E-Paper
Sign In
GISEC Global 2026: Security no longer stops at cyber
As AI, IoT, cloud and smart infrastructure converge, Middle East enterprises are redefining security from a technology function into a business resilience imperative that spans IT, OT, physical assets and critical operations
- PUBLISHED: Sat 3 Oct 2026, 8:00 AM
For years, cybersecurity was primarily about protecting data, networks and digital systems. Today, that definition is rapidly expanding. As organisations across the Middle East accelerate investments in AI, cloud computing, smart cities, industrial automation and connected infrastructure, security is evolving into a broader discipline focused on safeguarding business operations, physical assets and critical infrastructure.
Industry leaders agree that the challenge facing enterprises in 2026 is no longer confined to cyber threats alone. The convergence of information technology (IT), operational technology (OT), physical security systems and IoT devices means that a single vulnerability can trigger consequences far beyond the digital realm, affecting production, safety, revenue and customer trust.
Recommended For You
Meriam ElOuazzani, Vice-President for Middle East, Turkey and Africa at Censys, said organisations can no longer afford to treat cyber, physical and operational risks as separate workstreams.
"A single untracked surveillance camera, badge controller, engineering workstation or edge gateway can disrupt an entire site and turn a digital transformation investment into a remediation exercise," she said.
According to ElOuazzani, regional initiatives such as Saudi Vision 2030 and the UAE's digital transformation agenda are accelerating the integration of access control systems, surveillance networks and industrial infrastructure into enterprise environments traditionally reserved for financial and customer data. Against this backdrop, the Middle East cybersecurity market is projected to reach between $20 billion and $40 billion by 2030.
"The real test for CISOs in 2026 will be whether they can make unified risk decisions across IT, OT, physical assets and third-party environments," she added.
The Rise of Cyber-Physical Risk
Gavin Millard, Vice-President, Intelligence at Tenable, believes the definition of security itself has not changed, but the environments organisations must secure certainly have.
"In a smart city, port or utility operation, the distance between a digital system and a physical outcome is now extremely short," he said. "An exposed internet-facing service and an over-privileged identity used to create a data risk. Today, that same combination could impact a pump, barrier or access-control system."
While many large organisations have mature cybersecurity programmes, Millard argues that few can produce a complete inventory of all connected assets.
"That is the real challenge," he noted. "OT belongs to engineering, physical security sits with facilities, cloud assets belong to different teams, and no one has full visibility of the entire environment."
His prescription is straightforward: organisations must stop structuring security around departmental ownership and instead focus on attack paths that cut across technologies and business functions.
"If it is connected, it is in scope, regardless of who owns it."
Security as a Business Continuity Function
Ned Baltagi, Managing Director for Middle East, Africa and Turkey at SANS Institute, believes many organisations continue to underestimate the strategic importance of operational technology.
"IT supports how a business operates, but OT is why many businesses exist in the first place," he explained. "Whether it is a production line, energy grid, manufacturing plant or industrial control system, OT downtime directly impacts revenue."
Baltagi noted that independent financial models estimate global losses from OT cybersecurity incidents in the hundreds of billions of dollars during severe disruption years. Importantly, much of that impact stems from indirect consequences such as halted operations, supply-chain interruptions and precautionary shutdowns rather than the breach itself.
"At that point, the issue is no longer purely cybersecurity," he said. "It becomes a business continuity and operational resilience challenge."
The emergence of AI is further accelerating this transformation. As AI increasingly powers predictive maintenance, production optimisation and industrial operations, security leaders must view it through the lens of operational reliability and safety, not just information protection.
Breaking Down Security Silos
Sujoy Banerjee, Regional Business Director at ManageEngine, echoes the need for a unified security strategy.
"As organisations expand digitally, security can no longer focus solely on networks and systems," he said. "Companies must protect identities, endpoints, applications, infrastructure, connected assets and critical operational processes."
The growing interconnectedness of enterprise technology means disruptions in one area can quickly cascade into others, affecting customers, employees and essential services.
To mitigate this risk, organisations require end-to-end visibility across their environments, including assets, access privileges and interconnected systems.
"By linking insights across identities, endpoints, applications and infrastructure, enterprises can detect risks earlier, respond faster and build greater resilience," Banerjee said.
Bachir Moussa, Regional Vice-President, EMEA South at Nozomi Networks, agrees that security must extend beyond users and enterprise applications.
"Organisations now need visibility into industrial control systems, OT environments and the rapidly growing ecosystem of connected IoT devices," he said. "This is where cyber incidents can directly translate into real-world operational consequences."
Visibility — the Biggest Gap
Despite growing awareness, experts consistently identified one critical weakness across Middle East organisations: visibility.
Millard pointed to overlooked assets such as building-management systems, access-control solutions, industrial devices and legacy infrastructure installed years ago and never properly inventoried.
"Facilities teams purchase them, IT tolerates them and security rarely sees them," he said.
Baltagi highlighted a related problem: many organisations still lack a clear understanding of how attackers could move through interconnected environments. "Most security programmes focus on detecting anomalies rather than preparing for realistic attack scenarios," he explained. "The most successful organisations build security around known threat pathways and operational risks."
ElOuazzani believes the underlying issue is ownership rather than technology.
"Network teams see traffic. Engineers understand equipment. Plant managers focus on operations. But very few organisations speak a common asset language," she said.
Without shared visibility across departments, she warned, converged security risks becoming little more than a buzzword.
A New Security Imperative
The consensus among industry leaders is clear: the future of security lies in convergence.
As cloud platforms, AI systems, OT environments and physical infrastructure become increasingly interconnected, organisations can no longer view cybersecurity as an isolated function. The focus is shifting from protecting systems to preserving operational continuity, safety, resilience and trust.
For Middle East enterprises pursuing ambitious digital transformation agendas, success in 2026 will depend not on how many security tools they deploy, but on how effectively they unify visibility, intelligence and decision-making across every connected asset and operational environment. In a world where a digital vulnerability can halt a factory, disrupt a utility network or compromise critical infrastructure, security has become a boardroom issue, a business issue and ultimately a resilience issue.
Top Security Priority
As Middle East organisations accelerate digital transformation, security leaders are recalibrating their priorities. Industry experts at GISEC Global 2026 agree that cybersecurity can no longer be viewed as a standalone IT function.
Instead, the focus is shifting toward operational resilience, risk-based prioritisation, visibility across converged environments, and preparedness for increasingly sophisticated AI-enabled threats.
Millard believes the most important security decision organisations will face over the next 12 to 18 months is determining what not to fix. While that may sound counterintuitive, he argues it reflects a growing reality. Advances in frontier AI are enabling the discovery of critical software vulnerabilities and the creation of working exploits within hours, while enterprise patch cycles often take between 30 and 90 days. In that environment, simply working harder is no longer enough.
Millard describes this challenge as "active inertia": security teams remain busy processing lengthy queues of alerts and vulnerabilities, but often focus on issues with limited business impact while higher-risk exposures remain unresolved.
"The problem isn't effort," he said. "It's direction."
His advice to security leaders is straightforward: identify the ten assets that would have the greatest impact on business continuity or safety if compromised, map every pathway that could reach them, and focus remediation efforts there first.
"Everything else is maintenance," he said. "Fireproofing beats firefighting."
Visibility as the Foundation of Security
For Sujoy Banerjee, the top priority for regional organisations is achieving complete and continuously updated visibility of their security posture.
As enterprises expand their use of cloud services, AI, digital platforms, and connected infrastructure, understanding what assets exist and how they interact has become increasingly critical.
"Organisations need visibility across identities, devices, applications, networks, and infrastructure, as well as an understanding of how these elements connect," he said.
Without that visibility, security teams struggle to identify vulnerabilities, detect malicious activity, and determine where the most significant business risks reside.
Banerjee's advice is to avoid waiting for a security incident to expose weaknesses.
"Know what assets you have, understand who has access to them, identify your most critical risks, and continuously evaluate whether your security controls remain effective," he said. "Strong security begins with visibility but must be supported by continuous monitoring and improvement."
Shift From Controls to Exposure Management
ElOuazzani believes operational visibility will define security success over the coming year. According to her, organisations need real-time awareness of externally exposed assets and continuous insight into how their attack surface is changing.
"The key question is whether that exposure can evolve into a breach capable of disrupting operations," she said.
ElOuazzani argues that many organisations still view cybersecurity as a protective layer around digital transformation initiatives. However, as governments, financial institutions, healthcare providers, and energy companies continue expanding their digital footprints, external attack surfaces are growing faster than traditional security processes can adapt.
Her recommendation is to treat the next 12 months as a visibility exercise rather than a tooling exercise. "Boards should see how risk exposure is changing in real time," she said. "Security budgets should follow exposure, not assumptions."
She believes organisations that move beyond reporting security controls and instead report measurable exposure and risk will be best positioned to strengthen resilience ahead of GISEC Global 2026.
Prepare for the Incident Before It Happens
Ned Baltagi of SANS Institute identifies incident response planning as the most important investment organisations can make. Drawing on insurance industry research and real-world claims data, he notes that mature incident response capabilities demonstrate one of the strongest correlations with reduced financial loss following cyber incidents.
More importantly, organisations with tested industrial control system (ICS)-specific response plans are often able to detect and contain incidents significantly faster than those relying on untested procedures. "The difference isn't luck," Baltagi said. "It's practice."
His advice is simple: develop or update incident response plans using realistic attack scenarios that have affected similar organisations and then validate those plans through regular tabletop exercises.
"For many security leaders, understanding what truly needs protecting becomes much clearer once the response plan is tested against real-world scenarios," he said.
Resilience Must Extend Beyond Cybersecurity
Bachir Moussa of Nozomi Networks, believes resilience across cyber-physical systems should be at the top of every security agenda. The rapid adoption of operational technology, industrial automation and connected infrastructure is expanding the attack surface across critical sectors. Meanwhile, adversaries are increasingly using AI and automation to accelerate attacks and discover new points of compromise.
According to Nozomi Networks research conducted with BlastWave and Takepoint, nearly 88%t of organisations are already using or piloting AI for OT cybersecurity, yet fewer than 8% have implemented it comprehensively.
"This gap cannot be addressed through point-in-time assessments," Moussa said. "Organisations need continuous visibility into operational risk and business impact."
His message to security leaders is to broaden their perspective beyond traditional cybersecurity metrics.
"The objective is no longer simply preventing attacks," he said. "The real measure of success is whether business operations remain safe, reliable, and resilient when disruption occurs."
Managing Security in the Age of AI
For Harish Chib, Vice President Emerging Markets, Middle East Africa, Sophos, resilience within an AI-enabled threat landscape will increasingly dominate boardroom discussions.
Threat actors are already leveraging automation to improve phishing campaigns, accelerate reconnaissance, and exploit compromised identities across cloud, email, network, endpoint and identity environments simultaneously. At the same time, organisations are adopting generative AI and autonomous AI agents faster than governance frameworks can evolve.
That, he argues, creates three immediate priorities: strengthening identity security, consolidating fragmented security tools into integrated platforms, and establishing clear visibility and governance around AI usage.
"AI should not be viewed solely as a threat or solely as a solution," he said.
Instead, organisations should use automation and AI-driven capabilities to improve detection, investigation and response while retaining human oversight for critical decisions.
"That's how organisations reduce complexity, improve efficiency, and scale security operations without overwhelming already stretched teams," he said.
Despite differing perspectives, a common theme emerges across the industry: organisations must move beyond reactive cybersecurity and embrace a broader resilience-led approach. Whether through improved visibility, exposure management, incident preparedness, cyber-physical protection or AI governance, success will depend on understanding what truly matters to the business and aligning security investments accordingly.
The message from industry leaders is clear: in an era of converged environments and AI-driven threats, resilience, not technology alone, will define the next generation of security leadership.
