Microsoft published its 2026 Digital Defence Report on 2 October, using its visibility across the company’s digital ecosystem to describe shifts in cyber risk. The report says Microsoft sees more than 165 trillion security signals each day. That scale refers to telemetry processed by the company, not a count of confirmed attacks or unique victims. WAM’s coverage focused on the report’s relevance to the UAE as government and businesses expand their use of artificial intelligence.

For the first half of 2026, Microsoft data placed the UAE sixth globally among countries where its customers were most frequently impacted by cyber activity, and second in the Middle East and Africa. The ranking is specific to Microsoft’s customer footprint and its measure of impact; it is not a national incident count or a ranking of all cyberattacks. The release does not disclose the denominator, impact definition or country-level sample sizes alongside the positions.

The report identifies three broad shifts: AI is accelerating both attacks and defence; identity remains a primary route into organisations; and incidents can spread consequences beyond the initial victim through connected suppliers, platforms and service providers. As organisations add AI systems, they create more data, identities and access points to protect. This expands the security workload even when the technology is introduced to improve service speed or automate routine processes.

Microsoft, the UAE Cyber Security Council and Core42 announced plans to deploy the company’s AI-powered MDASH cybersecurity capability across UAE government entities. The announcement says it is intended to help security teams find vulnerabilities, prioritise risk and respond faster while supporting sovereign security, privacy and operational resilience. It provides no deployment schedule, agency list, contract value or measured response improvement, so the plan should not be presented as a completed nationwide rollout.

The report’s practical recommendations centre on protecting identities, responding faster and building resilience. Measures include stronger authentication, reducing reliance on passwords, accelerating detection and response, exercising incident plans and designing critical services to continue through disruption. These are operational controls, not a substitute for risk-specific engineering. Organisations still need asset inventories, access rules, backups, supplier oversight and tested recovery plans suited to the systems they operate.

For the UAE’s digital economy, the finding is that cyber resilience must grow alongside AI adoption. A compromised identity or supplier can disrupt services across multiple organisations, creating costs that do not stop at the first affected company. Security investments can reduce expected loss and downtime, but the report offers no UAE-specific loss estimate or return-on-investment figure. The ranking is a risk signal within Microsoft’s data, while local incident reporting and independent assessments are needed to measure national exposure comprehensively.