Dubai, United Arab Emirates – A new study by Illumio, a company specialising in breach containment, reveals that artificial intelligence (AI) has emerged as a new source of internal risks. The research indicates that organisations are increasingly empowering AI systems with legitimate access rights to make decisions, access sensitive data, and perform actions that are not always monitored or controlled by institutions.
High AI Autonomy in Middle Eastern Institutions
According to the report titled “Permissive Behaviour: How AI Autonomy Surpasses Imposed Limits”, 81% of organisations in the UAE and Saudi Arabia now delegate decision-making authority to AI systems that previously required human approval, surpassing the global average of 70% by 11 percentage points. However, only 59% of these organisations can consistently monitor and audit all actions undertaken by AI agents. This highlights a growing gap between the permissions granted to AI systems and the organisations’ ability to scrutinise and control their operations.
These risks are no longer mere theoretical possibilities; 79% of Middle Eastern organisations reported experiencing at least one security incident or warning signal related to AI in the past 12 months, compared to 76% worldwide. While much discourse on AI security focuses on how attackers could exploit the technology, the findings also unveil risks stemming from the AI systems within organisations themselves, particularly as these systems gain access to corporate applications, data, and infrastructure.
Significant Security Incidents Linked to AI
Nearly four in ten organisations in the Middle East (39%) indicated that AI provided recommendations that, if implemented, would pose a security risk, compared to 35% globally. Furthermore, 23% of institutions reported that AI executed an unauthorised action or caused one to occur, with the same percentage facing an AI-related security incident or a near-miss incident. Additionally, 22% mentioned that AI accessed data it was not authorised to, while 22% observed an AI agent or tool connecting to systems without proper security vetting.
The potential implications for businesses are increasing as more sensitive tasks are assigned to AI, with just over half of the organisations in the region (53%) deploying AI for cybersecurity operations. Moreover, over a third (34%) would allow AI to make changes to source code without oversight, while the same proportion is willing to permit AI to grant or revoke access permissions without human supervision. Notably, 22% of organisations are open to AI conducting security investigations without human review.
Movement Towards Enhanced Cyber Risk Management
The study highlights several key aspects regarding cybersecurity approaches in the region:
- Middle Eastern institutions adopt a more cautious approach to cyber risks: Less than half (44%) expressed a willingness to accept a higher level of cyber risk than they did 12 months ago, compared to a global average of 56%. Nevertheless, 59% currently allow AI to autonomously execute actions in live operational environments.
- Acknowledging the need for enforceable limits: Acknowledging the importance of controls, 87% of organisations believe that AI agents need security regulations distinct from those used for traditional software, compared to 82% globally. Additionally, 80% concur that limiting AI’s access scope is essential to pre-emptively addressing threats, significantly higher than the 69% global average. Explicitly defining permissible actions for AI is regarded as crucial for their security framework by 30% of organisations, in contrast to 25% globally.
Ragu Nandakumara, Vice President of Sector Strategy at Illumio, stated: “Middle Eastern organisations are granting AI effective powers, but doing so without controls carries risks. As AI transitions from suggesting actions to executing them, organisations cannot rely solely on understanding or predicting every decision it will make. They need clear, enforceable boundaries that govern its access scope, the systems it can interact with, and the extent of any unexpected activity. The solution is not to slow down AI adoption but to ensure that increased autonomy does not lead to heightened risks.”
The report suggests that a practical solution to balance AI’s expanding role is to regulate its access through a “zero trust” approach, instead of attempting to predict every potential action it may take.
For more information, please visit: Illumio AI Autonomy Report
Research Methodology
The study was conducted by Sapio Research on behalf of Illumio, surveying 1,100 decision-makers in IT and security across ten markets, including 100 participants from the UAE and Saudi Arabia. The figures pertaining to the Middle East in this announcement are drawn from this regional sample of 100 respondents. The broader global study involved 200 respondents from the United States, in addition to 100 respondents each from the United Kingdom, France, Germany, Switzerland, Austria, Japan, Australia, Singapore, Brazil, and Mexico.
About Illumio
Illumio is a leader in ransomware attack and breach containment, offering an innovative approach that assists businesses in containing cyber threats and enhancing operational resilience. Its breach containment platform employs an AI-driven security model to detect and contain threats across hybrid and multi-cloud environments, preventing the spread of attacks before they escalate.
Ranked by the Forrester Wave™ as a leader and a preferred choice among clients in micro-segmentation solutions, Illumio helps implement zero trust approaches, bolstering the cyber resilience of infrastructures and systems vital to critical operations worldwide.
Media Contacts:
Illumio: [email protected]