Nearly one in four organisations across the UAE and Saudi Arabia are using autonomous AI agents without adequate governance, exposing businesses to growing cyber risks as AI adoption accelerates, according to new research from KnowBe4.
The report, From Agentic Risk to Human Wins: Building a Culture of Security in the Era of Agentic AI, reveals that AI is becoming deeply embedded in enterprise operations, but governance, employee awareness and security controls are struggling to keep pace.
According to the study, 84% of cybersecurity leaders in the region say AI agents are already performing tasks within organisational workflows. However, 24% admit these AI deployments remain unapproved or largely ungoverned, creating what researchers describe as “Shadow AI”—autonomous systems accessing sensitive business information without sufficient oversight.
“Attackers are moving at machine speed, using deepfakes to target employees and prompt injections to hijack AI agents. Leaving almost a quarter of corporate AI usage ungoverned is a massive open invitation to threat actors.”
— Dr. Martin Kraemer, CISO Advisor, KnowBe4
The report also highlights growing concerns around AI-powered cyberattacks. Nearly 88% of employees believe deepfake voice and video content has become so convincing that it is increasingly difficult to distinguish genuine communications from malicious ones, while 52% acknowledge they could fall victim to a deepfake scam in the workplace.
Human error continues to be a significant security challenge. More than half (54%) of cybersecurity leaders said employee mistakes during routine work had the greatest impact on their organisations’ cybersecurity over the past year. Additionally, 44% of employees admitted that workplace distractions and time pressure often lead them to bypass established security practices.
The research further found that AI-enabled attacks are expected to become an even greater concern, with 36% of cybersecurity leaders identifying them as one of the biggest future human-related cyber risks.
Shadow AI is also becoming increasingly prevalent. Around 41% of employees reported using their own AI tools when approved solutions were unavailable, while 52% of security leaders said unsanctioned software and AI applications had negatively affected their organisations’ security posture during the past 12 months.
Despite 76% of security leaders expressing confidence in their preparedness for AI-driven threats, 84% acknowledged that significant improvements are still required to ensure AI systems operate within organisational security policies and acceptable risk limits.
The report suggests that organisations demonstrating stronger cyber resilience are those that embed security into workplace culture rather than relying solely on technology. Around 82% of employees in these organisations said they feel comfortable reporting mistakes without fear of blame, encouraging faster detection and response to potential threats.
Dr. Martin Kraemer, CISO Advisor at KnowBe4, warned that cybercriminals are increasingly exploiting AI technologies to automate attacks and manipulate both humans and AI systems.
The research concludes that organisations must build security-first cultures that extend beyond employees to include AI agents, combining governance, behavioural awareness and secure AI deployment practices to reduce enterprise cyber risk.
The findings are based on a global survey conducted by Vanson Bourne involving 4,000 respondents, including 800 cybersecurity decision-makers and 3,200 employees from organisations with at least 250 employees across the Americas, EMEA and Asia-Pacific regions.
