Sophos At GISEC 2026: How AI Is Reshaping Cybersecurity In The Middle East

(MENAFN- Khaleej Times) Harish Chib, Vice President for Emerging Markets, Middle East and Africa at Sophos, discusses AI-enabled threats, ransomware, identity security and why organisations are moving towards a more unified approach to cyber defence

Published: Wed 16 Sept 2026, 1:35 PM

Partner Content

As AI changes both the nature and speed of cyber threats, organisations across the Middle East are reassessing how they protect increasingly complex digital environments. From ransomware and identity-based attacks to the growing challenge of AI governance, resilience is becoming a critical part of the cybersecurity conversation. Harish Chib, Vice President for Emerging Markets, Middle East and Africa at Sophos, discusses the trends shaping the region, changing customer priorities and what Sophos will bring to GISEC 2026.

Can you tell us about Sophos' participation at GISEC this year?

At GISEC 2026, Sophos will focus on how organisations can defend themselves in an AI-enabled threat landscape, where attacks are faster, more coordinated, and increasingly difficult to manage with disconnected tools. The key focus will be Sophos Fusion, the industry's most complete AI-native cybersecurity defence system, which brings together security operations, endpoint, network, identity, email, cloud, managed detection and response, and third-party integrations into one coordinated defence architecture. Sophos will use the event to show how a unified approach can help organisations prevent, detect, investigate, and respond at AI speed, while keeping human expertise, accountability, and operational control at the heart of cybersecurity.

Sophos Fusion has been described as the industry's first AI-native cybersecurity defense system. Can you share more details on this?

Fragmented security stacks create blind spots. When endpoint, network, firewall, identity, email, and cloud tools operate in isolation, threats can move through the gaps between them undetected and security teams spend more time reconciling data than responding to risk. Sophos Fusion addresses this by unifying these capabilities within a single, coordinated architecture. Endpoint, network, firewall, identity, email, cloud, MDR, XDR, next-gen SIEM, and advisory services all operate on shared telemetry, allowing detections, investigations, and response actions to inform one another rather than existing as disconnected data points. It is also built for openness. With integrations across more than 500 third-party security and IT technologies, organisations are not required to replace their existing infrastructure. Current tools can be incorporated into the broader defence architecture, preserving prior investment while extending visibility and control.

The platform is powered by agentic AI, automation, and shared telemetry, complemented by human expertise from Sophos's analyst teams. Together, these capabilities enable security teams to gain broader visibility across their environment, accelerate investigation, coordinate response more effectively, and reduce the operational complexity inherent in managing disparate systems.

What do you see as the major cybersecurity shifts likely to impact the region in the year ahead?

Security leaders are facing a landscape that looks different than it did even a year ago. AI-enabled attacks are accelerating, identity has become a more central security concern, and organisations must now secure not just data but the AI tools that process it. At the same time, security teams remain under pressure to consolidate their toolsets and do more with less. Perhaps most pressing is the widening gap between AI adoption and AI governance, a gap that grows more consequential as generative AI and AI agents are granted access to sensitive business systems and data.

Ransomware remains one of the clearest examples of how these risks play out in practice. According to Sophos's 2026 State of Ransomware report, 79 per cent of ransomware attacks worldwide began with an identity-based point of entry, and malicious email and phishing have now overtaken exploited vulnerabilities as the leading root cause. In the UAE, organisations hit by ransomware reported an average recovery cost of $665,000. Taken together, these findings point to a clear set of priorities: stronger identity security, phishing-resistant controls, continuous monitoring, well-tested recovery processes, and coordinated detection and response across the entire environment.

What's changed most in how regional customers are buying and thinking about cybersecurity over the past year?

We are seeing a clear shift in how organisations think about security investment, away from buying more individual tools, and toward achieving stronger outcomes with less complexity. Most organisations already have solutions in place for endpoint, firewall, email, identity, cloud, and network security. The problem is that these tools rarely work together. As attacks move faster and span multiple parts of the environment, that fragmentation becomes a liability: blind spots emerge, investigations slow down, and response becomes harder to coordinate.

This is reshaping what regional customers are looking for. There is growing demand for approaches that are integrated, open, and AI-enabled, ones that improve visibility, speed, and resilience without requiring a wholesale replacement of existing investments. In particular, we're seeing rising interest in managed detection and response, AI-native defence, next-generation SIEM, identity-aware protection, and platforms capable of bringing native and third-party technologies together into a single, coordinated architecture.

Given how unpredictable geopolitical triggers can be, why should resilience now be the starting assumption for CISOs rather than prevention?

Prevention has limits. Geopolitical tension, supply chain risk, AI-enabled attacks, and infrastructure that keeps expanding faster than most teams can secure it have made that clear. So, while prevention still matters, it can't be the sole test of readiness anymore. At some point, an attack will succeed or a system will fail, and when it does, what matters is how fast an organisation notices, contains it, responds, and gets back to normal operations.

This changes what resilience actually means for a CISO. Stopping attacks is only part of the job now. Resilience is the rest of it - whether the business keeps running when something goes wrong, whether teams can see what's happening, coordinate a response, and actually execute a plan that's been tested under pressure rather than one that just looks good on paper.

In practice, resilience comes down to a few things working together: identity protection, monitoring that never really switches off, backups that hold up when they're actually needed, and incident response plans that have been rehearsed rather than filed away. It also means being able to move across endpoint, network, email, cloud, identity, and third-party systems at the same time, instead of one team handling one piece while another catches up. This is essentially what's driving Sophos toward a unified defence system - the idea that lowering risk and responding faster both come down to how well the pieces work together, especially when the threat landscape isn't cooperating.

MENAFN16092026000049011007ID1111675604