The conversation around cyber risk has shifted from “if” an attack will happen to “when.” What does that mean for how organisations should be preparing?
The numbers speak for themselves. Around 59% of UAE organisations have experienced a material cyberattack, and that’s only among those surveyed. The real figure is likely higher. So the question is no longer about whether you’ll be attacked. The question is: how fast can you recover?
When an attack happens, leadership needs to know what their minimum viable company looks like. What does the business need to be up and running within hours? That is where technology like data classification and what we call a digital jump bag becomes critical, knowing exactly what to bring back first when everything goes down.
I always use the analogy of flying on airlines. Every time you board a flight, you trust that if something goes wrong, the pilot has already simulated that exact scenario. That level of preparation and orchestration is what organisations need to build into their cyber readiness today.
Take Active Directory, over 90% of organisations depend on it, and it’s almost always one of the first things attackers target. Through our partnership with Semperis, we’ve helped customers reduce Active Directory recovery time from over six days to under six hours. That’s the kind of outcome the right technology and the right partnerships make possible. And at the end of the day, faster recovery directly translates to less money lost.
This readiness isn’t a box you tick once a year. It needs to be part of the conversation every single day.
There’s often debate about whether to prioritise prevention or resilience and recovery. Where do you stand?
I wouldn’t prioritise one over the other, they are equally important. It’s like asking whether the infrastructure team or the security team is more responsible for data protection. The answer is both. Neither can operate without the other.
Prevention has been the bread and butter of data protection for years; it’s the insurance policy. But having a backup is no longer enough on its own. The real question today is: how resilient are you, and how fast can you recover when the worst happens?
We’re also seeing the nature of attacks evolve. Wiper attacks, where bad actors simply delete data rather than encrypt it, are increasingly common. There’s no ransom demand, no negotiation. The data is just gone. That makes recovery capability not just important, but existential.
With backups now becoming a prime target for attackers, how should organisations rethink backup security, vaulted recovery, and clean-room resilience strategies?
Backups are your last line of defence, which is exactly why they’re the first thing attackers go after. We’ve evolved from the 3-2-1 rule — three copies of data, two locations, one off-site — to a 3-2-1-1 model, where the fourth copy is a vaulted version of your data.
We’ve been announced as one of the Google Cloud Partners of the Year because of our ability to vault data. Since February, our most requested product has been Cohesity Fort Knox, which gives customers that critical fourth copy.
The flexibility matters too. Fort Knox can live in hyperscalers, on-premises, or with local managed service providers, which is important given that data sovereignty is still a very real concern in this region.
The other challenge is contamination. If a bad actor is already inside your environment when you take a backup, you’re backing up the threat. You carry it to your DR site, then to your vault and suddenly none of your backups are clean. That’s why the ability to recover from a clean room has become a way of life, not just a best practice.
This is also why we don’t believe you can fight this fight alone. We pull in hundreds of thousands of threat feeds every day from partners like Semperis, Datadog, Google, Amazon, and Microsoft. Those feeds run into our AI model, which is tied directly to our backup process, constantly running anomaly detection to check whether a bad actor has already arrived. Because if you go to recover a backup and the threat is sitting inside it, it’s already too late.
For organisations that believe they already have strong data protection in place, where are the gaps most likely hiding?
Visibility. That’s the most common gap we see. Organisations don’t always know where their data sits, which applications and databases they’re protecting, or what they’d need to bring back first in a crisis.
You’d be surprised how many organisations don’t back up their databases, because they don’t trust legacy backup applications to do it reliably. Cohesity uses a modern single file system, SpanFS, that allows us to perform a live mount directly from the backup, taking database recovery from hours down to minutes or even seconds.
The other thing I’ll say is this: compliance is necessary but not sufficient. Ticking the backup box is no longer good enough. The real questions are: can you actually recover those backups? And how long will it take? With capabilities like instant mass restore, we can recover thousands of machines in under 45 minutes. That is the standard organisations should be holding themselves to.
Governments across the region are tightening their cybersecurity directives. How is that shaping enterprise behaviour?
It’s influencing both enterprises and vendors. You can’t engage with UAE government entities today without certifications. These requirements are raising the bar across the board.
The goal of the UAE government and the National Cybersecurity Council is to make it one of the safest places in the world for data. We’ve got work to do. The UAE is ranked second globally for the number of cyberattacks. But that pressure is building real resilience, and the Council is leading the way.
That push is being felt globally, too. The common thread is this: it’s no longer just about preventing access to personal data. It’s about ensuring you can still recover it if you’re attacked, whether that’s medical records, banking data, or personal information.
For us, this has meant investing heavily in the region: in certifications, yes, but also in people. The conversations we’re having with customers have shifted completely. Backup speed is not the focus of discussion anymore. It is resilience, clean rooms, anomaly detection, digital jump bags, and recovery orchestration.
What is your advice for businesses looking to strengthen their data protection posture right now?
Don’t wait. Simulate the disaster before it happens. Build the orchestration layer. Simplify wherever you can, complexity has historically been one of ransomware’s greatest allies. The more disparate technologies you have, the more doors you’re trying to protect. Get visibility across all your data through a single pane of glass, and reduce that complexity down to a manageable number of trusted solutions.
One more thing: make sure your infrastructure and security teams are talking to each other. Five years ago, maybe 10% of organisations had that alignment. Today it’s closer to 50-60%, but it’s still not good enough. When those two teams work together, recovery becomes faster and more reliable.
The threat is coming to everyone, regardless of size. So whether you’re a large enterprise or a small business, reach out to the specialists, get the right partnerships in place, and be ready.
Discussion about this post