800,000 attacks a day: Is your AI protecting you or making you more vulnerable?

Dubai: October is remembered as cybersecurity awareness month and now more than ever, it has become imperative for people to know more. Especially in the UAE where we’ve seen more than 800,000 attempted cyberattacks a day, according to the UAE Cyber Security Council. Security executives are now flagging newer risks. They point to the excessive use of autonomous AI agents who are taking decisions, accessing data and acting across company systems, with very little human oversight.

Positive Technologies puts the UAE at 35 per cent of all attacks in the region. Dr Mohamed Al Kuwaiti, head of the Council said that “AI has accelerated the cyber attacks dramatically.” In fact, global losses from cyberattacks reached $10.5 trillion or Dh38.6 trillion in 2024. Now, forecasts say that number could reach $15.6 trillion or Dh57.3 trillion by 2029.

Salah Suleiman, Managing Director, South Gulf at TrendAI, notes that agentic AI changes how attackers work as well as how companies operate. “Every agent becomes a new identity, entry point, and target,” he says. Criminals, he adds, are using AI to launch “faster, more convincing, and scalable attacks.” TrendAI Vision One answers with four principles: visibility, intent, control and oversight. A dedicated AI security layer governs how models and agents behave. “Securing agentic AI from the outset is essential to building trust,” Suleiman says.

Alexandre Depret-Bixio, SVP, International at Anomali, frames the issue as a boardroom call. “What do we allow machines to decide?” he asks. Data quality sits at the centre. “If you can’t trust your data, you can’t trust the decisions AI agents make on your behalf.” The outcome is “confident but bad decisions,” a risk he calls untenable in cybersecurity.

Governance is where the gap shows the most. Daniel Churches, Director Cybersecurity, Asia Pacific and Japan at DXC Technology, cites DXC research finding that only 47 per cent of organisations have fully integrated governance for agentic AI. Many are deploying autonomous tools anyway. “Organisations are effectively scaling risk as fast as they’re scaling capability,” he observes.

Churches wants companies to move beyond reactive defence towards “intelligent, proactive and increasingly autonomous security.” Depret-Bixio says we need to be patient. “Autonomy earns trust one governed decision at a time, with human approval and audit where it matters.”

Justin Henkel, CISO at SolarWinds, calls machine identities an “enterprise control problem,” not an “identity access management (IAM) cleanup exercise.” Every automated actor needs “a defined purpose, bounded authority, trustworthy provenance, observable behaviour and a tested path to revocation.” He tells leaders to track progress through privilege reduction, owner coverage, credential lifetime, provenance of sensitive actions, stale identity removal and time to revoke. “This is a measurable operating discipline, not a one-time compliance project,” Henkel says.

The debate leaves one point settled. Attackers already use AI at scale, and the UAE absorbs the pressure daily. Companies that deploy agents faster than they govern them hand criminals a new way in. Awareness Month once asked users to update antivirus software. This year it asks boards to decide what machines may do alone, and to prove they can audit every choice. Depret-Bixio explains it quite aptly saying, “The near-term future of AI will be judged by whether we can stand behind every decision it makes.”