{"id":1092,"date":"2026-10-13T11:12:20","date_gmt":"2026-10-13T10:12:20","guid":{"rendered":"https:\/\/www.intelligentciso.com\/middle-east\/2026\/10\/13\/delinea-report-finds-rogue-ai-threat-looms-large-for-uae-organisations\/"},"modified":"2026-10-13T11:12:20","modified_gmt":"2026-10-13T10:12:20","slug":"delinea-report-finds-rogue-ai-threat-looms-large-for-uae-organisations","status":"publish","type":"post","link":"https:\/\/www.intelligentciso.com\/middle-east\/2026\/10\/13\/delinea-report-finds-rogue-ai-threat-looms-large-for-uae-organisations\/","title":{"rendered":"Delinea report finds \u2018Rogue AI\u2019 threat looms large for UAE organisations"},"content":{"rendered":"\n

New research from Delinea reveals that 98% of UAE organisations have experienced confirmed or suspected instances of AI tools accessing sensitive data beyond task requirements, while seven in 10 failed to detect the latest instance within 24 hours and only 16% can immediately revoke credentials and terminate sessions.<\/em><\/p>\n\n\n\n

UAE organisations have moved quickly to establish policies governing AI access, but new research from Delinea shows that those rules are not consistently translating into effective control over what AI tools and agents do in practice.<\/p>\n\n\n\n

The global research surveyed IT and security leaders at organisations that are actively using or piloting AI, including 251 respondents in the UAE. Every UAE respondent said their organisation has a formal policy governing what data AI tools and agents may access. Yet 98% have experienced confirmed or suspected instances in which an AI tool accessed sensitive data beyond what its task required, compared with 87% across the global survey sample.<\/p>\n\n\n\n

The data points to inconsistent enforcement as a central weakness. Only 59% of UAE respondents say their organisation\u2019s AI data-access policy is actively enforced, compared with 71% overall.<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

Art Gilliland, CEO of Delinea, said: \u201cWritten policy is only as good as an organisation\u2019s ability to enforce it at the moment an AI agent acts. The UAE has clearly recognised the need to govern AI access, but the findings reveal what I call the fallacy of policy: assuming that defining what an agent should be allowed to do is the same as controlling what it actually does. That distinction becomes critical when agents operate across systems and make decisions at machine speed.\u201d<\/p>\n\n\n\n

The enforcement gap is particularly apparent when organisations attempt to identify excessive access. Seven in 10 UAE organisations did not detect the latest instance in real time or within 24 hours, compared with six in 10 across the overall sample.<\/p>\n\n\n\n

Delinea\u2019s findings arrive as governments, technology companies and business leaders confront the risks created by increasingly autonomous AI systems operating without effective controls. The OpenAI and Hugging Face incident in July demonstrated how quickly an agent can move beyond its intended boundaries and across connected environments before defenders contain it. The comparatively lower levels of enforcement and detection recorded in the UAE suggest that organisations could be particularly exposed to the consequences of similar loss-of-control events.<\/p>\n\n\n\n

Business pressure may be one reason policies are circumvented. When commercial demands or deadlines require AI tools to move faster than governance processes allow, 41% of UAE respondents say their organisation either allows employees and teams to find workarounds without formal approval or grants temporary access and reviews it later.<\/p>\n\n\n\n

Limited accountability may also reduce the pressure to turn written policies into consistently enforced guardrails. Although 98% of UAE respondents say approval from a named individual is required at least sometimes before an AI tool receives access to a new sensitive data source, only 35% can always trace a sensitive access event back to a named human authoriser. Without a clear and persistent line of responsibility, ownership of the controls needed to prevent another incident can become unclear.<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

That lack of accountability becomes particularly consequential when an organisation needs to intervene. Even after problematic access is identified, only 16% of UAE respondents say their organisation has real-time controls that can both revoke an AI tool\u2019s credentials and terminate its session immediately, less than half the 35% recorded across the overall sample.<\/p>\n\n\n\n

Mortada Ayad, VP of Sales \u2013 META, Delinea, said: \u201cUAE organisations have already taken the first step by establishing policies and approval requirements, but policy alone cannot contain an agent operating at machine speed. The next priority is to enforce authorisation at the instant of action by limiting access to what the task requires, maintaining a defensible link to the person who approved it, and terminating credentials and sessions immediately when the task ends or risk changes. This is how organisations can turn AI governance from a document into a working control.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

New research from Delinea reveals that 98% of UAE organisations have experienced confirmed or suspected instances of AI tools accessing sensitive data beyond task requirements, while seven in 10 failed to detect the latest instance within 24 hours and only 16% can immediately revoke credentials and terminate sessions. UAE organisations have moved quickly to establish […]<\/p>\n","protected":false},"author":18,"featured_media":965,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71,114,484,103,51],"tags":[180,95,181,169,358,75,78,98,121,80,853],"class_list":["post-1092","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-enterprise-security","category-middle-east","category-research","category-top-stories","tag-access-control","tag-agentic-ai","tag-ai-agents","tag-ai-governance","tag-art-gilliland","tag-artificial-intelligence","tag-cybersecurity","tag-data-security","tag-delinea","tag-identity-security","tag-mortada-ayad"],"acf":[],"publishpress_future_action":{"enabled":false,"date":"2026-10-25 23:20:49","action":"change-status","newStatus":"draft","terms":[],"taxonomy":"category","extraData":[]},"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts\/1092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/comments?post=1092"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts\/1092\/revisions"}],"predecessor-version":[{"id":1095,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts\/1092\/revisions\/1095"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/media\/965"}],"wp:attachment":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/media?parent=1092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/categories?post=1092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/tags?post=1092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}