to grow their business, as Acronis’ pricing is designed around usage, and Acronis’ business grows only if the partners’ business grows.

19

CISO SPEAKS

From

DEFENSE TO DNA

For Cybersecurity leaders like Nisha Rani, Chief Information Security Officer at Emirates Leisure Retail, the challenge lies in balancing the need for innovation with the growing complexity of emerging cyber threats.

“Balancing innovation with risk management is at the heart of modern cybersecurity leadership,” says Rani. With the rapid adoption of new technologies, it’s more important than ever to embed security into the innovation process from the outset, rather than treating it as an afterthought. This approach, known as “security-by-design,” ensures that new initiatives don’t just focus on agility but are built on a solid security foundation.

The journey to Zero Trust “Zero Trust isn’t a plug-and-play model; it's a mindset shift and a layered journey that needs to be tailored to the organization’s maturity and business needs,” she explains.

The process unfolded in four key phases: Visibility & Assessment: Strengthening Identity & Access Micro-Segmentation & Least Privilege Continuous Monitoring & Automation

Nisha emphasizes the challenges that emerged along the way, especially when dealing with legacy systems and third-party integrations.

“One of the most unexpected challenges was change in management and vbringing everyone, from IT teams to leadership, on board with the idea that trust needs to be continuously earned, not assumed,” she says.

This iterative approach allowed Emirates Leisure Retail to adapt and evolve while aligning security with business goals.

Preparing for tomorrow’s risks It is very much evident that AI-driven attacks are among Nisha’s biggest concerns.

“One of the biggest concerns right now is the rise of AI-driven attacks, especially advanced phishing and social engineering campaigns.

These attacks are getting incredibly convincing, tailored to specific individuals, timed perfectly, and often bypassing traditional detection methods,” she shares.

Nisha is also deeply concerned about the evolution of ransomware. As attackers move from simple encryption to double extortion, where both data is held hostage and threatened with leakage, the stakes have grown significantly. “It’s not just about backups anymore; it’s about containment, communication, and continuity,” she notes.

22

CISO SPEAKS To combat these evolving threats, Emirates Leisure Retail is enhancing its identity and access management systems, leveraging threat intelligence, and focusing on continuous education. “Even the best tools won’t help if people don’t know how to recognize and respond to threats,” Nisha emphasizes, highlighting the importance of a strong security culture.

If you weren't in cybersecurity, what would your dream job be?

The future of cybersecurity

What's one piece of tech gear or gadget you can't live without?

Looking ahead, Nisha predicts that AI both as a tool for attackers and as a defense mechanism will be one of the defining forces in cybersecurity.

“Attackers are already leveraging AI to launch highly targeted phishing campaigns, bypass security tools, and scale their operations with minimal effort. On the flip side, as defenders, we need to adopt AI-driven security tools to detect anomalies faster, automate responses, and reduce manual fatigue,” she explains.

In addition to AI, identity-based attacks are another growing concern, especially as organizations move more operations to the cloud and embrace hybrid work environments.

“Credential theft, session hijacking, and privilege escalation are growing threats and without a robust identity governance framework, it's easy to lose visibility and control,” she warns.

Nisha advises CISOs to prepare for these emerging threats by enhancing identity and access management systems, exploring AI for proactive defense, and ensuring their organizations are compliant with evolving data privacy and AI regulations.

Evaluating cybersecurity vendors When it comes to selecting cybersecurity vendors, Nisha emphasizes the importance of partnership over product.

“For me, the top priorities include integration capabilities, threat intelligence and accuracy, scalability, support and responsiveness, and of course, ROI, how much it reduces risk, improves efficiency, or strengthens compliance,” she says.

If I weren’t in cybersecurity, I think I’d be working somewhere that blends creativity, strategy, and a bit of tech—perhaps in product management or entrepreneurship.

If I had to pick just one piece of tech gear, it would have to be my smartphone.

What's your favorite way to unwind after a long day of tackling security challenges?

My favorite way to unwind is by cooking and hosting.

If you could only use one app for the rest of your life, which one would you choose and why?

In an ever-evolving world, I believe it's important to keep exploring new tools and technologies rather than sticking to just one app. As much as I value the tools that help me manage tasks and projects, I always look for new ways to improve productivity and streamline my work.

The beauty of technology is that it’s constantly advancing, and the key to staying ahead is being open to change and innovation. I enjoy experimenting with different solutions, learning from them, and finding the ones that best suit my needs at any given time. The focus is always on adapting and growing, both personally and professionally.

What's a fun or quirky hobby you enjoy when you're not busy with work?

When I'm not busy with work, I love to unwind by creating mandala art. There’s something incredibly calming about the repetitive process of drawing intricate patterns and filling them with color.

“During the demo phase, everything looked perfect. But once we rolled it out, we faced integration challenges, especially with our SIEM and endpoint solutions. Their support was slow, and it took months to stabilize,” Nisha notes. In contrast, another vendor exceeded expectations by offering customized dashboards and additional training to ensure user adoption.

www.techxmedia.com

21

CISO SPEAKS

Is your business treating cybersecurity

STRATEGICALLY ENOUGH? Cybersecurity is no longer a back-office function, it’s a strategic imperative. At Truebell Group, Manoharan Mudaliar, Information Security Manager, is at the forefront of enabling this shift. His mission is clear: ensure innovation happens securely, without slowing business momentum.

“Digital transformation in trade and commerce is accelerating rapidly,” he explains, describing how AI is optimizing supply chains, cloud platforms are redefining retail operations, and customer analytics are fueling hyper-personalization. But with every new capability comes a parallel surge in risk.

That balance between agility and assurance was tested during a critical transition to a multi-cloud architecture that supported realtime inventory insights across regions. “We embedded a securityby-design model from the outset,” Mudaliar shares, “leveraging DevSecOps pipelines, cloud-native security tools, and robust data governance.” The result was a system that not only delivered faster deployment cycles but also reduced the organization’s risk exposure, proving that security can enable innovation rather than impede it.

The Zero Trust mindset in motion For Mudaliar, adopting Zero Trust wasn’t a one-off project, it was a strategic shift in mindset. “Zero Trust is not a destination,” he reflects. “It’s about continuously validating users, devices, and access.”

Truebell’s journey began where many should: identity. By rolling out federated SSO, risk-based MFA, and revamping user provisioning, the team laid a foundation of trust. They then expanded to device-level assurance and granular network segmentation, focusing on areas like third-party vendor access and point-of-sale systems.

But the path wasn’t without obstacles.

“One unexpected challenge was legacy system integration, some platforms simply weren’t built for a Zero Trust world,” he recalls.

To bridge that gap, his team introduced layered controls and robust API gateways, ensuring both visibility and control without disrupting critical operations. Importantly, they kept business units engaged throughout the process, recognizing that transparency was key to maintaining momentum.

Tomorrow’s threats are already here As AI advances, so do the threats. Mudaliar points to a worrying trend: deepfakes and synthetic fraud are no longer theoretical, they’re impacting the commerce sector now.

“Whether it’s impersonating executives for fraudulent authorizations or manipulating product reviews, these threats are evolving fast,” he warns. To counter this, Truebell is implementing behavioral biometrics and AI-driven fraud detection systems that can flag even subtle anomalies in user behavior.

24

CISO SPEAKS “We’ve also set up a dedicated threat intelligence stream focused specifically on AI-based threats,” he adds, highlighting the company’s commitment to staying ahead of the curve.

What lies ahead Looking forward, Mudaliar sees a collision course between AI innovation and increasing regulatory pressure, especially around third-party risk. “Many commerce platforms rely heavily on external data enrichment or fulfillment partners,” he notes. “That makes AI supply chain risk a ticking time bomb.”

To get ahead of it, his team has begun assessing vendors’ AI usage, including how models are trained and governed.

“We’re also building internal AI governance frameworks to comply with upcoming EU and APAC regulations,” ensuring that as AI becomes more embedded in operations, it remains compliant and ethical.

Choosing vendors When evaluating cybersecurity partners, Mudaliar is pragmatic. “I focus on interoperability, commerce-relevant threat intelligence, time-to-value, and vendor resilience,” he says.

One standout experience came with a vendor offering AI-powered fraud prevention that significantly reduced fake accounts and chargebacks. But it’s not always a win.

“One EDR provider failed to cover IoTbased retail devices, leaving gaps we couldn’t afford,” he recalls.

Since then, real-world simulations and red teaming have become standard in vendor evaluations, because a glossy report doesn’t mean real-world readiness.

Bridging the gaps in vendor offerings Despite an expanding cybersecurity market, Mudaliar sees glaring gaps, especially around contextual understanding of the commerce sector.

If you weren't in cybersecurity, what would your dream job be?

Honestly, I had my eyes set on joining the Air Force.

I’ve always been drawn to discipline, strategy, and high-pressure environments, which probably explains why I ended up in cybersecurity! There’s something inspiring about defending airspace and now, I just defend cyberspace What's one piece of tech gear or gadget you can't live without?

My MacBook with my virtual machines—it's my portable SOC, lab, and war room all in one. Whether I’m testing malware samples, simulating attacks, or fine-tuning threat intel dashboards, it’s always mission critical. If it ever goes missing, I’d probably launch a full-scale IR just to find it!

What's your favorite way to unwind after a long day of tackling security challenges?

Spending time with my pet, Loki. He’s part therapist, part mischief-maker—and the only one who doesn’t judge my threat models or missed alerts. No matter how intense the day’s been, a quick play session with Loki resets everything. He’s my furry stress relief strategy!

If you could only use one app for the rest of your life, which one would you choose and why?

It’s where I get the fastest threat intel, zero-day chatter, meme-driven SOC humor, and occasional existential dread. Basically, a CISO’s dashboard with personality.

Where else can you see a CVE drop, a security researcher roasts it, and a cat meme in the same scroll?

“Support for regional frameworks like GCC or ASEAN commerce laws, and native ERP and marketplace integrations—that’s what we really need,” he says, underlining a call for smarter, sectorspecific security innovation.

“Commerce fraud patterns are vastly different from those in finance or healthcare,” he explains. “Yet most vendors don’t reflect that in their threat models.”

He’d like to see vendors invest in tailored machine learning models for commerce specific risks like logistics disruption, API abuse, and fraud.

www.techxmedia.com

23

CISO SPEAKS

Power, production and protection in the cyber challenge of

MODERN INDUSTRY

As industries advance towards digital transformation, the threat landscape continues to evolve at an alarming pace.

Cybersecurity, once considered a back-office necessity, is now at the very core of operational resilience. Naman Taldar, Regional Lead (OT Cyber Security) at Rockwell Automation, offers a critical view of today’s most pressing threats and a clear roadmap for securing the future.

"The world of cybersecurity is always evolving, with cybercriminals constantly finding new and more persistent ways to exploit vulnerabilities," Taldar notes. "One significant evolution is seen in ransomware attacks, which have moved beyond simply encrypting data and demanding a ransom. Modern ransomware involves data exfiltration and threats of public disclosure, disrupting business operations and damaging reputations."

Taldar highlights an array of risks, from operational disruptions and insider threats to sophisticated phishing campaigns, ransomware, unauthorized third-party access, cloud vulnerabilities, and even AI-driven threats such as deepfake identities that critical infrastructure and manufacturing organizations must now guard against.

The new frontier: IT/OT convergence As IT and OT systems converge, operational possibilities expand but so too do vulnerabilities.

"IT/OT convergence has enabled the critical infrastructure sectors to go where it has never gone before," Taldar explains. "The seamless communication between IT and OT networks has led to increased plant floor efficiencies and hefty cost reductions but has also presented new risks."

To counterbalance opportunity with resilience, Rockwell Automation deploys five strategic pillars: • A programmatic approach • Defense in Depth and Secure-by-Design thinking • Leveraging AI and automation • Comprehensive asset management • Participating in local forums.

• Alignment with global standards like IEC 62443 and NIST frameworks Taldar emphasizes that these are not abstract ideals but they are actionable steps informed by field experience and industry best practices, helping organizations fortify their OT environments in today’s hyper-connected world.

26

CISO SPEAKS Why interoperability is Non-Negotiable Cybersecurity integration in complex industrial environments demands more than just functionality; it demands seamless interoperability.

"Interoperability is critically important when integrating third-party cybersecurity solutions with Rockwell Automation's existing platforms and systems," Taldar stresses.

If you weren't in cybersecurity, what would your dream job be?

I would love to be a Pilot :P flying around the world and going to places, I love travelling.

What's one piece of tech gear or gadget you can't live without?

Rockwell's diverse ecosystems including PLCs, HMIs, SCADA systems, MES platforms, and industrial networks like EtherNet/IP — require precise, reliable integration. Poorly connected security tools risk disrupting real-time operations, causing communication failures, and even leading to safety incidents.

My Phone which keeps me busy and due to my travelling profile, a battery bank.

"Interoperability ensures that security measures do not impede the real-time performance and deterministic nature of Rockwell's systems," he adds. "It supports a comprehensive cybersecurity approach, streamlines security operations, reduces complexity, and facilitates compliance with regulatory standards."

I still watch Sci-fi movies in my free time just for Fun, my best way to relax is long drive (Alone) with some good music.

Innovation and collaboration

I would choose a multi-tasking and video call app, considering I stay away from my friends and family back home.

Keeping in view the dynamic threat environment, no organization can afford to operate in isolation. Taldar champions a model where innovation and vendor collaboration are at the heart of resilience.

"Innovation and vendor collaboration are indispensable in the ongoing battle against increasingly sophisticated cyberattacks," he affirms.

Here, innovation means embedding AI, automation, and proactive threat detection into core operations. Collaboration ensures diverse expertise is pooled, enriching threat intelligence and enhancing response capabilities.

"Successful partnerships demonstrate the power of working together to create a stronger and more resilient cybersecurity ecosystem," Taldar adds.

The next 5–3 years Taldar outlines a future where cybersecurity must adapt rapidly to emerging realities.

"If we look at the next 5–3 years, several key technologies and trends are poised to redefine industrial cybersecurity, driven by the convergence of IT and OT systems, evolving threat landscapes, and regulatory pressures," he says.

www.techxmedia.com

What's your favorite way to unwind after a long day of tackling security challenges?

If you could only use one app for the rest of your life, which one would you choose and why?

What's a fun or quirky hobby you enjoy when you're not busy with work?

Handling my 4 year old little monster & 9 year old Princess which takes up most of my energy. If I get free time , I love spending time with them and respond to most unusual questions you can ever think off.

Key forces shaping the future include: • AI and advanced analytics • Expanded attack surfaces from deeper IT/OT integration • Zero Trust Architecture • Integrated, interoperable security platforms • Increased regulatory compliance focus • Increased regulatory compliance focus Taldar believes that technology vendors play an important role in this transformation.

"Technology vendors can support this vision by investing in R&D, adopting AI and analytics responsibly, enhancing supply chain security, and offering integrated, interoperable solutions," he concludes

25

CISO SPEAKS

Innovation without

COMPROMISE In a digital world defined by acceleration, few understand the delicate balance between progress and protection better than Mohammed Nabeel Zubair, Senior Cybersecurity & Risk Compliance Engineer at Makita Gulf FZE. With experience spanning critical infrastructure, academia, and international compliance frameworks, Nabeel is not only defending systems, he’s shaping the future of cybersecurity.

“Balancing innovation and emerging risks is at the core of my role,” he explains. This philosophy was put to the test during Makita’s hybrid cloud transformation, which increased operational efficiency by 35% but also introduced identity and access management challenges. To counter them, Nabeel’s team “integrated AI-driven threat detection, implemented Zero Trust Architecture, and ensured full compliance with NIST, ISO 27001, and GDPR.” Their solution was both secure and scalable: policy-as-code enforcement, isolated network design, and machine learningdriven anomaly detection safeguarded $500M in digital assets.

Just as crucial was early stakeholder alignment, with Nabeel leading “cross-functional workshops where we translated security policies into operational guardrails for DevOps and cloud architects.”

Zero Trust: From Principle to Practice Nabeel doesn’t shy away from complexity and Zero Trust adoption at Makita Gulf was no exception. “Our Zero Trust journey was phased and strategic,” he says.

Beginning with identity hardening via Azure AD, MFA, and conditional access, the initiative reduced identity-based threats by %45. The next steps, micro-segmentation and Zero Standing Privileges added rigor to lateral traffic controls in hybrid cloud environments. However, the journey wasn’t without hurdles.

“One unexpected challenge was the lack of modern security protocols in legacy business applications,” Nabeel notes.

By crafting custom wrappers and token-based authentication models, his team brought even the most outdated systems into alignment with NIST 207-800. To ensure the framework remains agile, they now leverage telemetry, red team insights, and graph-based access mapping, which have improved key metrics like MTTD and MTTR.

The future is already knocking While most security teams are reactive, Nabeel is focused on futureproofing.

His biggest concerns?

Quantum computing, deepfakes, and autonomous AI-driven attacks.

CISO SPEAKS “Quantum algorithms threaten the integrity of today’s encryption. Deepfakes pose social engineering risks.”

If you weren't in cybersecurity, what would your dream job be?

To counter this, Nabeel’s team is already testing post-quantum cryptographic protocols, deploying AI-based digital forensics, and building honeynets connected to real-time ML systems. His teams are also preparing for the rise of “autonomous cyber weapons and synthetic identity fraud.”

If I weren’t in cybersecurity, I’d most likely be a gem merchant or a mechanical engineer. I’m originally from Sri Lanka, a country known for its rich gem heritage, and gem trading was actually my grandfather’s profession. Growing up, I was surrounded by stories of sapphires, precision craftsmanship, and the deep knowledge needed to evaluate a stone’s true value. That world still fascinates me—there’s something about the blend of science, intuition, and legacy in gem trading that resonates with me even today.

“CISOs of the future will need to think more like futurists anticipating technology shifts before they occur and embedding agility into their architecture.”

From vendor evaluation to ecosystem integration Nabeel applies the same precision to evaluating vendors as he does to building architecture.

“I prioritize integration, threat intelligence maturity, compliance mapping, and ROI.” While some platforms have delivered “an XDR platform that integrated seamlessly with Splunk... reduced analyst alert fatigue by 40”% others fell short, such as one “cloud-native” vendor that lacked proper API visibility.

These lessons now inform rigorous simulationbased evaluations and post-sales SLA tracking.

He’s also vocal about what’s missing in the market: “Vendors often lack context-aware AI explainability, comprehensive hybrid-cloud coverage, and real-time adaptive remediation.” He wants to see more “explainable AI, universal policy engines, and autonomous detection-to-response orchestration”, all supported by federated threat intelligence pipelines.

Cybersecurity as a culture, not a checkbox Perhaps most impressive is Nabeel’s success in embedding cybersecurity into the DNA of his organization. “Culture is everything,” he says.

At Makita, each department has its own cybersecurity maturity index and KPIs. Awareness training is gamified, roadshows bring education to every employee, and achievements in threat reporting are recognized.

“This approach led to a 300 % increase in threat reporting within one year.” Through teaching roles and mentorship, Nabeel has trained over 200 cybersecurity professionals globally, many of whom now serve in critical infrastructure or federal roles.

“Cybersecurity culture must be continuous, customized, and cross-functional.”

www.techxmedia.com

What's one piece of tech gear or gadget you can't live without?

Without a doubt, my mobile phone. It’s far more than just a communication device—it’s my mobile SOC (Security Operations Center), knowledge hub, task manager, and digital companion. I rely on it for monitoring critical alerts, skimming through threat intelligence feeds, organizing notes and research, and even mentoring students remotely.

What's your favorite way to unwind after a long day of tackling security challenges?

Unwinding is essential in a field where your mind is always two steps ahead. I enjoy a mix of things depending on the day. I often start by catching up on cybersecurity podcasts It’s both relaxing and a way to stay current with global developments. Sometimes I switch to a favorite show or just spend time with family, which instantly grounds me. Prayer gives me mental clarity and focus, while diving into technical reading or a good research article lets me unwind intellectually.

If you could only use one app for the rest of your life, which one would you choose and why?

I’d choose Notion—hands down. It’s the central hub for nearly every aspect of my life. I use it for organizing research, managing my cybersecurity strategy documentation, planning lectures, tracking personal goals, and even keeping up with to-do lists. Its flexibility allows me to structure information the way my brain processes it..

What's a fun or quirky hobby you enjoy when you're not busy with work?

I’m a huge fan of escape rooms and cybersecuritythemed games. There’s something incredibly satisfying about being locked in a scenario that demands lateral thinking, puzzle-solving, and teamwork under pressure. It mirrors incident response in many ways—you're analyzing clues, identifying gaps, and racing against the clock.

27

NEWS

UAE Cybersecurity Council Participates in Google Cloud Next 2025 The United Arab Emirates, represented by the UAE Cybersecurity Council, took part in Google Cloud Next 2025 in Las Vegas, USA. The global summit, hosted annually by Google, focused on advancements in cloud computing, artificial intelligence, and cybersecurity.

This year’s event brought together tech leaders, developers, and partners from around the world. Google introduced several AI-powered tools, including the Gemini 2.5 Pro model, Gemini Code Assist, and Google AI Studio. These tools are designed to enhance cloud development and support innovation in multiple sectors, including healthcare and commerce.

During the summit, the UAE Cybersecurity Council announced a major collaboration with Google. The two parties will launch a Global Cybersecurity Centre of Excellence in Abu Dhabi.

This new centre reflects the UAE’s commitment to digital transformation and aligns with the country’s Digital Economy Strategy 2031.

The centre aims to strengthen UAE cybersecurity capabilities and promote the safe adoption of digital technologies. It will also support innovation by integrating Google’s advanced products and services into the UAE’s digital infrastructure.

Dr. Mohamed Al Kuwaiti, Head of Cybersecurity for the UAE Government, represented the country at the event.

In his address, he underlined the importance of international partnerships and highlighted national initiatives such as Falcon LLM and Cyber Pulse, which focus on improving digital security.

As part of the collaboration, Abu Dhabi will host the regional headquarters of Google’s first Cybersecurity Academy in the Middle East.

The academy will provide certified training programs, develop instructors through Train-the-Trainer sessions, and deliver advanced education in digital technologies.

The initiative is expected to create over 20,300 specialized jobs in the UAE cybersecurity sector. It will also attract an estimated $1.4 billion in foreign direct investment. These efforts are set to boost the country’s economic growth and digital resilience.

In addition, over 25 digital products are currently in development through the UAE-Google partnership.

The collaboration will also support local startups by providing access to customized Google Cloud services.

28

Dr. Mohamed Hamad Al Kuwaiti Head of Cybersecurity for the UAE Government The launch of Google’s regional office in the UAE is expected to contribute further to the local economy. It will help position the UAE as a leading destination for technology, investment, and innovation.

Overall, the initiative showcases the UAE’s dedication to building a secure digital future.

It strengthens the country’s position as a global hub for cybersecurity and reinforces its long-term strategy to lead in AI and cloud technology.

NEWS

Cybersecurity Trends You Can’t Ignore in 2025 As technology continues to evolve at lightning speed, cybersecurity professionals are finding themselves at a crossroads. Business disruption is constant, threats are becoming more complex, and teams are being pushed harder than ever.

So how can security leaders keep up and more importantly, stay ahead?

Gartner has identified six key cybersecurity trends for 2025 that every security and risk management (SRM) leader should have on their radar. These aren’t just buzzwords they’re the trends shaping how organizations will defend, adapt, and thrive in the face of nonstop change.

Trend 1: GenAI Driving Data Security Programs Most security efforts and financial resources are traditionally focused on protecting structured data such as databases.

However, the rise of GenAI is transforming data security programs, shifting focus to protect unstructured data text, images and videos.

Many organizations have completely reoriented their investment strategies, which has significant implications for large language model (LLM) training, data deployment and inference processes.

Ultimately, this shift underscores the changing priorities that leaders must address as they communicate the impact of GenAI on their programs.

Trend 2: Managing Machine Identities Increasing adoption of GenAI, cloud services, automation and DevOps practices, has led to the prolific use of machine accounts and credentials for physical devices and software workloads.

If left uncontrolled and unmanaged, machine identities can significantly expand an organization’s attack surface.

According to Gartner, SRM leaders are under pressure to build a strategy to implement robust machine identity and access management (IAM) to protect against attacks, but it must be a coordinated enterprise-wide effort. A Gartner survey of 335 IAM leaders globally, conducted between August and October 2024, found that IAM teams are only responsible for %44 of an organization’s machine identities.

Trend 3: Tactical AI SRM leaders are facing mixed results with their AI implementations, leading them to reprioritize their initiatives and focus on narrower use cases with direct measurable impacts.

These more tactical implementations align AI practices and tools with existing metrics, fit them into existing initiatives, and enhance visibility of the real value of AI investments.

www.techxmedia.com

SRM leaders now have clear responsibilities to secure third-party AI consumption, protect enterprise AI applications and improve cybersecurity with AI. By focusing on more tactical, demonstrably beneficial improvements, they can minimize the risks for their cybersecurity programs and can more easily demonstrate progress.

Trend 4: Cybersecurity Technology Optimization According to a Gartner survey of 162 large enterprises, conducted between August and October 2024, organizations use an average of 45 cybersecurity tools. With over 3,000 vendors in cybersecurity, SRM leaders need to optimize their toolsets to build more efficient and effective security programs.

Gartner recommends aiming for a balance that procurement, security architects, security engineers, and other stakeholders are satisfied with to maintain the right security posture. To achieve this, SRM leaders should consolidate and validate core security controls and focus on architecture that enhances portability of data.

Threat modeling and organizational technology drivers such as AI adoption can also be used to assess advanced needs.

Trend 5: Extending Security Behavior and Culture Program Value Security behavior and culture programs (SBCPs) Cybersecurity burnout and its organizational impact must be recognized and addressed to ensure cybersecurity program effectiveness. The most effective SRM leaders are not only prioritizing their own stress management, but they are also investing in teamwide wellbeing initiatives that demonstrably improve personal resilience.

Gartner analysts are presenting key strategies and technologies in cybersecurity at the Gartner Security & Risk Management Summit, taking place through today in Dubai.

29

NEWS

UAE, Google Cloud Launch Cybersecurity Center of Excellence UAE partners with Google Cloud to launch a Cybersecurity Excellence Center in Abu Dhabi, boosting AI, digital resilience, and startup growth across the region.

In line with the UAE Government’s vision to become a global hub for artificial intelligence and digital leadership, national institutions are taking firm steps to enhance digital infrastructure and strengthen cybersecurity. These efforts reflect the country’s commitment to following the directives of its leadership and maintaining global competitiveness in emerging technologies.

As part of this strategy, the UAE Cabinet has approved support for Google Cloud to launch its first Cybersecurity Excellence Center in Abu Dhabi.

This partnership underlines the UAE’s ongoing efforts to advance digital transformation and develop national capabilities in cybersecurity and AI. The initiative supports the government’s aim to create a secure and trusted digital environment. It is designed to benefit organizations across sectors by improving cybersecurity readiness and driving innovation. It also highlights the UAE’s intent to invest in cutting-edge technology and empower local talent.

This development follows the recent visit of H.H. Sheikh Tahnoon bin Zayed Al Nahyan, Deputy Ruler of Abu Dhabi and National Security Adviser, to the United States. During the visit, Sheikh Tahnoon met with top global executives to discuss strategic partnerships in artificial intelligence. These discussions explored how AI can drive sustainable growth and enhance global innovation.

As a result, the UAE Cybersecurity Council, in collaboration with Google Cloud, announced the new Cybersecurity Excellence Center. The facility will focus on building cybersecurity capabilities and positioning the UAE as a regional and global center for innovation and education in this field.

The center will promote collaboration with global institutions, offer training programs, and build expert talent. A key part of the initiative is a CSC-backed training program delivered by Mandiant, part of Google Cloud. It will provide immersive, hands-on courses to help professionals respond to advanced cyber threats.

Courses will include real-world simulation exercises and flexible learning paths. Government employees across the UAE will also have access to more than 900 online labs and courses via Google Cloud Skills Boost.

In addition, Google Cloud announced a new accelerator program in 2025 for 25 high-potential startups from the Hub71 ecosystem. These startups will receive mentorship and support in scaling their businesses.

30

H.H. Sheikh Tahnoon bin Zayed Al Nahyan Deputy Ruler of Abu Dhabi and National Security Adviser, to the United States.

The top-performing ones will qualify for up to 300,000$ in Google Cloud credits, the highest available tier globally.

All Hub71 startups will be eligible for cloud credits to access advanced tools and infrastructure.

This move aims to support the UAE’s growing startup ecosystem and promote entrepreneurship in technology.

Google Cloud will also invest in advanced cloud infrastructure in the UAE, supported by the Cybersecurity Council.

This investment will provide the foundation needed to drive innovation and ensure secure digital operations. It also shows confidence in Google Cloud’s platform and its alignment with the UAE’s cybersecurity goals.

NEWS

CrowdStrike, Wipro Partner on Next Gen SIEM for Cybersecurity CrowdStrike has announced a new partnership with Wipro Limited. Wipro will integrate the Falcon platform into its CyberShield offering.

This upgrade brings advanced AI-powered threat detection and response. It also simplifies workflows and reduces security costs.

The use of CrowdStrike Falcon Next-Gen SIEM allows faster time to value. It also lowers total cost of ownership (TCO). With native access to CrowdStrike data, Wipro offers improved cybersecurity outcomes.

According to Daniel Bernard, Chief Business Officer at CrowdStrike, Wipro’s decision highlights the platform’s edge over legacy and modern alternatives.

Together, they aim to scale threat detection and response across enterprises.

The partnership also helps address the global cybersecurity skills gap. Many SIEM systems are outdated, slow, and expensive. Falcon’s AI, automation, and index-free design solve these challenges.

Tony Buffomante, Senior Vice President at Wipro, says moving to CrowdStrike’s SIEM accelerates the shift to modern, AI-based security operations.

The updated platform provides several benefits: It offers real-time threat detection using GenAI. It improves analyst productivity through automation.

It cuts costs by eliminating expensive data ingestion. And it ensures 7/24 monitoring through Wipro’s global Cyber Defense Centers.

This collaboration brings global enterprises scalable, AI-driven cybersecurity.

With both technology and services aligned, the solution helps secure digital operations more effectively.

Daniel Bernard, Chief Business Officer at CrowdStrike

www.techxmedia.com

31

INTERVIEW

IT’S NOT ABOUT HACKERS IT’S ABOUT ACCESS

MOREY

HABER

Chief Security Advisor BEYONDTRUST

32

INTERVIEW

We sat across with Morey Haber, a name wellknown in global cybersecurity circles. With a calm, thoughtful demeanor that contrasted the often chaotic world of cyber defense, Morey exudes a rare blend of technologist, historian, advisor and craftsman.

“I’ve been with BeyondTrust for 21 years,” he said matter-of-factly. “I started in engineering, managing teams and product. Then I served as CTO and CISO. Now, I’m helping clients understand security risks as Chief Security Advisor. And this year, my seventh book is being published.”

From CISO to cyber storyteller If there’s one thing Morey does well, beyond threat mitigation, it’s storytelling and that’s not just metaphorical. He’s authored six published books (with multiple editions), with a seventh on the way.

But the origin of his writing career? Less grand, more human.

“It was a dare,” he said, laughing. “Literally. My CTO at the time said, ‘You write a lot, do you think you could write a book?’ I said yes. He dared me. That was the first. After that, it just became natural.”

The books reflect his deep understanding of attack surfaces, the evolution of threats, and how organizations should adapt. His upcoming title, Attack Vectors, traces cybersecurity’s history from the 1950s to now.

“Why do firewalls exist? Why antivirus? Why identity security? Everything we use today was born from attacks we’ve already faced. This book explores those stories.”

Cloud security starts with seeing clearly When we turned the conversation toward today’s cybersecurity climate, especially in cloud environments, Morey didn’t begin with buzzwords or vendor jargon. Instead, he talked about something more fundamental: visibility.

“If you’re going to put something in the cloud, make sure you have full visibility into its operations because it’s not your computer. It’s someone else’s,” he emphasized.

Maury’s approach to cloud security is rooted in experience and not just reacting to threats but building from first principles.

“You need visibility first. Then comes detection, mitigation, remediation and finally, recovery if something bad happens. But you can’t protect what you can’t see.”

The Real Risk Isn’t Malware. It’s Misconfiguration.

Morey discusses further on what really keeps CISOs up at night.

www.techxmedia.com

“It’s not the hacker, or whether a patch is applied.

Those things are established. It’s the access that wasn’t secured. The credential that wasn’t removed. The product we know is vulnerable and can’t replace in time.”

“The things that worry me the most are the ones out of my control, those spin in my head.”

It’s a sobering reminder that breaches are often not grand acts of warfare but quiet oversights, lurking within systems.

AI: A social engineering revolution As the topic moved to artificial intelligence, Maury’s insight turned almost prophetic.

“The biggest thing about AI isn’t malware. It’s making social engineering harder to detect.”

He explained the threat with a scenario that felt unsettlingly real.

“Imagine spoofing your CEO’s voice, sending a voicemail that says, ‘Hey, I need this,’ but it’s a scam. That’s more dangerous than a ‘send me a gift card’ email. It sounds just like you. That’s AI.” But AI, he believes, is not just an attacker’s weapon. It’s also a defender’s lens especially in Identity and Access Management (IAM).

“IAM will benefit enormously. AI will help profile what normal behavior looks like, whether for a human or a machine identity. Today, roles are manually defined. AI can streamline them, spot overlap, and even flag anomalies.”

He describes a near future where AI not only predicts risk, but summarizes thousands of session logs into meaningful, readable insights: “Instead of watching hours of recorded sessions, generative AI will just tell you what happened.”

A Lesson from early days

When I asked about his most impactful earlycareer lesson, Morey didn’t talk about coding languages or certifications. He talked about something human.

“Be quiet. Listen. You don’t have the answer to everything. Most of the time, formulate your thoughts after listening to others. Not every question needs an instant answer.”

Simple. Yet profound. A trait that likely shaped his rise from engineer to trusted advisor.

Inside the Okta incident Morey then shared one of the more public security events BeyondTrust navigated: The 2023 Okta support breach.

“It was detected within hours. Remediation required working closely with supply chain vendors. It was all textbook, containment, isolation, forensics. Our tabletop exercises paid off.”

33

INTERVIEW

The blog about the incident, he says, is available publicly.

“We followed our incident response plan, and the vendor ultimately admitted we were right. That validation is key.”

The Metrics that matter

In a time when CISOs are under pressure to prove ROI, Morey believes in clarity and simplicity. His preferred framework? CIS Top 18.

“It’s a framework any company can use. Simple, straightforward questions. Are you using MFA everywhere? Do you monitor logs? Each control rolls up into a score, and that score gives a red-yellow-green dashboard to show the board.”

Frameworks, he says, are not just for audits, they're budgeting tools. They spotlight gaps. They help build cases for change.

34

AI will help profile what normal behavior looks like, whether for a human or a machine identity.

Today, roles are manually defined. AI can streamline them, spot overlap, and even flag anomalies.

37

INTERVIEW

SECURITY, SPEED, AND NO MORE VPNS? CLOUDFLARE SAYS THAT’S THE FUTURE

BASHAR BASHAIREH

AVP Middle East, Türkiye & North Africa CLOUDFLARE

38 36

INTERVIEW Bashar Bashaireh, AVP for the Middle East, Türkiye, and North Africa at Cloudflare, shares how the company’s globally distributed “connectivity cloud” is securing everything from web apps and APIs to Zero Trust networks, all while advancing sustainability and transparency across the digital ecosystem.

using a combination of proprietary DDoS mitigation technologies, AI, and constantly updated threat intelligence. Malicious traffic such as volumetric floods, protocol-based attacks, and application-layer threats is identified and blocked at the edge, closest to the source, before it can impact the origin server.

How does Cloudflare combine security and performance across the edge?

Cloudflare’s mitigation is always on, operates autonomously without human intervention, and reacts within seconds to new threats, ensuring legitimate traffic flows uninterrupted even during the most sophisticated and large-scale attacks. In its latest Q2025 1 DDoS Report, Cloudflare reports to have blocked the most intense packet rate attack on record, peaking at 4.8 billion packets per second

Cloudflare combines security and performance across the edge by operating on a globally distributed network (335+ cities in 125+ countries) that processes and filters traffic as close to the end user as possible. This unified platform, the connectivity cloud, enables Cloudflare to deliver robust security such as DDoS mitigation, a web application firewall, bot management, and Zero Trust access without compromising speed and performance, which is enhanced through intelligent traffic routing, content caching, and edge computing reducing latency and server load. By inspecting and optimizing traffic in a single pass at the edge, Cloudflare eliminates the need for multiple middleware solutions, ensuring faster, more secure and private digital experiences at scale.

What’s unique about your approach to Zero Trust networking?

Cloudflare's approach to Zero Trust networking is unique because it leverages its global network to enforce security policies closer to users, applications, and data eliminating the need for traditional VPNs or centralized security appliances. Rather than relying on a perimeter-based model, Cloudflare applies identity-based, context-aware access controls dynamically, evaluating every request based on user identity, device posture, and location in real time.

Its connectivity cloud platform is fully cloud-native and integrates seamlessly with existing identity providers, offering fast, secure access to both internal and SaaS applications without backhauling traffic.

By combining access control, secure web gateway, DNS filtering, and inline CASB into a single edgebased platform, Cloudflare’s connectivity cloud simplifies Zero Trust adoption and delivers it with low latency and global scale.

How does Cloudflare protect against large-scale DDoS attacks in real-time?

Cloudflare protects against large-scale DDoS attacks in real time by leveraging its massive, globally distributed network that spans over 335 cities and can absorb over 348 Tbps of traffic. All incoming traffic is routed through this network, where it is automatically analyzed and filtered

www.techxmedia.com

What’s the impact of your Workers platform in enabling secure serverless computing?

Cloudflare’s Workers platform enables secure serverless computing by running lightweight, isolated code at the edge of its global network, allowing developers to build and deploy applications without managing infrastructure or exposing origin servers. Unlike traditional serverless platforms that centralize execution in specific regions, Workers operates across hundreds of data centers worldwide, reducing latency and minimizing attack surfaces by handling requests closer to users.

Security is baked in through isolation models that don’t rely on containers or VMs, reducing the risk of cross-tenant vulnerabilities.

Combined with integrated DDoS protection, access controls, and secure data handling, Cloudflare Workers empowers developers to deliver fast, scalable, and secure applications with a Zero Trust approach by design.

How are you helping customers secure APIs and web applications more effectively?

Cloudflare helps customers secure APIs and web applications more effectively by providing an integrated, edge-based platform that combines intelligent threat detection, real-time traffic filtering, and adaptive access controls. Its Web Application Firewall (WAF) uses machine learning and global threat intelligence to automatically identify and block malicious requests, while API Gateway enforces strict schema validation, rate limiting, and authentication to protect APIs from abuse and data breaches. By inspecting all traffic at the edge, Cloudflare eliminates blind spots and ensures threats are mitigated before reaching origin infrastructure.

Combined with bot management, DDoS protection, and Zero Trust access controls, Cloudflare delivers a comprehensive and scalable security solution that protects applications without sacrificing performance or developer agility.

37

INTERVIEW

What’s the role of Cloudflare Radar in increasing transparency on global threats?

Cloudflare Radar plays a key role in increasing transparency on global threats by providing real-time insights and data on Internet traffic patterns, emerging cyberattacks, and connectivity disruptions observed across Cloudflare’s vast global network.

By aggregating and anonymizing billions of requests per day, Radar offers a clear, public view into trends like DDoS activity, phishing campaigns, and Internet outages, helping organizations, researchers, and policymakers better understand the evolving threat landscape. This transparency not only raises awareness but also supports faster, more informed responses to incidents, ultimat ely contributing to a safer and more resilient Internet.

How do you balance sustainability and green tech with global infrastructure expansion?

Cloudflare balances sustainability and green technology with global infrastructure expansion by designing its network to be both energy efficient and environmentally responsible. The company strategically partners with data center providers that prioritize renewable energy and carbon neutrality.

38 40

Cloudflare also focuses on software and hardware optimizations that reduce energy consumption per request, allowing its edge network to scale globally without proportionally increasing its carbon footprint.

Through initiatives like network consolidation, efficient server utilization, and transparent sustainability reporting, Cloudflare ensures that as its infrastructure grows, its environmental impact remains minimal, aligning performance and security with a commitment to a greener Internet.All information can be found in Cloudflare’s 2024 Impact Report.

Cloudflare balances sustainability and green technology with global infrastructure expansion by designing its network to be both energy-efficient and environmentally responsible.

41

INTERVIEW

IF YOU WANT TO STOP HACKERS, START THINKING LIKE ONE

ILYA

LEONOV

Regional Director for POSITIVE TECHNOLOGIES

40

INTERVIEW As threats grow more complex and critical infrastructure becomes a prime target, security teams are flipping the playbook. Offensive tactics, real-time threat intel, and a laser focus on what can’t be allowed to fail are driving a new, more aggressive defense strategy. Ilya Leonov, Regional Director for Positive Technologies, MENA, breaks down why the best defense today starts with a hacker’s mindset.

How does Positive Technologies integrate offensive cybersecurity techniques into enterprise defense?

At Positive Technologies, we are proud to have the largest team of Offensive Security experts in the country. This deep offensive expertise allows us to tightly integrate Red Team experience into our defense practices.

Our solutions are continuously improved by applying real-world attack techniques and tactics identified during offensive operations. This unique integration ensures that our defense products, solutions, and systems are highly resilient and able to anticipate sophisticated adversary behaviors.

Can you explain how your MaxPatrol platform supports vulnerability management and compliance?

How does your Threat Intelligence Center differentiate from others in the market?

The Positive Technologies Expert Security Center (PT ESC) holds a unique position on the market.

Our experts gather exclusive threat intelligence daily through the protection of critical national infrastructure and complex incident investigation.

Over the last few years, PT ESC has dealt with some of the most sophisticated attacks and advanced malware strains. This unparalleled real-world experience gives our threat intelligence depth and authenticity, which sets it apart from traditional, purely data driven threat intelligence services.

What is your approach to securing critical infrastructure and national systems?

Protecting critical infrastructure is at the heart of national security. Positive Technologies approaches this with our Result Driven Cybersecurity framework, focusing on identifying non tolerable events those incidents that could lead to catastrophic consequences and building comprehensive cybersecurity strategies to prevent them. Our approach integrates world class products, expert services, continuous security assessments, and ongoing educational programs to ensure resilience at every level.

MaxPatrol is a comprehensive security platform that combines SIEM, Vulnerability Management (VM), and Endpoint Detection and Response (EDR) capabilities.

How do you stay ahead of new and evolving threat vectors?

It provides maximum visibility across the infrastructure, enabling effective control over vulnerabilities and robust response capabilities at the endpoint level. MaxPatrol VM specifically combines advanced asset management features with an AIdriven vulnerability scanning engine.

It’s often said that defenders are always one step behind evolving attackers, and there is some truth to that. However, at Positive Technologies, we leverage deep expertise and firsthand experience in countering complex attacks to stay as close to the forefront as possible.

It prioritizes discovered vulnerabilities based on realtime intelligence about active threat actor campaigns worldwide, ensuring organizations focus on the most critical risks affecting them today.

Our continuous research, realworld investigations, and adaptive defense mechanisms allow us to meet modern cyber threats head on, ensuring that we maintain an edge even in the dynamic world of cyber warfare.

What industries are you seeing the most growth in, and why?

We are seeing the most significant growth in the financial sector. It has demonstrated high cybersecurity maturity and has a clear strategic vision for its security needs. In addition, the industrial sector is undergoing a major shift, prioritizing cybersecurity enhancements for critical infrastructure and operational technology (OT) systems.

This shift is driven by the increasing recognition of cyber risks to national security and business continuity.

www.techxmedia.com

What’s your vision for the future of cyber resilience in high-risk environments?

Looking ahead, we anticipate that AI and automation will play an even greater role on both offensive and defensive sides. Cybersecurity professionals will oversee comprehensive, automated platforms that handle detection, investigation, and response activities.

Another major trend will be the development of dedicated OT Security Operations Centers (OT SOCs), specifically designed to monitor and respond to threats targeting critical infrastructure. This evolution will be essential for safeguarding the most vital assets in increasingly high-risk environments.

41

INTERVIEW

UNDER THE HOOD OF CYBERSECURITY, WHY PACKET LEVEL VISIBILITY MATTERS MORE THAN EVER?

EMAD FAHMY

Systems Engineering Director NETSCOUT

42 44

INTERVIEW Encryption is both a necessity and an obstacle, maintaining visibility into network traffic has become one of the greatest challenges in cybersecurity. To better understand how organizations are dealing with this encrypted terrain, we spoke with Emad Fahmy, Systems Engineering Director at NETSCOUT.

How does NETSCOUT help enterprises maintain visibility in increasingly encrypted traffic?

At NETSCOUT, we help enterprises maintain visibility into encrypted traffic using our nGenius Decryption Appliance. It securely decrypts SSL and TLS traffic without compromising performance, providing full packet visibility across encrypted flows.

This enables IT and security teams to uncover hidden threats and performance issues that would otherwise remain concealed.

By maintaining end to end traffic visibility, we ensure organisations can meet compliance requirements whilst keeping encrypted data accessible for security monitoring and troubleshooting.

What differentiates NETSCOUT’s approach to DDoS mitigation from other vendors?

Our DDoS mitigation combines realtime, packet level visibility with global threat intelligence from ASERT our ATLAS Security Engineering and Response Team.

Unlike many traditional solutions, we offer onpremises, cloud based, and hybrid options that dynamically adapt to changing attack vectors.

Our multi layered defence, strengthened by AI and machine learning, provides proactive protection, minimising downtime and ensuring continuity of services for our customers .

How is Smart Data used in your solutions to improve threat intelligence?

Smart Data is at the core of our solutions. It transforms packet level traffic into rich, actionable metadata with minimal delay. By contextualising network and application behaviours, Smart Data enables faster, more accurate threat detection and incident analysis.

This intelligence is critical for threat hunting, anomaly detection, and forensic investigations, empowering organisations to detect risks earlier and respond decisively across physical, virtual, and hybrid environments.

www.techxmedia.com

How do you support telecom and 5G infrastructure security?

We deliver end-to -end visibility across 5G infrastructure using solutions like nGeniusONE and InfiniStreamNG, which monitor the RAN, core, and edge in real time.

Our tools uncover vulnerabilities and performance issues across complex telecom environments.

Additionally, our Arbor suite defends telecom operators against DDoS attacks, protecting the critical low latency services essential for sectors such as healthcare, smart cities, and autonomous vehicles.

What role does packet-level visibility play in detecting advanced persistent threats (APTs)?

Packet-level visibility is absolutely vital for detecting Advanced Persistent Threats. Our Omnis Cyber Intelligence solution captures and analyses packets throughout the infrastructure, allowing security teams to detect subtle anomalies and hidden communications that indicate APT activity. By reconstructing entire traffic sessions, our customers can trace an attacker’s movements, facilitating both realtime threat detection and retrospective forensic investigations.

How are NETSCOUT’s solutions helping organisations reduce MTTR and improve incident response?

Our unified visibility platform dramatically reduces Mean Time to Repair by enabling precise, rapid root cause analysis across networks, applications, and security systems. Thanks to realtime Smart Data insights, teams can avoid time consuming data mining.

Tools like nGeniusONE correlate user experience, service performance, and security incidents, allowing for efficient prioritisation and quicker incident resolution, thus enhancing both operational resilience and service reliability.

What’s your perspective on the convergence of network performance management and cybersecurity?

We see the convergence of network performance management and cybersecurity as critical in today’s interconnected world.

By integrating packet-level intelligence across both fields, organisations can eliminate operational silos and achieve a unified view of both service health and security posture. Our solutions offer real-time monitoring, threat detection, and forensic capabilities within a single ecosystem, helping IT teams to proactively protect services while maintaining optimal performance.

43

OPINION

SIX TRENDS FROM THE VERIZON 2025 DATA BREACH INVESTIGATIONS REPORT (DBIR) YOU CAN’T IGNORE

SAEED ABBASI

Vulnerability Research Manager QUALYS (TRU)

44

OPINION The 2025 Data Breach Investigations Report reveals critical trends that security teams and leaders must address to protect their organizations against evolving cyber threats. Once again, Qualys contributed to this report with over 100 million anonymized customer data points to help unpack critical patterns and equip organizations with the knowledge to bolster security and stay ahead of future threats.

Key findings show that the exploitation of vulnerabilities as the initial access vector for breaches has grown to 20.% Edge device vulnerabilities grew nearly eight-fold, while the presence of ransomware increased by 37.% Third party involvement in breaches doubled to 30,% and espionage-motivated breaches rose significantly to 17.% Additionally, 46 % of compromised systems with corporate credentials were non-managed devices, highlighting the risks of BYOD (Bring Your Own Device) a result of the hybrid workforce of today and the importance of robust asset management.

Let’s look at the implications of these findings.

Vulnerability Management: The Growing Challenge Across 12,195 confirmed data breaches that were analyzed in the 2025 DBIR, exploiting vulnerabilities as an initial access vector grew significantly, reaching 20 % of breaches. This represents a 34 % increase from the previous year and approaches the frequency of credential abuse (22 %).

This trend demands immediate attention from security teams, particularly as Edge devices and VPNs now represent 22 % of vulnerability exploitation targets, an almost eight-fold increase from just 3 % in 2024.

Organizations must leverage a risk based approach and prioritize vulnerability scanning and patching for internet facing systems. The data clearly shows that attackers follow the path of least resistance, targeting vulnerable edge devices that provide direct access to internal networks.

Qualys Threat Research Unit (TRU) findings reinforce the payoff of this strategy. Analyzing more than half a billion anonymized vulnerability detections from 2024, TRU found that nearly 20 percent of vulnerabilities were later added to CISA’s Known Exploited Vulnerabilities (KEV) but Qualys VMDR customers already remediated before CISA issued its alert.

Security teams should: •

• • • • •

Implement asset management for internal and external assets to gather a complete inventory of their hosts, including assets that run EOL (end of life) software Deploy broad vulnerability detection capabilities Leverage risk based prioritization for findings Implement automated patch management workflows Prioritize patching or mitigating vulnerabilities in edge device Consider compensating controls and alternative mitigation strategies when immediate patching isn’t possible

VPNs Under Siege: Closing the Window Before Attackers Break In According to the report, the median time for organizations to fully remediate edge device vulnerabilities was 32 days, while the median time for these vulnerabilities to be mass exploited was zero days meaning the analyzed vulnerabilities were added to the CISA KEV catalog on or before their CVE publication. This timing gap represents a critical window of exposure that organizations must work to close.

The Qualys Threat Research Unit (TRU) analyzed nearly 100,000 rigorously anonymized detection records focused on VPNs and other secure access tools collected throughout 2024.

Although many organizations act quickly when new flaws land on CISA’s Known Exploited Vulnerabilities (KEV) list, our data shows that remote access vulnerabilities still linger.

In a survival analysis of 17 widely exploited CVEs, the median time to remediate was 15 days, while the median time to weaponization was just three days leaving a 12 day window in which AI enabled attackers can breach exposed edge gateways.

These numbers underscore a hard truth: speed and discipline are the only ways to shrink the 12 day danger zone and beat the three-day weaponization clock.

Treat VPN appliances and secure access gateways as “Tier0” assets and adopt a wartime footing combining rapid patching with layered defenses.

The playbook below turns the data into day-to-day action.

Within two weeks of a vulnerability appearing on the KEV list, that remediation rate rises to 64 percent evidence that continuous, automated scanning and a mature, risk based prioritization program can dramatically shrink the window of opportunity for attackers.

www.techxmedia.com

45

OPINION

Rapid-Fire Defense for VPNs & Secure Access Gateways: Patch fast -Fix every KEV-listed flaw immediately -Keep VPN/firewall firmware current and retire end-of-life gear

Detect and contain -Segment networks so a breached gateway can’t fan out -Stream VPN/firewall logs to an external SIEM in real-time -Run IDS/IPS to spot exploit traffic and abnormal appliance behavior

Cloud and application security programs must evolve to: • Implement automated secret scanning, -24hour credential rotation processes, and multi-factor authentication to secure credentials in third-party environments • Establish comprehensive third-party security assessments and reduce critical vulnerability remediation timeframes • Implement continuous monitoring of third-party security postures • Utilize solutions for unified risk visibility across cloud infrastructure and implement continuous scanning with prioritized remediation based on business criticality

Ransomware: Evolving Tactics and Economics

Compliance and Risk Management

Lock down access -Enforce MFA (plus client certificates where possible) -Disable unused services and separate admin and user portals -Block public access to management ports and rate-limit login attempts

The presence of ransomware in analyzed breaches grew by 37 %, appearing in 44 % of all breaches reviewed (up from 32 % last year). However, the median ransom payment decreased to 115,000$ from 150,000$ the previous year, with %64 of victims refusing to pay (up from 50 % two years ago).

Analysis of infostealer malware credential logs revealed that %30 of compromised systems can be identified as enterprise-licensed devices. However, almost half (%46) of these compromised systems with corporate logins were non-managed devices hosting both personal and business credentials.

Small organizations are disproportionately affected by ransomware. While larger organizations experience ransomware in 39 % of breaches, SMBs face ransomware in a staggering 88 % of breach incidents.

By correlating info stealer logs with ransomware victim data, the DBIR report found that %54 of ransomware victims had their domains appear in credential dumps, and %40 had corporate email addresses in compromised credentials.

Organizations should implement a comprehensive vulnerability management approach that:

Data Protection and Emerging Threats

-Integrates threat intelligence feeds to identify emerging ransomware variants and tactics -Deploys advanced detection mechanisms that specifically flag the association of a vulnerability with known ransomware groups -Utilizes risk-based prioritization to remediate vulnerabilities that ransomware operators actively exploit -Employs next-generation endpoint detection and response (EDR) solutions capable of detecting ransomware-specific behaviors -Develops incident response playbooks that address data exfiltration and extortion scenarios common in modern ransomware attacks.

Generative AI presents increasing risks, with %15 of employees routinely accessing GenAI systems on corporate devices. Among these, %72 used non-corporate emails, anWWd %17 used corporate emails without integrated authentication systems.

Cloud and Application Security: The Third-Party Challenge

The 2025 DBIR findings emphasize the need for a holistic security approach that prioritizes vulnerability management, while addressing third-party risks and evolving ransomware tactics.

Third-party involvement in breaches doubled from %15 to %30, with credential reuse in third-party environments becoming increasingly common. The research found the median time to remediate leaked secrets discovered in GitHub repositories was 94 days.

46

Espionage-motivated breaches grew significantly to %17, with these attackers leveraging vulnerability exploitation as an initial access vector %70 of the time. Interestingly, approximately %28 of incidents involving state-sponsored actors had a financial motive.

In addition, analysis indicates that “synthetically generated text in malicious emails has doubled over the past two years,” showing how threat actors are also increasingly adopting AI technologies.

Conclusion

Security teams can build more resilient programs that protect their organizations against the most prevalent attack vectors by focusing on these key areas.

CISO SPEAKS

Cutting through the hype and confronting

THE REAL RISKS

As emerging technologies like artificial intelligence and quantum computing gain traction, organizations must navigate a growing array of threats while maintaining focus on strategic priorities.

In this conversation, Jacob Mathew, a senior government cybersecurity leader shares his perspectives on what risks loom largest heading into 2030, how to evaluate vendors with unproven innovations, and how to remain grounded amid the constant buzz of technological breakthroughs. Drawing from years of leadership experience, his insights reflect a pragmatic approach to cybersecurity grounded in strategic alignment, operational resilience, and thoughtful adoption of emerging tools.

AI or Quantum: What's the bigger risk by 2030?

"If I had to choose between AI risk and quantum risk for 2030, I would bet on AI risk more than Quantum risk," he stated decisively. While quantum computing presents a very real threat to current encryption standards, he believes it's still a longerterm concern. “Post-Quantum Cryptography is still in early development and would take well over 2030 to be rolled out widely.”

AI, on the other hand, is already here and growing. “AI is being widely adopted across the world, and the associated risks are already operational.” As organizations rush to deploy AI across operations, cybersecurity professionals are already working to secure, regulate, and ethically manage these systems. “I expect early deployments of Artificial General Intelligence to commence on or around 2030 which will take AI risks to another level.”

Evaluating vendors with unproven innovations When it comes to cutting-edge vendors, Jacob highlights the importance of due process over gut feel. “Being in government, we have robust processes to onboard all vendors. This is a very robust process and once onboarded all suppliers including new tech vendors would be able to participate.” That structured approach ensures both compliance and fairness while allowing space for innovation to prove its worth.

Fighting tech FOMO while staying ahead With new technologies emerging constantly, it's easy to chase trends for fear of falling behind. But that’s a trap Jacob avoids deliberately. “We need to stay focused on improving the organisation’s security posture, rather than jumping from one hype to another.”

The goal? Avoiding noise, managing leadership expectations, and focusing on what truly matters.

To maintain that balance, they rely on a rich mix 50

CISO SPEAKS of community engagement and trusted information sources: • Networking with other leaders, both locally and internationally.

• Subscribing to reputable threat intelligence platforms.

• Following credible bodies like NIST, SANS, the UAE Cybersecurity Council.

• Reviewing Gartner’s Hype Cycle regularly.

• Participating in local forums.

• Listening to podcasts from reputable sources.

When early adoption paid off Asked to reflect on a success story with new tech, he recalled a time when he introduced machine learning to their cybersecurity stack.

“I introduced some machine learningenabled cybersecurity tools, hoping they'd offer a bit of an edge over the old signaturebased systems.”

The results were beyond expectations. “Not only did threat detection get faster, but false positives dropped significantly. That meant my team had more time to focus on real issues, and our overall risk management became much sharper than expected.”

What future tech do we need now?

Their biggest wish for the future is surprisingly clear: unified identity.

If you weren't in cybersecurity, what would your dream job be?

My dream job could have been as a social worker with a cause, or as a medical doctor.

What's one piece of tech gear or gadget you can't live without?

It is my smartphone, my mobile command center for everything I do, both at work and in life.

What's your favorite way to unwind after a long day of tackling security challenges?

I devote some of my free time to my spiritual growth, physical activity (long walks), family, and friends. This is a challenge during workdays, but I can devote more time during weekends.

If you could only use one app for the rest of your life, which one would you choose and why?

For me, this would be WhatsApp, which allows me to connect with family, friends, and colleagues across the world. I am also in several groups that keeps me updated on the latest developments in my professional and private life.

“My wish is that vendors build better crossdomain identity systems ones that truly unify our fragmented identity ecosystems.”

What's a fun or quirky hobby you enjoy when you're not busy with work?

In every organization he has worked in, identity sprawl has posed persistent challenges across legacy systems, cloud, SaaS, IoT, and OT.

Writing, public speaking, and creating short videos for my YouTube channel are some of the things I enjoy doing.

“Most IAM solutions try to help, but they often fall short requiring complex integrations, leaving visibility gaps, and failing to deliver true, end-to-end identity lifecycle management.” Getting that right, he says, could be a game changer: “If vendors can get this right, it could completely change how we approach threat detection and prevention by targeting the one vector attackers exploit most often.”

Strategic planning in a dynamic threat Landscape

But there's a key nuance: “In my opinion, for business strategy to be effective it must encompass technology and cybersecurity from beginning to the execution.”

While threats evolve rapidly, the roadmap is a guiding compass not a rigid script.

“We can manage the threats through continuous monitoring, threat intelligence gathering, adaptation, and adopting proactive security measures. ” A well-aligned, multi-year roadmap helps organizations remain agile, justify investments, and build resilience despite the chaos.

“Multi-year roadmaps should be derived from the strategy document,” he explained.

www.techxmedia.com

49

OPINION

WHAT HAPPENS WHEN AI TURNS AGAINST US?

VASILY DYAGILEV

Regional Director Middle East & RCIS CHECK POINT SOFTWARE TECHNOLOGIES

50

OPINION As artificial intelligence becomes more deeply embedded in business operations, it's also reshaping how cyber threats evolve. The same technologies helping organizations improve efficiency and automate decision making are now being co-opted and weaponized by threat actors.

The inaugural edition of the Check Point Research AI Security Report explores how cyber criminals are not only exploiting mainstream AI platforms, but also building and distributing tools specifically designed for malicious use. The findings highlight five growing threat categories that defenders must now account for when securing systems and users in an AI driven world.

AI Use and the Risk of Data Leakage An analysis of data collected from Check Point’s GenAI Protect reveals that 1 in every 80 GenAI prompts poses a high risk of sensitive data leakage.

Data also shows that %7.5 of prompts about 1 in 13 contain potentially sensitive information, introducing critical security, compliance, and data integrity challenges. As organizations increasingly integrate AI into their operations, understanding these risks is more important than ever.

AI-Enhanced Impersonation and Social Engineering Social engineering remains one of the most effective attack vectors, and as AI evolves, so too do the techniques used by threat actors. Autonomous and interactive deepfakes are changing the game of social engineering, drastically improving the realism and scale of attacks. Text and audio have already evolved to generate non scripted, real time text, while video is only advancements away.

While data poisoning typically affects the training phase of AI models, new vulnerabilities have arisen as modern LLMs access realtime online information, leading to a risk known as "retrieval poisoning."

A notable case involves the Russian disinformation network "Pravda," which created around 3.6 million articles in 2024 aimed at influencing AI chatbot responses. Research indicated that these chatbots echoed Pravda's false narratives about %33 of the time, underscoring the significant danger of using AI for disinformation purposes.

AI-Created Malware Creation and Data Mining AI is now being used across the entire cyber attack lifecycle from code generation to campaign optimization. Tools like FunkSec’s AI generated DDoS module and custom Chat GPT style chatbot demonstrate how ransomware groups are integrating AI into operations, not just for malware creation, but for automating public relations and campaign messaging.

AI is also playing a critical role in analyzing stolen data. Infostealers and data miners use AI to rapidly process and clean massive logs of credentials, session tokens, and API keys. This allows for faster monetization of stolen data and more precise targeting in future attacks.

In one case, a dark web service called Gabbers Shop advertised the use of AI to improve the quality of stolen credentials, ensuring they were valid, organized, and ready for resale.

The Weaponization and Hijacking of AI Models

A recent FBI alert underscored the growing use of AI generated content in fraud and deception, while real-world incidents, such as the impersonation of Italy’s defense minister using AI generated audio, have already caused significant financial harm.

As these capabilities scale, identity verification based on visual or auditory cues is becoming less reliable, prompting an urgent need for multi layered identity authentication.

Threat actors are no longer just using AI they are turning it into a dedicated tool for cyber crime. One key trend is the hijacking and commercialization of LLM accounts.

LLM Data Poisoning and Manipulation

Even more concerning is the rise of Dark LLMs maliciously modified AI models such as HackerGPT Lite, WormGPT, GhostGPT, and FraudGPT. These models are created by jailbreaking ethical AI systems or modifying open-source models like DeepSeek.

They are specifically designed to bypass safety controls and are marketed on dark web forums as hacking tools, often with subscription-based access and user support.

Concerns have been raised by researchers regarding LLM (large language model) poisoning, which is a cyber security threat where training datasets are altered to include malicious content, causing AI models to replicate the harmful content. Despite the strong data validation measures in place by major AI providers like OpenAI and Google, there have been instances of successful poisoning attacks, including the upload of 100 compromised AI models to the Hugging Face platform.

www.techxmedia.com

Through credential stuffing and infostealer malware, attackers are collecting and reselling access to platforms like ChatGPT and OpenAI’s API, using them to generate phishing lures, malicious scripts, and social engineering content without restriction.

51

OPINION

WHAT IF THE FIREWALL ISN’T ENOUGH? OPSWAT THINKS IT’S TIME FOR A RETHINK

SERTAN

SELCUK

VP FOR METAP & CIS OPSWAT 52 54

OPINION How does your presence at GISEC reflect OPSWAT’s strategic priorities in the Middle East region?

OPSWAT is committed to uplifting the regional security industry by advancing cyber resilience across critical infrastructure. We’re expanding our local partnerships, enhancing our channel ecosystem, and driving innovation through continuous product development. With a strong focus on IT/OT convergence, compliance, and threat prevention, we aim to empower Middle Eastern enterprises and governments to stay ahead of evolving threats. Our GISEC participation allows us to demonstrate this steadfast commitment to delivering IT/OT cybersecurity solutions and fostering the cyber talent that the region needs to defend its critical infrastructure and sustain economic progress.

Are there any new product launches, partnerships, or initiatives you’re unveiling at the event?

OPSWAT is participating in GISEC as a Diamond sponsor this year and we are proud to showcase our latest cybersecurity advancements in critical infrastructure protection (CIP). We shall have live demos and sessions, through OPX labs, offering practical insights on safeguarding vital systems and networks. Alongside the Lab, will be OPSWAT’s Nuclear Plant Model Reactor, a display that underscores the company’s expertise in securing sensitive environments like nuclear power plants.

Alongside the product showcase and demos, a couple of senior executives from OPSWAT will be holding sessions. During day two, on the Government Stage, hosted by Dubai Electronic Security Center, OPSWAT Founder and CEO, Benny Czarny, will present “Breaking the Firewall: Revolutionizing Cyber Defense for a Connected World”. He will make the case for a fundamental rethinking of the traditional firewall, highlighting how the rise of AI driven exploits, encrypted attacks, and increasingly complex network environments demands a new approach to cybersecurity. Also on day two, on the Critical Infrastructure Stage, OPSWAT’s Director of Products and Solutions, Kris Voorspoels, will take part in a panel discussion on the security crisis facing the Industrial Internet of Things (IIoT) in the regional oil and gas sector. Finally, aiming to enhance cybersecurity standards across the region in alignment with the goals of the UAE National Cybersecurity Strategy, OPSWAT Academy will offer complimentary CIP certifications, such as File Security Associate (OFSA), Secure Storage Associate (OSSA), Email Security Associate (OESA), Web Traffic Protection Associate (OWPA), and Data Transfer Security Associate (ODSA).

What are the unique challenges in securing operational technology (OT) environments, and how does OPSWAT address them?

Securing Operational Technology (OT) environments poses unique challenges, distinct from traditional IT systems, due to differences in architecture, priorities, and the critical nature of the infrastructure involved.

OT systems often operate on legacy equipment

www.techxmedia.com

that was never designed with cybersecurity in mind, making them difficult to patch or integrate with modern tools. These environments prioritize uptime and physical safety over data confidentiality, so even minor downtime for security updates can be unacceptable.

Many OT networks are air gapped or highly segmented, creating visibility gaps and complicating threat detection and response. Data transfers typically occur via removable media like USB drives, introducing a significant attack surface. OPSWAT addresses these risks through a suite of purpose built solutions for OT environments. Tools like MetaDefender Kiosk and MFT enable secure file transfers into air gapped networks by using multiscanning (with +30 antivirus engines) and Deep Content Disarm and Reconstruction (CDR) to sanitize files without disrupting operations OPSWAT's USB Firewall prevent infected devices from compromising critical systems. In environments requiring strict one way data flow, OPSWAT also offers data diodes hardware enforced unidirectional gateways that ensure information can only move in one direction, preventing external access to sensitive internal systems. This adds a physical layer of protection against network-based threats. OPSWAT solutions operate offline, making them ideal for air gapped settings, and also include vulnerability assessment tools to help comply with regulatory standards such as NERC CIP and ISA/IEC 62443.

Our solutions also support proprietary OT protocols and provide APIs for integration with SCADA or SIEM platforms.

By enabling secure, policy driven file transfers, ensuring compliance, and protecting against malware even from removable media. OPSWAT helps organizations reduce cyber risk without disrupting operational continuity. This comprehensive approach aligns well with the specific needs of critical infrastructure and industrial control systems, where resilience, uptime, and safety are paramount.

How is OPSWAT working with governments and enterprises across the GCC to elevate cyber resilience?

Our approach to cybersecurity has evolved significantly over the last 12 months. Our solutions are designed to secure both IT and OT environments using patented technologies such as multi scanning, Deep CDR, and advanced threat intelligence.

We've focused on enhancing our ability to detect and mitigate advanced threats, particularly those targeting complex and interconnected systems.

We've integrated AI-powered threat detection, real-time monitoring, and data sanitization into our solutions to ensure that organizations can respond to threats quickly and effectively. As the cybersecurity landscape continues to shift, we've also prioritized automation and machine learning to proactively identify vulnerabilities and block attacks before they impact operations.

53

OPINION

Securing the Middle East’s Digital Backbone with AI Driven Cyber Physical Resilience As the Middle East accelerates its digital transformation, protecting cyber-physical systems has become a national and economic priority. The region’s ambitious investments in smart cities, energy modernization, transportation networks, and connected industries have dramatically expanded the attack surface.

Every new IoT sensor, industrial control system, or cloud-connected asset creates a potential entry point for adversaries, whether they are financially motivated criminals, malicious insiders, hacktivists, or nation-state actors.

In this environment, ensuring the resilience of both digital and physical operations is essential to safeguarding economic growth, public safety, and national stability. Organizations must move beyond traditional perimeter-based defenses and adopt proactive strategies that integrate cybersecurity into the fabric of their operations.

True resilience starts with visibility: understanding what is connected, how assets interact, where the vulnerabilities are, and who has access. Yet for many organizations, particularly those with legacy systems and hybrid IT-OT environments, achieving this level of insight is still a challenge.

As operational technology and IoT ecosystems continue to converge with IT networks, the need for real-time monitoring and early threat detection becomes even more urgent.

Artificial intelligence (AI) is playing a transformative role in addressing these challenges. From the inception of modern industrial cybersecurity strategies, AI has enabled faster, more accurate detection of anomalies and threats across complex, distributed environments.

Today, AI-driven threat detection is helping organizations across sectors, including energy, utilities, manufacturing, financial services, healthcare, and retail identify risks earlier, respond faster, and adapt their defenses as threat actors evolve their tactics.

However, technology alone is not enough.

Building cyber-physical resilience also demands significant investment in regional capabilities.

This includes strengthening cybersecurity talent pools, deepening collaboration between the public and private sectors, aligning with

56 54

LUIS FERREIRA Regional Sales Director MEA Nozomi Networks

OPINION

emerging regulatory frameworks, and fostering an environment of shared intelligence and trust.

Across the Middle East, national cybersecurity authorities are taking a leadership role driving standards, setting expectations for critical infrastructure protection, and encouraging continuous improvement in cyber defense capabilities.

focused on disrupting critical services and supply chains. Cyberphysical attacks, ransomware campaigns targeting industrial assets, and exploitation of vulnerable IoT devices are no longer theoretical risks—they are present-day realities. Only with proactive resilience strategies can organizations stay ahead of these evolving threats.

Organizations looking to protect their operations in 2025 and beyond must embed cybersecurity at the core of every digital initiative. This means building security directly into smart grids, autonomous systems, connected healthcare platforms, and financial services innovations not bolting it on afterward. It also means investing in continuous monitoring, realtime detection, and intelligent response strategies that span IT, OT, and IoT environments.

As the region comes together at GISEC to share knowledge, innovations, and best practices, one thing is clear: securing the future of the Middle East’s digital economy will require foresight, collaboration, and a commitment to continuous evolution. Cyber-physical resilience is not optional, it is the foundation for sustainable growth and national security in an increasingly connected world.

The threats targeting the Middle East are sophisticated, persistent, and increasingly

www.techxmedia.com

Monitoring, real-time detection, and intelligent response strategies that span IT, OT, and IoT environments.

The threats targeting the Middle East are sophisticated, persistent,

and increasingly focused on disrupting critical services and supply chains.

Cyber-physical attacks, ransomware campaigns targeting industrial assets, and exploitation of vulnerable IoT devices are no longer theoretical risks—they are present-day realities.

Only with proactive resilience strategies can organizations stay ahead of these evolving threats.

As the region comes together at GISEC to share knowledge, innovations, and best practices, one thing is clear: securing the future of the Middle East’s digital economy will require foresight, collaboration, and a commitment to continuous evolution.

Cyber-physical resilience is not optional—it is the foundation for sustainable growth and national security in an increasingly connected world.

55 57

OPINION

The Four Ts Approach: A Framework For Cyber Risk Management A ship captain will identify potential risks to their boat, cargo and crew, and put in place strategies to mitigate these risk factors. Risks vary from vessel to vessel; the captain of an enormous container ship doesn’t have to worry about a squall in the same way the captain of a small sailboat would because their ship is far less likely to capsize. Risk tolerance also plays a role. While one captain and crew may be comfortable riding out a severe storm, others would want to implement a change of course.

IT and security teams may not have to worry about sea conditions, but similar to ship captains, they must assess and respond to risk in a way that is appropriate for their organization. Just as it doesn’t make sense for a captain to halt their voyage for a minor issue, IT teams can’t afford to slow down business operations for low risk threats.

Many organizations struggle to manage cyber risk effectively, often focusing on point threats and challenges rather than taking a strategic, holistic approach.

Fortunately, the four Ts framework can help.

Managing Cyber Risk in an Overwhelming Landscape In today’s connected business environment, cyber risk is unavoidable. Software supply chain attacks impacted %61 of U.S. businesses last year. My company, Sophos, found in its "The State of Ransomware 2024" report, that ransomware also continues to pose a serious risk to organizations, with %30 of ransom demands reaching 5$ million or more.

Adding to the chaos, the nationwide shortage of IT and security professionals leaves many organizations struggling to keep pace with adversaries’ evolving tactics. But the reality is that even for fully staffed teams, eliminating cyber risk entirely requires protections so extensive and

56

RAJA PATEL Chief Product Officer, Products Sophos

5

59

OPINION

cumbersome that it could bring business operations to a standstill. Effective cyber risk management in the current landscape requires a strategic and targeted approach. The four Ts is a simple, effective framework that any organization can use to achieve that goal. The premise is that there are four ways to respond to risk: • Tolerate risks that pose an insignificant threat to your business.

• Terminate risks that can be eliminated entirely.

• Treat risks that can be reduced to an acceptable level.

• Transfer risks to a third party.

Each organization will have its own appetite for risk.

For example, a small beauty salon startup with limited resources might accept a higher level of cyber risk, while a large financial institution tolerates very little risk because its operations hinge on client trust and the ability to protect sensitive financial information.

By identifying and analyzing the potential impact and likelihood of cyber risks, you can create a tailored strategy that aligns with the nature of your risk tolerance and resource availability.

Applying The Four Ts To Cyber Risk Management The first step to applying the four Ts framework is to understand the potential cyber risks to your business.

Think about the threats you face, how vulnerable you are to them and the potential business impact should an attack succeed. Areas to consider when assessing your risks will range from external threats such as supply chain attacks to internal weaknesses that increase exposure (e.g., a shortage of in-house expertise or high levels of unpatched software).

With that in place, the next step is to consider how to manage each risk, leveraging the four Ts framework.

Consider the following scenarios that demonstrate how you might use the four Ts framework in practice:

Tolerate As a healthcare provider, you may have an important piece of medical equipment that’s running on an unsupported version of software. You’re not able to update the software because it hasn’t been approved by the overseeing regulatory body. But the device isn’t connected to the internet, and ceasing to use it until you can update it would compromise patient treatment.

You decide to tolerate the risk of the legacy software being compromised because the likelihood is minimal and outweighed by the considerable patient benefit of continued use.

Terminate A system allowing contractors to access an internal system has known internet-facing vulnerabilities that could be exploited to give threat actors access to your internal network. The IT department identifies that this system is used infrequently, and alternative methods of

www.techxmedia.com

access are available. The team decides the risk outweighs the benefits and so terminates the risk by shutting the whole system down.

Treat Considering unpatched vulnerabilities are the most common root cause of ransomware attacks (according to our report), you decide to prioritize reducing exposure to mitigate this major risk.

Treatments can take the form of regular attack surface exposure scanning and maintaining a rigorous risk-based patching program. There’s no need to tolerate this risk given that effective attack surface management solutions and services are readily available.

Transfer While cyber risk can be greatly reduced through effective management, it can never be wholly eliminated. And with average ransom payments reaching 2$ million this year, the consequences of a successful attack are not tolerable.

As a result, you decide to transfer your residual risk by purchasing a comprehensive cyber insurance policy that covers data breaches, enabling you to mitigate the financial impact in the event of an attack. You also select an MDR provider that includes a breach warranty in the event of an incident.

Ensure Ongoing Cyber Resilience With Continuous Risk Assessments Using the four Ts framework streamlines the planning and implementation of a comprehensive cyber risk strategy. It also makes cyber risk easy to communicate across the organization. But applying this framework isn’t a one-time effort.

As technology advances and adversaries also advance their tactics and discover new avenues to execute their attacks, the threat landscape will also change. At the same time, your organization’s risk tolerance may evolve as well based on factors like the volume of sensitive data you handle and the criticality of customer trust to your business model.

Establish a regular cadence to review your cyber risk tolerance and strategy. Just as a ship’s captain must constantly adjust to changing sea conditions and disruptions, you must stay agile and responsive to the evolving cybersecurity landscape.

59 57

PRODUCTS SHOWCASE PRPDUCT SHOWCASE

Acer

TravelMate

Security Features: Enterprise Grade Protection for Business Leaders

For CIOs, CTOs, and IT decision-makers, device security is a top priority.

Acer’s TravelMate series is engineered to meet the rigorous demands of modern enterprises, providing advanced security features that protect sensitive data, ensure regulatory compliance, and support secure remote work.

Here’s how TravelMate devices deliver enterprise-grade protection: Trusted Platform Module (TPM) 2.0 TPM 2.0 provides hardware-based cryptographic processing and secure key storage, enabling secure boot, BitLocker drive encryption, and strong device authentication. This is essential for compliance with industry standards and safeguarding corporate assets.

Biometric Authentication: Fingerprint Reader & IR Camera Integrated fingerprint readers and IR cameras support Windows Hello, offering secure, password-free authentication. Biometric logins reduce the risk of credential theft and streamline user access, supporting zerotrust security models.

Acer ProShield Plus Acer’s unified security suite offers centralized credential management, file and folder encryption, and secure file deletion. ProShield Plus simplifies endpoint security administration and helps enforce companywide data protection policies.

BIOS & Firmware Security TravelMate devices feature BIOS-level password protection, secure boot, and firmware safeguards to prevent unauthorized system changes and defend against firmware-level attacks. Multiple password layers (user, supervisor, HDD) add further protection.

Physical Security: Kensington Lock Slot & Webcam Shutter A Kensington lock slot enables physical device security in shared or public environments. The integrated webcam privacy shutter protects against unauthorized camera access, addressing privacy concerns for executives and remote workers.

Comprehensive Drive Encryption Native support for BitLocker and third-party encryption solutions ensures all data at rest is protected, even if a device is lost or stolen. This is critical for regulatory compliance (GDPR, HIPAA, etc.) and risk mitigation.

58

PRODUCT SHOWCASE

Secure Erase Functionality TravelMate devices offer secure erase options, allowing IT teams to permanently remove sensitive data before device reassignment or disposal, reducing the risk of data leaks.

Endpoint Security Compatibility Full compatibility with enterprise endpoint security platforms enables seamless deployment of antivirus, anti-malware, and remote management tools, supporting centralized IT control and rapid incident response.

Windows Security Integration TravelMate devices are optimized for Windows security features, including Secure Boot, Windows Defender, and device encryption, ensuring a secure foundation for enterprise environments.

Why It Matters for Business Leaders These layered security features help organizations protect intellectual property, maintain regulatory compliance, and support secure hybrid work. With Acer TravelMate, CIOs and CTOs can confidently deploy devices that meet the highest standards of enterprise security— reducing risk, simplifying management, and empowering productivity.

The security features above can all be found on the Acer TravelMate P6 14 AI; a premium business laptop designed for professionals who demand top-tier performance, security, and mobility. Powered by the latest Intel Core Ultra processors with integrated AI acceleration, it delivers exceptional speed and efficiency for multitasking and productivity. The P6 14 AI features a lightweight yet durable magnesium-alloy chassis, a high-resolution 14-inch display, and advanced security. With long battery life, enterprise-grade manageability, and robust connectivity, the TravelMate P6 14 AI is built to meet the needs of modern business leaders and mobile professionals. www.techxmedia.com

59

Trending

C

M

Y

CM

MY

CY

CMY

K

catch all the ACTION, INSIGHTS, and UPDATES across our socials.

58

HOSTED BY

OFFICIAL GOVERNMENT CYBERSECURITY PARTNER

OFFICIALLY SUPPORTED BY

MIDDLE EAST AND AFRICA’S LARGEST CYBERSECURITY EVENT