Introduction
Cybersecurity is not an IT problem. It stopped being an IT problem the moment a breach became a board-level accountability event.
In February 2026, Dr Mohamed Hamad Al Kuwaiti, Head of the UAE Cybersecurity Council, announced that between 90,000 and 200,000 breach attempts strike UAE infrastructure every single day. Since the beginning of 2026 alone, 128 cyber threat incidents have targeted UAE entities – with government administration, financial services, and banking among the most affected sectors. EY’s Six Boardroom Priorities Shaping MENA in 2026 named cybersecurity alongside AI governance as the two defining technology risks on the regional board agenda, noting that cyberattacks across MENA increased 40 percent year-over-year and that more than half of audit committees continue to face fragmented visibility, inconsistent testing, and unclear incident response structures.
For the fifth consecutive year, the IIA’s 2026 Risk in Focus survey – drawing on insights from over 4,000 chief audit executives and directors across 131 countries – ranked cybersecurity as the number one global risk and internal audit priority. The WEF’s Global Cybersecurity Outlook 2026 reported that 91 percent of the world’s largest organisations have changed their cybersecurity strategies due to geopolitical volatility. In the GCC, where geopolitical tension is not a passing condition but a structural feature of the operating environment, that statistic lands with particular weight.
The board’s role in this environment is not to become technical. It is to own the governance of cyber risk with the same rigour it applies to financial and regulatory risk – because the consequences of getting it wrong are now comparable.
What Board-Level Cyber Governance Actually Means
There is a version of cyber governance that most GCC boards currently have: a CISO presents to the audit committee once a year, a dashboard shows breach attempts blocked, and the board approves the cybersecurity budget without deeply interrogating it. That is not governance. That is reporting.
IMD’s cybersecurity governance analysis for 2026 identified four pillars that boards must own to exercise genuine oversight: information architecture, people, structures and processes, and governance culture. Each requires board-level decisions, not management delegation.
Information architecture means the board understands what data the organisation holds, where it lives, how it flows, and who has access to it. In the GCC, where data sovereignty is increasingly regulated – Saudi Arabia’s PDPL under SDAIA and the UAE’s federal data protection law both impose specific obligations on how personal data is stored and protected – the board cannot govern data risk without understanding the organisation’s data map. Most boards do not have one presented to them.
People means the board has at least one director with cybersecurity literacy sufficient to interrogate management assertions on risk. Gartner projected that by end of 2026, approximately 70 percent of boards globally would have at least one member with cybersecurity expertise. GCC boards are not all there yet, and the gap matters: a board that cannot ask the right questions of a CISO receives whatever the CISO chooses to present.
Structures and processes means the board has designated oversight – a committee with a specific cyber mandate, defined reporting lines, and a documented escalation protocol for cyber incidents. EY’s MENA analysis was direct on this point: boards require clarity over investigation ownership, escalation thresholds, and the authority to commission independent investigations. Without these structures, the board learns about a material breach at the same time as everyone else.
Governance culture means cybersecurity awareness is embedded at the board level as a standing priority, not a topic that surfaces only after an incident. The WEF’s Global Cybersecurity Outlook 2026 found that only 19 percent of organisations claim to exceed their minimum cybersecurity resilience requirements – a figure that reflects how rarely cyber governance moves beyond the baseline.
For directors seeking to understand where their board’s cyber oversight currently stands, MEIoD’s advancing digital transformation and cybersecurity governance provides the contextual framework, while the CG Assessment identifies specific governance gaps including the adequacy of technology risk oversight.
The GCC-Specific Risk Profile
The GCC’s cyber risk environment in 2026 has three characteristics that make board governance more urgent, not less, than in comparable markets elsewhere.
Geopolitical exposure. The WEF Global Cybersecurity Outlook 2026 found that 64 percent of organisations are now accounting for geopolitically motivated cyberattacks, including disruption of critical infrastructure and espionage. State-aligned and politically motivated cyber activity has increased materially – Akin Gump’s GCC cybersecurity analysis confirmed that sophisticated actors are deliberately targeting organisations in strategically important regions, often focusing on disruption, intelligence gathering, or influence. The March 2026 cyberattack on Stryker demonstrated that some actors may erase devices and destroy data with no clear economic motive – purely to cause disruption.
Ransomware escalation. Ransomware attacks increasingly involve data theft and extortion alongside operational disruption, creating simultaneous legal, regulatory, and reputational exposure. The global average cost of a data breach in 2026 reached $4.88 million, according to IBM and WEF reporting. In sectors where the GCC has concentrated exposure – financial services, energy, government-linked entities – the operational and regulatory consequences of a ransomware event are materially higher than the average.
AI-amplified attack surfaces. The WEF Global Cybersecurity Outlook 2026 noted that AI is transforming cyber on both sides of the fight – strengthening defence while enabling more sophisticated attacks. For GCC boards overseeing organisations that have adopted AI rapidly, the attack surface has expanded faster than most governance frameworks have tracked. Gartner projects that more than 40 percent of organisations will experience a security or compliance incident tied to unauthorised shadow AI by 2030.
MEIoD’s analysis of how committees and boards interact addresses how audit committee oversight needs to extend into technology risk – a mandate that the IIA’s new Cybersecurity Topical Requirement, effective February 5, 2026, has formalised for internal audit functions operating under the 2024 Global Internal Audit Standards.
What the Board Should Be Asking
Effective cyber governance at the board level does not require directors to understand packet filtering or endpoint detection tools. It requires a consistent set of questions that management must be able to answer – and that the board must be willing to hear honestly.
The questions that separate genuine board oversight from procedural reporting are: What are the three highest cyber risks to our organisation right now, and how has that assessment changed in the last six months? What is the process for escalating a material cyber incident to the board, and has it ever been tested? What percentage of our critical systems have been independently assessed in the last twelve months? Who is accountable if a breach occurs, and what decisions does the board need to make in the first 72 hours? Are our cyber insurance coverage and incident response plans current and tested?
These questions are not technical. They are governance. A board that asks them regularly and receives substantive answers is exercising oversight. A board that does not ask them is governing by hope – a standard that no regulator, insurer, or institutional investor will accept when the question of accountability arises.
For directors working through how to build this oversight capacity, MEIoD’s Corporate Directors Program covers digital risk, technology governance, and oversight frameworks as part of its broader director development curriculum. The September cohort opens on 13 September.
MEIoD’s upcoming webinar on The Audit & Risk Committee: Beyond Financial Oversight to Tech & ESG Assurance on 14 October 2026 addresses directly how audit and risk committees can expand their mandate to cover cybersecurity and technology risk alongside traditional financial oversight.
Strengthen Your Board with MEIoD
Cybersecurity governance is no longer optional architecture. In the GCC’s current threat environment, it is a board accountability matter. MEIoD helps boards build the oversight structures that cyber risk now demands.
CG Assessment – identifies gaps in technology risk oversight and provides a specific improvement roadmap
Board Evaluations – assesses whether the board’s composition and committee structure are adequate for the cyber risk the organisation faces
Corporate Directors Program – builds the governance literacy that directors need to oversee technology risk effectively. July cohort: 12 July; September cohort: 13 September
Audit & Risk Committee Webinar – 14 October 2026, addressing the expanded mandate for tech and ESG assurance
The breach that defines your board’s governance legacy has not happened yet. Contact MEIoD to ensure your oversight architecture is built before it does.
FAQ
What is the board's responsibility in cybersecurity governance?
The board is responsible for overseeing cyber risk with the same rigour applied to financial and regulatory risk. This means designating committee oversight, ensuring at least one director has cyber literacy, receiving regular substantive management reporting, and maintaining a tested incident escalation protocol – not delegating cyber entirely to management and the CISO.
How serious is cyber risk in the GCC in 2026?
The UAE Cybersecurity Council confirmed between 90,000 and 200,000 breach attempts hit UAE infrastructure daily, with 128 confirmed cyber incidents since the start of 2026 alone. EY’s MENA boardroom analysis found cyberattacks across the region rose 40% year-on-year. The IIA ranked cybersecurity as the number one global risk for the fifth consecutive year in its 2026 survey of over 4,000 audit executives.
What questions should a GCC board ask about cybersecurity?
The five most important governance questions are: What are our three highest cyber risks right now? What is the escalation process for a material breach and has it been tested? What percentage of critical systems have been independently assessed in the past twelve months? Who holds accountability if a breach occurs? Are our cyber insurance and incident response plans current? These are governance questions, not technical ones.
Does a GCC board need a cybersecurity expert as a director?
Gartner projected that by end of 2026 approximately 70% of boards globally would have at least one member with cybersecurity expertise. The board does not need a technical expert, but it does need at least one director with sufficient digital risk literacy to interrogate management reporting and hold the CISO accountable. Without that, the board governs cyber risk on the basis of what management chooses to present.
How does the IIA's 2026 Cybersecurity Topical Requirement affect GCC audit committees?
The IIA’s new Cybersecurity Topical Requirement, effective February 5, 2026, as part of the 2024 Global Internal Audit Standards, formalises cybersecurity as a required focus area for internal audit functions. GCC audit committees overseeing internal audit should be confirming that their function’s plan includes cybersecurity coverage, that findings are reported to the committee independently of management, and that the committee has the mandate and expertise to act on those findings.
