Cover Story
Active Resistance Against Cyberattacks Through Robust Solutions and Best Practices
The cover story helps readers understand the trend of cyberattacks, the impact of breaches, required strategies, and the need to inculcate best practices to create active resistance against cyberattacks.
Cybersecurity is one of the most often used terminologies in almost all industries in the context of rising cyber threats, including the exploitation of software vulnerabilities, ransomware attacks, and malicious intrusions in enterprise networks. While digital transformation and cloud business are taken to a new level, the “zero trust” approach becomes a widely appreciated strategy from small and medium-sized enterprises (SMEs) to large corporates.
The time is crucial for cybersecurity professionals and services providers as intruders simultaneously exploit vulnerabilities in software or network systems and make use of the latest technologies to hijack. Reports suggest that office suits, IoT devices, and other communication agents in the enterprise networks are repeatedly found vulnerable when it comes to resisting breaches. Apart from that, the use of AI-powered cyberattacks also became common practice.
Most of the cyberattacks, such as ransomware and malware attacks, are motivated by financial interests. Such attacks are designated to steal personally identifiable information (PII), Social Security information, and credit card details from servers. The stolen information is generally gets sold in underground digital marketplaces. But then, attacks happened on government enterprises and utility service networks are contemplated the political and diplomatic interests.
Protection of Critical Systems from Cyberattack
Cybersecurity is the practice of protecting IT and network systems from potential cyberattacks; it guards data and sensitive information also from digital attacks. Today, an enterprise requires to install multiple agents in its IT system and educate its workforce to combat breaches that originate outside the organization.
Cyberattacks at an enterprise not only cause loss of trust in partners but also bring a bad reputation in the industry especially if the breach is specific to personally identifiable information (PII) of customers. Therefore, enterprises have no choice but to stay upfront in protecting their critical systems.
The average cost of a data breach was USD 3.86 million globally in 2020. The cost includes:
- Expenses of discovering and responding to the breach
- Downtime
- Revenue
- Reputational damage
Most Known Cyber Threats
Even though enterprises and cybersecurity professions establish strong measures against outside breaches, attackers find ways to exploit in-house weaknesses focusing on remote access tools, work-from-anywhere environments, etc.
The following are some of the known cyberattacks:
Malware
They are malicious software variants, such as viruses, worms, Trojans, and spyware and they can be mostly detected using antivirus tools. However, malware presence in the computer can give unauthorized access to systems.
Ransomware
This is a type of malware that locks down files or data and threatens to erase or destroy the data unless a ransom is paid to the cybercriminals who designated the attack. Recently, ransomware attacks have targeted state and local governments across the world.
Phishing/Social Engineering
Phishing scams often take place through emails or text messages that appear to be sent by a legitimate company asking for sensitive information, such as credit card data or login information. Studies find a surge in pandemic-related phishing, tied to remote work.
Distributed Denial-of-Service (DDoS) Attacks
DDoS attacks try to crash a server, network, or website by overloading it with traffic – most often from multiple coordinated systems. DDoS attacks overwhelm enterprise networks through the simple network management protocol (SNMP), used for modems, printers, switches, routers, servers, etc.
Advanced Persistent Threats (APTs)
An intruder or group of intruders infiltrate a system and remain undetected for an extended period. The intruder leaves networks and systems intact so that the intruder can spy on business activity and steal sensitive data while avoiding the activation of defensive countermeasures.
Enforcement of Security
The network and IT systems can be safeguarded by several layers of security. For that enterprises need a well-thought-out strategy, including robust applications, foolproof network systems, and end-user education. Such efforts can keep intruders away from accessing, stealing, or destroying data.
Alain Penel, Regional Vice President – Middle East, Fortinet, rightly pointed out, “To fight today’s evolving threats, organizations should look into a security platform based on a cybersecurity mesh architecture with security solutions that are designed to work together. A cybersecurity mesh architecture integrates security controls into, and across, widely distributed networks and assets.”
He added, “organizations need to develop a security-driven networking strategy that tightly integrates an organization’s network infrastructure and security architecture, enabling the network to scale and change without compromising security operations.”
The following are some of the areas that need a high level of attention subjected to cybersecurity.
Security for Critical Infrastructures: Critical infrastructures handle data related to national security, public health, and the safety of citizens. Not only credible systems but also concrete measures need to be enforced to protect such information.
Network Security: Both wired and wireless (Wi-Fi) connections have to be protected and ensure no intrusions in them.
Application Security: Enterprises should enforce relevant activities to protect applications whether they function on-premise or in the cloud. Security should be built into these at the design stage, with considerations for how data is handled, user authentication, etc.
Cloud and Storage Security: Cloud service providers offer encryption of data on rest (in storage), in motion, and use. In case, an enterprise protects data within its premise need to be on constant alert.
Information Security: Data protection measures, i.e., GDPR, secure your most sensitive data from unauthorized access.
Disaster Recovery: Several cloud service providers offer disaster recovery services to enterprise customers. In case of unplanned events, natural disasters, power outages, or cybersecurity incidents, they can help businesses to recover data in its original form.
End-User Education: Building security awareness across the organization to strengthen endpoint security. For example, users can be trained to delete suspicious email attachments, avoid using unknown devices, click suspicious links, etc.
“Digital immunity and data protection will become the key pillar of growth, trust, and customer retention for businesses, and they will need to efficiently and seamlessly manage an ever-increasing threat profile and attack canvas,” opined Saket Modi, Co-founder & CEO of Safe Security.
Best Practices
“Zero trust” security strategy: Zero trust strategy assumes compromise and sets up controls to validate every user, device, and connection into the business for authenticity and purpose. Organizations can combine security information to enforce validation controls.
Behavior detection: Advanced detection methods such as user behavior analytics and artificial intelligence (AI) need to be imposed in enterprise environments to confront potential intrusions.
Conclusion
Cybersecurity can be enabled with a proper strategy that needs the support of the right kind of solutions and awareness among the staff members of an organization. Let’s conclude the story attributing to the words of Emad Haffar, Head of Technical Experts, Kaspersky, “Deploy advanced cybersecurity controls to enable the discovery of sophisticated and unknown threats, facilitate investigations and allow timely remediation and response; such tools are anti-APT and EDR solutions among others. In addition, provide staff with basic cybersecurity hygiene training, as many targeted attacks start with phishing or other social engineering techniques.”
Automotive
Chinese Cars Are Reshaping the GCC Market, but Resale Value Could Be the Next Battleground
The GCC automotive market is undergoing a significant transformation. Chinese manufacturers are expanding their presence, established brands are navigating supply chain disruptions, and consumers are reassessing the economics of vehicle ownership.

At Keyloop Fusion Live Dubai, Srijith KN, spoke with Nour Abu-Safe, Head of Insights & Analytics at AutoData Middle East, about the changing competitive landscape, the impact of regional logistics challenges, and the opportunities emerging for automotive retailers.
Drawing on market intelligence, vehicle valuation data and industry research, she explains why technology alone may not guarantee long-term customer loyalty, why hybrids currently offer stronger residual value, and why the next major opportunity for dealerships could lie in pre-owned Chinese SUVs.
How are disruptions around the Strait of Hormuz affecting established automotive brands, and could the market changes become permanent?
Initially, many believed the disruption would be temporary. However, the data is beginning to show that market conditions are solidifying and businesses are adapting.
Traditional manufacturers, particularly Japanese brands such as Toyota, Nissan and Lexus, are experiencing challenges getting inventory into the region.
Chinese manufacturers have been more agile because several operate their own vehicle carrier fleets and logistics networks. This has allowed them to establish alternative routes into the GCC.
We have seen a 90% reduction in Japanese vehicle imports into the region, linked to the disruption around the Strait of Hormuz.
Alternative routes through ports outside the Gulf and via the Red Sea and Saudi Arabia are increasingly being used. However, these arrangements are creating delays, with vehicles now taking approximately six to eight weeks to reach showrooms.
The important development is that the market is adapting. Some of the alternative logistics routes established during this period could remain in use for years to come.
Are Chinese automotive brands attracting an entirely new generation of buyers, or are they winning customers away from established manufacturers?
It is a combination of both.
Younger consumers, particularly those between 19 and 30, are increasingly attracted to Chinese vehicles because of their styling, advanced technology, competitive pricing and safety features.
For younger families, especially those entering parenthood, these features can be important purchasing considerations.
Chinese vehicles also tend to offer attractive warranty and servicing packages, making them appealing to consumers who want to reduce their overall ownership costs.
Older buyers, particularly those in their 40s and 50s, generally demonstrate stronger loyalty towards established manufacturers and premium brands.
However, Chinese manufacturers are increasingly entering the premium segment as well, and we are beginning to see them capture some of that market share.
These demographic observations are also supported by consumer research, including studies published by YouGov, which we reference in our market analysis.
Chinese vehicles are becoming increasingly sophisticated. But can manufacturers sustain customer loyalty when technology evolves so quickly?
This is one of the most interesting challenges facing Chinese manufacturers.
Advanced technology is a powerful selling point. It looks attractive in marketing materials and helps manufacturers differentiate their vehicles.
However, rapid technological advancement also accelerates depreciation.
When a manufacturer introduces a significantly improved model within a short period, previous model-year vehicles can quickly appear outdated. That creates challenges for residual values and the used-car market.
For dealerships, the opportunity is to identify vehicles that offer a balance between modern technology and proven, practical features.
Hybrid vehicles are an interesting example because they combine improved efficiency with familiar internal combustion technology.
A vehicle that balances innovation with long-term usability may be better positioned to retain customers over five to ten years than one that depends primarily on the latest technology.
Chinese manufacturers are doing many things well, but the next few years will reveal how effectively they manage this challenge.
With affordability becoming increasingly important, how are vehicle financing and leasing models evolving across the GCC?
Vehicle demand remains present, and manufacturers have found ways to maintain supply despite the disruptions.
However, we could see greater pressure on consumer finances over the coming year.
That creates opportunities for financing and leasing providers.
Financing offers with zero down payment are becoming particularly relevant for buyers who may not have sufficient funds available for a substantial upfront payment.
On the leasing side, some operators are reporting demand increases of approximately 30% to 35%.
Consumers still need vehicles for everyday mobility, but some are becoming more reluctant to take on the financial commitment and risk associated with outright ownership.
Leasing offers an alternative that can address those concerns.
What is the biggest opportunity dealerships may be overlooking today that could become particularly important in 2027?
Used Chinese SUVs.
SUVs represent the largest vehicle body-type segment in the region, and the growing population of Chinese SUVs creates a significant opportunity for dealerships.
The first owner typically absorbs much of the vehicle’s depreciation during the initial two to three years. In some cases, that depreciation could be around 50%.
For dealerships, this creates an opportunity to develop certified pre-owned programmes around relatively young Chinese SUVs.
A three-year-old vehicle may still be in excellent condition and covered by its original warranty or service package.
If dealerships can price these vehicles correctly, they can attract buyers who cannot afford a brand-new SUV but still want a modern, well-equipped vehicle.
This could become an important growth segment for the automotive retail industry.
For consumers considering a vehicle purchase today, which offers the strongest proposition: petrol, hybrid, electric or a competitively priced Chinese vehicle?
There is no single answer because the decision depends on individual priorities.
However, when we compare petrol, hybrid and electric vehicles, our current data indicates that hybrids retain their value best.
They offer fuel efficiency while maintaining the familiarity and convenience of an internal combustion engine.
For buyers concerned about long-term value, that makes hybrids particularly attractive.
Chinese manufacturers, meanwhile, are becoming increasingly competitive on design, pricing and technology.
Vehicles such as the ROX 01 and Jetour G700 demonstrate how Chinese brands are entering segments traditionally dominated by established SUVs such as the Toyota Land Cruiser and Nissan Patrol.
The competitive landscape is changing considerably.
One particularly interesting insight from our latest data is that 48% of the new 2027-model vehicles arriving in the UAE are Chinese brands.
That tells us how aggressively these manufacturers are planning their product introductions, expanding supply and positioning themselves to attract both new and existing automotive customers.
The next few years will be particularly interesting as these changes reshape the balance between established manufacturers and emerging competitors.
Cover Story
The AI Learning Dilemma: Better Answers, But Better Thinkers?
As artificial intelligence becomes embedded in higher education, universities face a growing challenge: ensuring that students develop independent thinking rather than simply producing polished AI-assisted work. From rethinking assessments to preserving the value of intellectual effort, the conversation is shifting towards what Turnitin calls learning integrity.
In this interview with Amal Dimashki – Regional Director, MENAT & Pakistan, Turnitin explores how institutions can balance AI adoption with critical thinking, meaningful assessment and the development of essential learning skills.

Students are becoming increasingly comfortable prompting AI, but how can universities ensure they are still developing independent reasoning and critical thinking rather than simply producing better AI-assisted answers?
Prompting is becoming an important skill, but being able to write a sophisticated prompt is not the same as being able to think critically.
AI can be a very effective learning partner. It can help students brainstorm, explore different perspectives, challenge an argument or receive feedback on something they have written. But students still need to do the cognitive heavy lifting. If they simply prompt AI for an answer and then refine that answer until it looks better, we may improve the quality of the output without necessarily developing the student’s thinking.
This is why AI literacy needs to go beyond teaching students how to prompt. Students need to learn how to critically evaluate AI-generated content, verify information and sources, question what they are given and make their own judgments about the output. Turnitin’s guidance on responsible prompting encourages students to engage with AI iteratively and interrogate its responses rather than simply accepting what it produces.
We want students to use AI as a learning partner while remaining actively engaged in the learning process and taking ownership of the work they produce. Turnitin’s guidance to students reinforces this by encouraging them to ensure that the majority of their work remains their original thinking.
Universities therefore need to develop AI literacy alongside critical thinking and independent judgment, so that becoming better at using AI does not come at the expense of developing the skills students are there to learn.
What should a modern assessment look like if institutions want to measure a student’s actual understanding rather than just the quality of the final submitted work?
In an AI-enabled environment, assessing only the final product gives us a limited view of whether learning actually took place. A polished final submission does not necessarily tell us how the student arrived there.
This is where a process-based approach to assessment becomes increasingly important. Educators can build meaningful checkpoints into the learning journey through outlines, drafts, formative feedback, revisions and reflection. This allows them to see how the student’s thinking developed, how they responded to feedback and where they may need additional support. Turnitin’s multipart assignments, for example, are designed around structured checkpoints for guidance and reflection throughout the writing process.
At Turnitin, we refer to the broader framework behind this as learning integrity. It expands traditional academic integrity by placing greater emphasis on the integrity of the learning process and ensuring that students are doing the work necessary to learn and develop.
It brings us back to a familiar principle: “show your work.” Greater visibility into drafts, revisions and the development of ideas gives educators richer evidence of how a student approached the assignment rather than relying on a single snapshot at the end. Turnitin Clarity, for example, provides visibility into how students develop their work from ideation through to final submission.
This does not mean making every assessment more complicated. It means designing assessment around the learning objective and creating opportunities for students to demonstrate that they have developed the skills being assessed.
The final submission will continue to matter, but it can be considered alongside evidence of the learning process that produced it.
AI makes it possible to get answers, summaries and explanations almost instantly. Do you worry that this could reduce students’ ability to sustain attention, read deeply and work through difficult material without immediate assistance?
There is certainly a risk, and students themselves recognise it. Turnitin’s research found that 64% of students are concerned that the use of AI in education may be shortcutting their learning.
Learning should not become a completely frictionless process. Researching a subject, developing a point of view, articulating ideas with evidence, editing and working through something difficult all require effort, and some of that effort is where learning happens.
Turnitin refers to this through the concept of “productive struggle.” Cognitive growth and long-term retention require students to engage with difficulty rather than having every challenge immediately removed for them.
That does not mean students should struggle without support. AI can provide guidance and feedback throughout the learning process. Turnitin Clarity’s AI Assistant, for example, is designed to prompt reflection and support students throughout their writing without generating the full response for them.
As AI becomes more capable, preserving productive struggle will become increasingly important. We want students to benefit from the support AI can provide without removing the effort involved in developing knowledge and skills.
4. Looking ahead, how do you see the role of academic integrity evolving as AI becomes embedded in writing, research and learning, and what will universities need to change over the next few years?
Academic integrity will remain fundamental, but its role is expanding as AI becomes embedded in learning.
At Turnitin, we describe this evolution through learning integrity, a proactive expansion of traditional academic integrity that places greater emphasis on the integrity of the learning process. It reflects the need to understand how students are developing their work and ensure they are developing the skills their education is intended to build.
Over the next few years, universities will need to translate this into practice. AI governance needs to provide educators with clear guidance, while recognising that responsible AI use will not look the same across every subject or assessment. Turnitin’s learning integrity framework recognises a spectrum ranging from no AI in some contexts to defined AI use cases and more open use in others.
Educators will also need greater agency over how AI is introduced into teaching and assessment. Turnitin’s latest Learning Integrity Insights found that AI decision-making is moving closer to faculty and teaching and learning leaders, while educators are asking for education-specific AI that is flexible enough to reflect how they actually teach and design assignments.
Technology therefore needs to adapt to pedagogy, rather than pedagogy adapting to the technology. This is the principle behind Turnitin Clarity’s configurable AI settings, which allow educators to determine the level and type of AI support appropriate for an individual assignment.
Over the next few years, universities will need to bring these pieces together: clear AI governance, greater educator agency, assessment practices that support learning integrity, and technology designed around the needs of teaching and learning.
Cover Story
Saudi Arabia’s tax amnesty is entering its final months
What could follow the December deadline is an assessment cycle, not a filing cycle.
By Manish Bansal, Associate Partner, Dhruva Advisors, A Ryan Affiliate, Saudi Arabia
For most of the past five years, inter-alia, one of the major topics of tax conversation in Saudi boardrooms has been e-invoicing. Are we on the Fatoora platform? Which wave are we in? Has the ERP been configured or do we go with a third-party e-invoicing solution? Will we make the deadline?
Those were the right questions for the period we have just left. They are not necessarily the right questions for the period we are entering.

On 29 June 2026, the Zakat, Tax and Customs Authority (“ZATCA”), acting on a decision of the Minister of Finance, extended the Cancellation of Fines and Exemption of Financial Penalties initiative for a further six months, running from 1 July to 31 December 2026. It covers excise tax, value added tax, real estate transaction tax, withholding tax and corporate income tax. That much has been widely reported.
Less widely noticed is a condition set out in the accompanying guideline. If the Authority extends the initiative again past December, that further extension will not reach returns that fell due after 30 June 2026.
The Authority has not simply granted more time. It has informed the market, in advance, where the relief eventually stops. Whatever is announced in December, the clean-up window for historical positions is being drawn shut. For a tax administration, that is about as clear a statement as one can give.
What the regulator already sees
The reason this matters now, rather than in some indeterminate future, is that the Authority’s information position has changed fundamentally.
Wave 24 of the e-invoicing Integration Phase closed on 30 June 2026. Announced in September 2025, it captured every taxpayer whose VAT-subject revenues exceeded SAR 375,000 in 2022, 2023 or 2024. That figure is not arbitrary: it is the mandatory VAT registration threshold. In effect, the wave brought the entire registered population into scope.
And the direction has not stopped there. On 24 July 2026 – ZATCA published the criteria for Wave 25, halving the threshold to SAR 187,500 of VAT-subject revenue in 2022, 2023, 2024 or 2025, with integration required by 1 February 2027.
Under the Integration Phase, standard business-to-business invoices are cleared by ZATCA before they reach the buyer, and simplified business-to-consumer invoices are reported within twenty-four hours. Invoices must be issued in a prescribed structured format, carrying a cryptographic stamp and a unique identifier.
The Authority is therefore no longer reliant on what appears in a filed return. It holds the underlying transactional record, in structured form, close to real time, across the whole economy.
This is the shift most finance functions have not yet absorbed. For years, the Saudi assessment process began with an information request. In an environment of structured, near-live data, it begins instead with an anomaly the system has already identified. The taxpayer’s first substantive contact with the process is not a request for documents. It is a proposition to be answered.
Key exposure areas to be mindful of
In our experience, the following key areas could be more visible and exposed to assessment risk in the Kingdom once transactional data can be cross matched against declarations.
The first is permanent establishment risk arising from project delivery. Groups routinely deploy technical staff, secondees and subcontracted specialists into Saudi projects while treating the arrangement as an offshore supply. Given that most KSA government portals are inter-linked, careful monitoring of in-Kingdom presence is critical, in particular, employees of non-resident companies undertaking fly-in/fly-out assignments in the Kingdom. It is worth noting that the current tax law has no de minimis threshold for the creation of a permanent establishment. Accordingly, even a single day of presence in the Kingdom could potentially give rise to a permanent establishment, although in practice, the ZATCA may apply a more facts-based approach when assessing whether a permanent establishment exists.
Second is related-party pricing, and here a change that took effect two years ago is still under-appreciated. Following amendments to the Transfer Pricing By-Laws, the transfer pricing provisions apply to zakat payers as well as taxpayers for financial years beginning on or after 1 January 2024, and Advance Pricing Agreements became available to both. For a Saudi family group with decades of intercompany arrangements built for operational convenience rather than for documentation, this is a material change in obligation, and one that many such groups have not yet worked through.
Lastly, needless to state that VAT audits are likely to get much more sophisticated with real time data and the data analytics and AI tools available.
What the amnesty covers, and what it does not
Many companies are counting on this window. It is worth being precise about what it covers.
The initiative covers late registration, late payment and late filing fines, penalties on the amendment or correction of a VAT return, and other financial fines imposed under Article 45 of the VAT Law, including field detection and e-invoicing violations. To benefit, a taxpayer must register where registration is required, submit the outstanding returns, and either pay the amounts due or obtain ZATCA’s approval for an instalment plan.
Two limits deserve emphasis. The initiative does not extend to penalties relating to tax evasion violations. And it operates on fines for returns falling due up to 30 June 2026.
There is also a point that no guideline states because it does not need to. The initiative waives penalties. It does not validate a technical position. A voluntary disclosure that corrects an arithmetic omission is a straightforward matter. A voluntary disclosure that reveals a contestable tax treatment is a different exercise entirely, because it puts a position on the record that will be read. The analysis must come before the filing, not after it.
Fewer than four months
For most groups, what remains to be done before 31 December is a short list. It is also, notably, not a systems exercise. The e-invoicing platforms are already built and connected. The work now is reviewing the positions those systems have been reporting all along.
Reconcile first. Take VAT/ Tax/ Zakat returns, customs declarations, withholding tax filings and audited financial statements for the open years and reconcile them against one another before ZATCA’s systems do it. Where the numbers do not tie, understand why, and document the reason contemporaneously rather than reconstructing it under assessment.
Then sort. Separate the genuine errors, which the current window is designed to resolve, from the judgement positions, which need to be assessed on their merits and defended with evidence that pre-dates the query.
Finally, treat documentation as a deliverable with a deadline. Substantiation assembled after an assessment notice arrives carries markedly less weight than substantiation prepared when the transaction occurred.
A regulator that publishes wave criteria six months ahead, that notifies taxpayers directly, that issues guidance with worked examples, and that tells the market in advance where relief will end, is behaving like the administration of a mature investment destination. That predictability is an asset for serious businesses, and it is what long-term capital looks for.
But predictability runs in both directions. The Kingdom has been clear about what it expects and when. The businesses that will move through the coming assessment cycle with least disruption are those that use the next few months to answer the questions before they are asked.
Disclaimer: This article is intended for general information only and does not constitute tax, legal, accounting or other professional advice. It reflects the tax rules in force as of the publication date, and the described regulatory landscape continues to develop. Readers should obtain professional advice appropriate to their own facts and circumstances before acting on any matter discussed.
-
Trending1 year agoOPPO A6 Pro 5G Review: Reliable Daily Driver
-
Tech News2 years agoDenodo Bolsters Executive Team by Hiring Christophe Culine as its Chief Revenue Officer
-
VAR2 years agoMicrosoft Launches New Surface Copilot+ PCs for Business
-
Automotive2 years agoAGMC Launches the RIDDARA RD6 High Performance Fully Electric 4×4 Pickup
-
Tech Interviews3 years ago
Navigating the Cybersecurity Landscape in Hybrid Work Environments
-
Hospitality2 years agoGulfood 2025 30th Edition Kicks Off Today, Setting New Benchmarks in F&B Growth and Innovation
-
VAR11 months agoHuawei Nova 14 Pro Review: Where Camera Excellence Meets Ecosystem Evolution
-
Tech News1 year agoNothing Launches flagship Nothing Phone (3) and Headphone (1) in theme with the Iconic Museum of the Future in Dubai


