THE BREACH STARTED WITH A MISSED UPDATE.

WHAT HAPPENED

In mid-September Dr. Mohamed Al Kuwaiti, head of cyber security for the UAE Government, publicly described an attack on a private company. The attacker phoned him and demanded more than $5 million. He did not name the company or say when the call came.

The National reported that the attack destroyed data linked to the company's infrastructure and that the attackers tried to leak what they took; the two outlets differ on how far they got. Gulf News described the victim as a private organization supporting a government sector and said cooperation with local and international partners contained the attack. Both reports give the same entry point: a vulnerability that the latest software updates would have closed.

Two announcements followed within the month. On 17 September the UAE Cyber Security Council and Open Innovation AI launched a UAE-built AI model for security teams, covering vulnerability and code analysis, incident investigation and risk assessment. At the end of September Microsoft, the Council and Core42 announced a phased rollout of MDASH, Microsoft's AI tool for finding vulnerabilities and ranking risk, across UAE government entities. The Council's National AI Test and Validation Lab will support adoption, and Core42 will handle onboarding through its sovereign public cloud.

THE CHEAPEST WAY IN IS STILL THE KNOWN ONE

Nothing in this incident required a new technique. A known flaw stayed unpatched in a company holding data worth ransoming, and the attacker found it first. It is a familiar pattern, and the tools the government chose to roll out this month aim at exactly that problem: finding and ranking flaws across many entities at once.

That is also a sensible place for a first AI security budget. Vulnerability work produces a backlog with a count and an age. A scanner either brings both down or it doesn't, and you can tell which within a quarter.

AGENTS INHERIT YOUR PATCH BACKLOG

The incident matters for AI roadmaps for a second reason. An agent with tool access can reach whatever its tools can reach. If a CRM connector or an internal API runs on an unpatched system, the agent becomes one more path to it, and anyone who can influence the agent's instructions can use that path.

Most agent pilots we review are scoped around what the agent should do. Fewer list every system it can touch, and fewer still check those systems' patch status before go-live. The integration layer is part of the attack surface and deserves the same review as anything exposed to the internet.

FIVE CHECKS BEFORE THE NEXT AGENT GOES LIVE

• Patch what the agent can reach. List every system an agent or integration will touch, pull the open critical and high-severity vulnerabilities on each, and make closing them a condition of go-live.
• Give each agent its own account. Use separate service identities with only the permissions the workflow needs. A shared admin key turns one manipulated agent into access to everything.
• Point AI at your own estate. An AI-assisted scan of code and configuration comes with a clean metric: open findings and days to fix, reported monthly.
• Decide who takes the call. Write down who answers a ransom demand and who notifies the authorities. Then run a test restore from your backups this quarter.
• Ask suppliers for patch records. The victim here reportedly sat in a government supply chain. Any supplier connected to your systems brings its update discipline with it.