UAE enterprises are moving rapidly to adopt artificial intelligence, but security governance is struggling to keep pace, according to a new study by Microsoft, CPX and IDC.
The report, Securing AI in the UAE Enterprise, surveyed 175 senior security and technology executives and found that 98% of security teams had encountered at least one AI-related security risk in production environments. At the same time, 80% of chief information officers were confident their AI investments would deliver results within two years.
Released on October 16 in line with Cyber Security Awareness Month, the study examines whether enterprise security, governance and operating models are evolving quickly enough to address the risks accompanying wider AI deployment.
The findings highlight the growing exposure of corporate systems and data as AI becomes embedded in business workflows. Some 92% of security leaders said AI systems were processing sensitive data, while 54% had encountered cases in which an AI system’s decision could not be explained or audited for compliance purposes.
Unapproved AI tools raise data risks
The use of AI outside official organisational controls is emerging as a major challenge. According to the study, 43% of CIOs said employees regularly use AI tools that have not been approved or provided by their organisations.
More than half of security teams had identified data leakage through unsanctioned AI tools, highlighting the difficulty of monitoring how employees use external services and handle company information.
The findings also point to risks from the growing deployment of agentic AI systems, which can perform tasks with varying degrees of autonomy. More than half of the organisations surveyed had AI agents deployed or in active development, but only one in 10 considered themselves fully prepared to deploy them safely.
The report says organisations need clear permission boundaries, oversight and accountability as AI agents become more widely used.
Security teams lack decision-making authority
The study identifies weaknesses in how organisations approve and assess AI deployments. Only 15% of chief information security officers had mandatory approval authority over AI deployments, while just 10% of organisations defined security requirements before evaluating an AI solution.
Security teams were often brought into the process after strategic or deployment decisions had already been made, limiting their ability to address risks early.
The research also found that only 30% of organisations used a structured methodology to assess their AI security posture. Another 40% relied mainly on reactive assessments, vendor reviews or third-party audits.
Expertise remains a concern: 87% of security teams were not fully comfortable with AI security topics, while only 13% of organisations had fully defined approaches and operating models.
The report recommends that organisations establish formal security approval processes, audit existing AI systems and the data they handle, develop policies for unapproved AI use, and define controls for autonomous agents. It also suggests that organisations with limited expertise consider working with managed security providers to conduct initial inventories and assessments, while retaining responsibility for their own governance.
Executives call for stronger governance
Hadi Anwar, CEO of CPX, said AI readiness should not be measured by adoption alone, adding that technological change must be matched by accountability, governance and security models designed for increasingly autonomous systems.
Rima Semaan, Data and AI lead at Microsoft UAE, said organisations needed visibility into how AI was being used, clear accountability and controls over data and access. These measures were particularly important as AI agents became more common, she said.
Shilpi Handa, associate research director for Security and Trust at IDC, said AI adoption across UAE enterprises was accelerating, but security governance had not kept pace. She said the key challenge was governance rather than the technology itself.
AI also becomes a cybersecurity tool
Despite the risks, AI is increasingly being used to strengthen cyber defences. Two-thirds of UAE security teams already use AI for cybersecurity, while the remainder plan to adopt it within the next 12 months, the study found.
The findings point to a dual task for security leaders: protecting organisations against risks introduced by AI while using the technology to improve threat detection, investigation and response.
The report concludes that UAE enterprises will need to build security, visibility and governance into AI programmes from the outset as they move towards more autonomous systems.
