Artificial intelligence adoption is moving quickly through UAE enterprises, but security and governance capabilities are not advancing at the same pace. A study by CPX, Microsoft and IDC, based on responses from 175 senior security and technology executives, found that 52% of surveyed organisations have AI agents deployed or in active development. Only 10% said they were fully prepared to deploy agentic AI safely.
The findings point to an accountability gap rather than a lack of interest in AI. Ninety-eight percent of the surveyed security teams had encountered at least one AI-related security risk. Yet only 15% of organisations gave the chief information security officer mandatory approval authority over AI deployments, while just 10% established security requirements before evaluating an AI solution.
That sequence matters. When security teams are brought in after a solution has been selected, they may be asked to contain risks that were designed into the project from the beginning. Agentic systems make the issue more urgent because they can operate across applications, retrieve sensitive data, make recommendations and initiate bounded actions. Their risk profile depends not only on the model, but also on permissions, identity controls, data flows, monitoring and escalation.
The report is relevant to the UAE market because it measures the transition from experimentation into operational use. A company can have an agent running in a pilot while still lacking a reliable inventory of models, a process for approving new tools or evidence that controls work under adversarial conditions. The resulting exposure can include data leakage, prompt injection, unauthorised actions, inaccurate outputs and unclear responsibility when a system fails.
The findings create a market opportunity for cybersecurity, governance, evaluation and compliance providers. They also establish a practical test for enterprise AI programmes: security should be involved before a system is selected, authority should be explicit, and organisations should be able to show how the system is monitored and stopped when necessary.
The research is survey-based and should not be treated as a census of every UAE enterprise. It is nevertheless a useful indicator of the gap between AI ambition and deployment readiness. For the Gulf’s next phase of adoption, trustworthy operations may become as important as access to models and compute.
