The UAE is fighting AI hackers with AI of its own

The UAE says the cyber fight around the war in the region has become both faster and noisier. Since fighting began between Iran, Israel and the U.S. in February, the country’s Cyber Security Council says it has detected and contained coordinated attacks on aviation, energy and education, with hackers making about 800,000 attempts a day by April — roughly four times the prewar level.

The shift is not just volume. It is tempo. According to the council and security firms working across the Gulf, artificial intelligence is helping attackers write phishing emails, hunt for software flaws and build malicious code at a pace human defenders struggle to match. Ram Narayanan of Check Point Software Technologies said the gap between a vulnerability being disclosed and someone trying to exploit it has shrunk from days to hours. That is a brutal change for anyone tasked with keeping critical systems upright.

The UAE has been naming the attacks as they happen. In February, it said its systems repelled attempts described as terrorism-related, including efforts to break into government platforms and plant ransomware. Check Point separately traced break-in attempts on internet-connected cameras in the UAE, Qatar, Kuwait and Bahrain back to Iranian hackers, saying the goal appeared to be footage for missile targeting and damage assessment. In July, financial firms were hit with phishing, software flaws and malicious code, though services kept running. In August, the council said it tracked and stopped coordinated attacks on aviation, energy and education before they spread.

The defenders are building their own counterweight. The council says analysts working in shifts still read alerts and decide what matters, but they now sit inside a national operations center that gathers signals from across government. On May 12, the UAE launched “Cyber Factory” with CPX Holding to design AI security systems that can anticipate, detect and respond faster, while keeping more of the tooling at home under what the council calls national cyber sovereignty. That’s the logic here: if attackers have industrialized speed, defenders have to do the same or get left staring at logs while the damage is already done.