UAE employees outpace EMEA peers in cyber confidence, study reveals

Khaleej Times

29-06-2025

The UAE workforce is ahead of its EMEA peers across several indicators of cyber-readiness, underscoring the country's progress toward its national vision for digital resilience and AI-enabled defence, a study showed.
According to research by Cohesity, a company specialising in AI-powered data security and resilience, 86 per cent of UAE employees expressed confidence in recognising a cyber threat—compared to 81 per cent in the UK, 80 per cent in Germany, and just 62 per cent in France. Nearly nine in ten (89 per cent) UAE respondents also said they trust their organisation's ability to prevent and recover from attacks.
Beyond awareness, the study reveals encouraging signs of action-oriented behaviour. Two-thirds of UAE employees say they would report suspicious activity to their cybersecurity team, showing an apt response, in comparison to respondents from the UK (61 per cent), Germany (53 per cent), and France (48 per cent). Amongst other UAE employees, over half would notify their IT department. This instinct to act is supported by ongoing education: 66 per cent have received some form of cybersecurity training in the past year.
However, the research also highlights areas where further progress is needed. A small but notable group of employees say they would either attempt to resolve a threat on their own (15 per cent) or turn to personal contacts first (19 per cent), indicating a gap in internal reporting clarity, and a potentially risk to the entire organisation that mis-understanding of how important it is that reporting through the correct processes is critical to the quickest resolution of any potential risk of cyber attack . Among those hesitant to report incidents correctly, the leading reasons include fear of blame or confusion (46 per cent), a belief that it isn't their responsibility (27 per cent), and worry about overreacting (14 per cent).
Johnny Karam, Managing Director and Vice President, International Emerging Region at Cohesity, commented: 'The findings reflect the UAE's clear leadership in cybersecurity readiness across the EMEA region. With initiatives driven by the UAE Cybersecurity Council and a strong national focus on AI and digital transformation, it's no surprise that employee awareness is rising in step with enterprise investment.'
'What stands out is not just awareness, but the willingness to act. The next step is closing the gap—equipping employees with the tools, clarity, and – perhaps most importantly - confidence to respond without hesitation. If we educate all employees of the serious risks to the organisation of not correctly reporting any potential cyber risks they see, encouraging a mentality that they will not get in trouble for doing so, and highlighting their individual capability to maximise the speed of response all UAE organisations can be more resilient. At Cohesity, we believe true cyber resilience is built on both technology and a culture of empowered people,' Karam added.
The UAE's continued investment in cybersecurity infrastructure, most recently through advanced threat detection systems activated under the direction of the UAE Cybersecurity Council, demonstrates a firm national commitment to securing the digital landscape. The study shows that employees are already aligning with this vision:
● Two-thirds of the respondents have undergone cybersecurity training, with 39 per cent participating in multiple sessions in the past year.
● Over half (51 per cent) would report a suspicious incident to IT, while 67 per cent would notify a cybersecurity team, demonstrating a willingness to escalate issues through formal channels.
● 77 per cent are familiar with the term 'ransomware', showing widespread awareness of key threat types.
Awareness of cyber threats is on the rise in the UAE, with 77 per cent of employees familiar with the term 'ransomware'. This strong baseline offers an ideal foundation to build upon. By expanding education beyond surface-level awareness to include real-world examples and practical training, companies can empower their teams with the confidence and clarity needed to respond effectively.
While confidence in reporting and escalating potential ransomware threats within the organisation is high, the study reveals opportunities to further strengthen internal reporting behaviour. Around 15 per cent say they would attempt to resolve a threat themselves, and 19 per cent would first alert their personal contacts, These responses highlight a proactive mindset, which organisations can harness by further strengthening internal reporting protocols and promoting awareness of the appropriate escalation paths.
Among the smaller group of employees who expressed hesitation in reporting a potential incident, the most common reasons included:
● UAE employees showed a strong sense of fear of blame or not understanding the issue (46 per cent), while EMEA employees had a more neutral perspective (UK - 26 per cent, Germany - 20 per cent, and France - 15 per cent).
● 27 per cent of the UAE respondents believed it wasn't their responsibility, showing a much bigger gap to appreciating their role in their organisations cyber safety as compared to their EMEA counterparts (UK -10 per cent, Germany - 12 per cent, and France 19 per cent).
● 14 per cent UAE employees feared overreacting, in-tune with 18 per cent of German respondents 15 per cent from the UK and 11 per cent of French respondents showing similar sentiment.
With the UAE government actively advancing national cybersecurity capabilities and frameworks, the country is uniquely positioned to lead by example. Employees are ready and willing: confidence is high, training is widespread, and the instinct to act is evident. To fully unlock this potential, organisations must ensure that every employee, from the frontline to the C-suite, knows their role in safeguarding the business.
Mark Molyneux, CTO, EMEA at Cohesity, added: 'These findings confirm what we're seeing across the region: employees are increasingly aware of cyber risks and are willing to step up, which is largely due to the UAE Cyber Security Council's approach to increasing security awareness across the Emirates. But this awareness must be matched with action. The future of cybersecurity will be defined by how quickly organisations can enable secure, informed decisions at every level. That means embedding cyber resilience into daily operations, investing in smart automation, closing the gap between detection and response, and instilling a culture that supports employees in raising concerns early in a safe space. In fast-moving threat environments, AI-powered data security is not a luxury, it's an operational necessity.'