Gulf enterprises must close AI security gaps to boost cyber resilience, says SANS Institute

Rapid AI rollout across Gulf government services, finance, energy and critical infrastructure is exposing organisations to complex cyber risks, according to Ned Baltagi, Managing Director for the Middle East, Africa and Turkey at the SANS Institute, in an interview with TahawulTech. Baltagi says the SANS AI Security Maturity Model assesses protection, utilisation and governance across five maturity stages, revealing common gaps such as limited visibility into AI deployments, weak data controls and insufficient model oversight.

He recommends a lifecycle-wide governance approach: inventory AI systems, classify processed data, assign owners and conduct risk-based assessments before production. The model highlights five essential capabilities—AI policy, risk management, oversight, shadow-AI visibility and compliance readiness—supported by frameworks like NIST AI RMF and ISO/IEC 42001.

SANS’ 2026 global research shows 73 % of practitioners have altered training due to AI, while 78 % report confirmed or suspected AI-enabled attacks. Baltagi stresses that practical, role-based training (e.g., SEC545, GAIPS) is vital to build the specialised skills needed for AI application security, adversarial testing and prompt-injection mitigation, thereby strengthening Gulf cyber resilience.