Compliance to confidence: A shift in Middle East cybersecurity investments

For a clear sense of where cyber priorities are heading in the GCC, you have to look at the people in control of the budgets – and what keeps them awake at night. 

New research from PwC shows that boards and business leaders in the Middle East are taking a more focused stance on cyber. Nearly a quarter plan to raise cyber budgets by 11%+ in 2025, and 63% say their boards are highly effective on regulatory responsibilities – well above the global average. 

This governance shift is driving spend into strategy, rather than just cybersecurity tooling. 

What gets funded first? 

According to PwC’s Middle East findings, business leaders in the region say their top investment priority is improving risk posture against a strategic plan, then data protection, and modernising tech/cyber infrastructure. 

On the technology leader side (CISOs and CIOs), the emphasis skews even harder towards protection: 40% rank data protection as their top investment area (compared with 28% globally) and 31% are prioritising GenAI/ML. 

Taken together, that’s a vote for practical controls that reduce blast radius (from DLP and encryption to strong IAM, secrets management, and better data lifecycle hygiene) and for building guardrails around fast-moving AI adoption.

The regional threat picture at a glance 

Threat-wise, the concerns here are specific and immediate. Hack-and-leak operations top the list (47%, vs 38% globally), alongside third-party breaches (36%), BEC/account takeovers (36% vs 24% globally), and cloud-related threats (35% vs 42% globally).

And preparedness is mixed – some organisations are least prepared for cloud threats, while others are least prepared for third-party breaches.

With this in mind, we expect procurement requirements, continuous monitoring, and SBOM/SCRM capabilities to see budget tailwinds. 

But we have to remember there’s a human layer too. When we interviewed past Black Hat MEA speaker Suresh Sankaran Srinivasan (Group Head of Cyber Defence at Axiata), he said:

“I wish everyone realised that cybersecurity is more of an attitude than a technical skill or control.”

That perspective is important in the context of the changes we’re seeing in the region. Spend is rising, but if it isn’t coupled with a mindset shift (from compliance box-ticking to resilient culture), the ROI will be thin. 

Regulation and compliance requirements are tightening 

Regulation is having a real impact on budget decisions too. Saudi Arabia and the UAE continue to tighten data localisation and sectoral rules – leading to local data centres and cloud controls to meet compliance requirements. 

Boards feel the heat, and CISOs get the mandate (and, increasingly, the budget) to operationalise compliance without slowing down innovation.

The power of community for a thriving sector 

When we interviewed Isabelle Meyer (Co-Founder and Co-CEO at ZENDATA Cybersecurity), we asked why events like Black Hat MEA are valuable to her. She said:

“The community! It makes us grow, gather, and create.”

That shared expertise is what helps boards and CISOs spend smarter – learning from peers, avoiding shiny-tool syndrome, and investing where it counts.

So here are our three key takeaways for Middle East cyber leaders right now: 

1. Make data protection your north star. Use it to rationalise tooling, push for data classification at source, and connect spend to measurable risk reduction.
2. Treat third-party risk as a programme. Move beyond contract clauses to continuous, evidence-based assurance and third-party incident exercises.
3. Put AI under governance. Invest in model and data governance, prompt controls, and AI-aware monitoring.

If you want to position yourself at the heart of regional and global cybersecurity knowledge, there’s still time to register for Black Hat MEA 2025.