IDC finds AI security governance gaps in UAE

By Editorial October 19, 2026

CPX, Microsoft and IDC report on AI security risks and governance across UAE enterprises

A new IDC study has found significant gaps in AI security governance across UAE enterprises. While 80% of CIOs expect results from AI investments within two years, 98% of security teams have already encountered AI-related risks.

The Securing AI in the UAE Enterprise study, released by Microsoft, CPX and IDC, surveyed 175 senior technology and security executives. It examines whether cybersecurity practices and governance structures are keeping pace with AI adoption.

The findings show that 92% of security leaders report AI systems processing sensitive data. Meanwhile, 54% have encountered AI decisions they could not explain or audit for compliance purposes.

Infographic showing AI investment confidence and security risks across UAE enterprises

An infographic from the study highlights the gap between AI investment confidence, business-case validation and real-world AI security risk in UAE enterprises.

Shadow AI exposes enterprise security gaps

Unapproved AI tools are creating additional security risks across UAE organizations. According to the study, 43% of CIOs report regular employee use of unauthorized AI tools. More than half of security teams have identified data leakage through these applications.

Agentic AI presents another governance challenge. More than half of surveyed organizations have deployed AI agents or are actively developing them. However, only one in 10 consider themselves fully prepared for safe deployment.

The research also identifies gaps in security oversight. Only 15% of CISOs have mandatory approval authority over AI deployments. Just 10% of organizations establish security requirements before evaluating AI solutions. Furthermore, only 30% use structured methods to assess their AI security posture. Another 40% mainly rely on reactive assessments, vendor reviews or third-party audits.

Security governance must keep pace with AI adoption

The report recommends involving security teams earlier in AI decision-making. It also calls for clear approval processes, regular assessments and defined permission boundaries for AI agents.

The research makes clear that readiness cannot be measured by adoption alone. UAE organizations are moving quickly to capture the opportunities presented by AI, but the pace of technological change must be matched by clear accountability, stronger governance and security models designed for increasingly autonomous systems. The organizations that succeed will be those that embed security and governance into their AI programs from the outset.

– Hadi Anwar, CEO of CPX

The study also highlights the growing role of AI in cyber defense. Two-thirds of UAE security teams already use AI for cybersecurity. The remaining teams plan to adopt it within the next 12 months.

Organizations therefore face two priorities: securing their own AI deployments and using AI to improve threat detection, investigation and response. The report concludes that governance, visibility and security must become integral parts of enterprise AI adoption.