Exclusive interview with Premchand Kurup, CEO, Paramount

Which emerging cyber risks are most likely to influence or reshape GCC banking regulations in the coming years?

We live in an era where nearly every banking service depends on advanced digital infrastructure, and cybercriminals are aware of it. With the emergence of AI, the risks have evolved even further, enabling attacks that can adapt and operate at an unprecedented scale. Over the period of 2024–2026, GCC banking regulations in the region are being influenced by the convergence of advanced ransomware, API-driven open banking risks and AI-enabled cyber threats.

Firstly, targeted ransomware and data extortion attacks against banks and fintechs in the Gulf region have evolved from isolated incidents into a persistent and systemic risk. Financial institutions in the UAE and across the GCC region have experienced a noticeable rise in incidents and malware activity through 2024 and into 2025 by nearly 100%, and this is specific to Paramount. . In response, regulators are tightening requirements for incident reporting timelines, operational resilience testing and recovery capabilities within central banks and national cybersecurity frameworks, with these requirements expected to become more stringent in 2026.

Secondly, the rapid expansion of open banking and digital transformation initiatives has made API security and cloud exposure critical regulatory concerns. Misconfigured cloud environments, weak API authentication, and complex third-party integrations are creating new attack surfaces that traditional perimeter-based security models cannot adequately protect. As a result, regulators in the UAE, Saudi Arabia, and other GCC countries are strengthening supervisory expectations around identity management, data protection and third-party risk management within banking regulations.

Additionally, the rise of AI-driven fraud and AI-assisted cyberattacks is reshaping how supervisors view the intersection of model risks and cyber risks. AI is being increasingly used to support credit assessment, KYC and fraud detection, while also being leveraged by attackers to scale phishing, social engineering and evasion techniques. This dual-use nature of AI is prompting regulators to develop guidance on AI governance, explainability and enhanced monitoring of AI-enabled processes in the financial sector.

What is one underrated cybersecurity innovation today that you believe will become critical for the Middle East’s BFSI sector over the next few years?

One of the most underrated cybersecurity innovations today, and yet one that is likely to become critical for the Middle East’s banking, financial services and insurance (BFSI) sector over the next few years, is behaviour-based analytics, which has become deeply integrated into security operations centre (SOC) functions and fraud detection systems. Numerous financial institutions still rely heavily on static, rule-based systems that trigger alerts based on fixed thresholds or known attack signatures. While effective against traditional threats, these approaches struggle to detect modern attacks that rely on lateral movement, living off the land (LOTL) techniques and sophisticated social engineering.

In contrast, behaviour-driven analytics establishs dynamic baselines for users, devices, applications and APIs. It continuously monitors the way accounts are accessed, transactions are executed and systems communicate, enabling early detection of anomalies that signal potential fraud or intrusion. These capabilities closely mirror the patterns observed in recent high-impact attacks on banks and fintechs across the region. For GCC banks navigating rapid cloud adoption, open banking frameworks and increasing use of AI in core operations, behavioural analytics is becoming essential. It allows institutions to distinguish legitimate high-volume digital activity from subtle intrusions, as highlighted in the report titled ‘2025 Global Digital Trust Insights – Middle East findings’.

Reflecting this shift, Paramount’s advisory and SOC services in the region are increasingly promoting a transition from purely rule-driven monitoring to a blended model that combines behavioural analytics, traditional rules, and threat intelligence. This integrated approach significantly improves detection speed and reduces false positives in complex Middle Eastern financial environments.

From the Paramount SOC’s perspective, approximately how many security incidents or threats have been monitored and mitigated this year

Over the last year we have issued over 592 critical advisories and mitigated them. Critical advisories are those that have the potential to halt business operations significantly.
The year 2026 has just begun, and we have issued nearly 100 advisories already.

Apart from critical advisories we have issued regular 318 advisories this year while the number stood at 2208 last year . We have just begun the year, but the number of alerts shows an increasing trend.

What types of cyber threats are most frequently detected and addressed by the SOC?

During the fiscal year 2024–2025, the most frequently detected threats identified by Paramount’s SOC include phishing and credential theft leading to account takeover, often using highly localised and AI-generated lures. SOC teams also regularly respond to ransomware and data extortion campaigns, alongside API, web application, and DDoS attacks targeting digital banking platforms. Moreover, cloud misconfigurations and excessive access permissions remain a persistent risk, frequently identified through continuous monitoring and threat hunting.

How can C-suite leaders better prepare their organisations, and what proactive steps should banks take to stay ahead of fraud and cyber threats?

For banks across the GCC region, C-suite leaders need to treat cyber resilience as a core board-level business capability, and not simply as a technical or IT function. With cyber threats having direct implications for financial stability, reputation, and regulatory compliance, leadership should embed cyber risk into enterprise risk management frameworks and board reporting. Major threat scenarios such as prolonged digital channel outages, data extortion incidents, or systemic third-party failures should be quantified and reviewed alongside credit and liquidity risks, in line with evolving GCC regulatory expectations. Leaders should further align their cyber strategies with national cybersecurity frameworks and central bank guidance, using independent maturity assessments to identify gaps and prioritise investments through 2026.

From an operational and technology perspective, adopting a zero-trust approach across identities, devices, networks and applications is becoming essential, particularly in API-enabled and cloud-based banking environments. This should be supported by strong SOC and incident response capabilities, whether in-house or through specialised providers such as Paramount, to ensure 24/7 monitoring, rapid containment and documented playbooks for both regulators and customers. Banks also need to invest in advanced fraud analytics and behaviour-based monitoring to detect account takeover and payment fraud, particularly as AI tools make phishing and social engineering more convincing, as witnessed in recent UAE ransomware trends.

Equally important is rigorous third-party and supply chain risk management. This includes structured security due diligence and continuous monitoring of fintech partners, cloud providers and critical vendors, given the growing risk of indirect compromised paths into Gulf financial institutions. Finally, C-suite leaders should actively promote a strong cyber resilience culture. This involves running realistic simulations of ransomware, data leaks, and payment fraud scenarios to sharpen organisational readiness and showcase proactive resilience to regulators, customers and shareholders.

Given the distinct regulatory, cultural, and operational landscape of the GCC, what makes cybersecurity in the region’s BFSI sector uniquely challenging compared to the US or Europe?

Cybersecurity in the GCC region’s BFSI sector is uniquely challenging because financial institutions operate at the intersection of rapid digital transformation, high geopolitical relevance and complex, multi-layered regulation. From a regulatory standpoint, institutions in the region must comply simultaneously with national cybersecurity authorities, central banks, and in some cases, free zone regulators. These entities impose detailed requirements on controls, data protection and incident reporting, creating a more fragmented and demanding compliance landscape than in many single-jurisdiction markets. The situation is further complicated by strict data residency and data sovereignty rules, which significantly influence how banks can design and deploy cloud, analytics, and cross-border platforms.

Operationally, GCC banks are advancing quickly into digital, mobile and open banking services, often faster than ecosystem-wide security maturity. While this supports financial inclusion, it also expands the attack surface through APIs, cloud services, and fintech partnerships. At the same time, the Gulf region has become one of the most actively targeted regions for financially motivated cybercrime and disruptive attacks, with banks and fintechs featuring prominently in 2024–2025 reports on ransomware, DDoS campaigns and sophisticated fraud schemes. The combination of rapid innovation, partner security, high attacker interest and evolving regulatory expectations creates a risk profile that is distinct from more established markets in North America and Europe.

In response, Paramount’s work with GCC BFSI clients focuses on developing region-specific security architectures and systems rather than simply importing models from other geographies. This includes designing frameworks aligned with local regulatory obligations, regional threat intelligence and the operational realities of Middle Eastern institutions as they evolve through 2026.

Stake, the MENA region’s leading digital real estate investment platform, and ACE & Company, a Swiss-headquartered global investment group focused on private markets, with more than $2.0 billion in assets under management, today announced a strategic partnership to support the development of liquidity solutions for investors in Stake products. The agreement will focus initially on the platform’s real estate portfolio in the UAE, held through Prescribed Companies, the equivalent of Special Purpose Vehicles (SPVs) in DIFC.

The initiative is intended to create a more liquid, transparent, and efficient marketplace for investors seeking exposure to fractional real estate opportunities through Stake’s platform. By combining Stake’s innovative access model with ACE & Company’s longstanding experience in private market investing and secondary transactions, the partnership aims to strengthen the investment ecosystem around fractional ownership structures in the UAE.

The joint venture reflects both firms’ confidence in the long-term fundamentals of the UAE. At a time of heightened regional uncertainty, the UAE continues to distinguish itself through economic resilience, political stability, high-quality infrastructure, and sustained global investor interest. These attributes have helped position the country as one of the region’s most compelling destinations for long-term real estate capital.

Through the planned secondary infrastructure framework, investors in Stake products are expected to benefit from greater flexibility in managing their holdings, improved visibility around market pricing, and clearer pathways to liquidity. In turn, the broader market stands to benefit from enhanced stability, stronger price discovery, and increased participation and confidence in fractional real estate as an investable asset class. The framework operates within Stake’s existing DFSA-approved regulatory permissions, providing investors with established oversight and regulatory clarity. Stake is regulated by the DFSA, the independent regulator for business conducted from or within DIFC.

For Stake, the partnership marks an important step in the continued evolution of its platform, extending beyond access to ownership and toward the development of more mature market infrastructure. For ACE & Company, the collaboration draws on its extensive experience in private equity and secondaries to help unlock liquidity solutions in a fast-growing segment of the alternative investment landscape. The DIFC’s established private markets framework, and its Prescribed Company regulations in particular, have been central to enabling this model, providing the institutional and legal infrastructure on which this secondary transfer facility innovation is built.

Manar Mahmassani, Co-Founder and Co-CEO of Stake said:

“The UAE has always rewarded those who invest in it with conviction, and that’s exactly what this partnership represents. Stake was born in crisis. We launched during COVID, when global real estate markets were struggling and Dubai’s property industry was at its low point. What we saw was a market that is far from broken, but fundamentally sound, going through a temporary challenge. That conviction has never left us. Today, the world is watching the region, and we want to be unambiguous about where we stand: we are long Dubai, and we are long the UAE. This is not the moment to retreat: it’s the moment to build the institutional infrastructure this market deserves. That’s exactly what this partnership is all about – a mature, resilient market attracting institutional confidence and capital committed for the long run.”

Sherif El Halwagy, Partner and Co-Founder at ACE & Company said:

“Drawing on almost two decades of experience in offering liquidity to investors across private markets ecosystems via secondaries, we see a tremendous opportunity in real estate secondaries in the UAE. This partnership reflects our conviction in the country’s long-term fundamentals and our disciplined approach to capital deployment in high-quality assets. We look forward to further strengthening our relationships with investors and partners across the region.”

The partnership is designed to benefit all stakeholders across the ecosystem. Existing investors gain added optionality and transparency, prospective investors gain greater confidence in the structure, and the market benefits from stronger liquidity mechanisms, a scalable source of permanent/long-term capital and a more institutionalized framework for participation.

As fractional ownership continues to gain traction globally, Stake and ACE & Company believe that robust secondary infrastructure will play a critical role in supporting the sector’s long-term growth. The joint venture represents a shared commitment not only to product innovation, but also to building the underlying market architecture needed to support sustainable expansion in the UAE and beyond.

Attributed to: Fernando Fanton, Chief Product & Technology Officer, Property Finder

In the global race for digital supremacy, the conversation often centers on legacy hubs. However, for those of us operating at the intersection of high-growth technology and urban evolution, the focus has shifted. Today, Dubai is no longer just a destination to “set up” a business; it has become the definitive place to build the future of your industry.

As a company that has achieved significant scale within this ecosystem, Property Finder has had a front-row seat to a remarkable transformation. We have seen Dubai evolve from a regional leader into a resilient, future-focused global hub that offers a unique combination of speed as a strategy and resilience by design. For the international tech community, the message is clear: the structures, momentum, and insights required to turn global ambition into tangible growth are being perfected right here.

Resilience by Design

What sets Dubai apart today is its ability to turn complexity into clarity. In a world defined by market volatility, Dubai has doubled down on stability through the Dubai Economic Agenda (D33). This isn’t just a policy document; it is a roadmap that provides the international tech community with a predictable, pro-innovation regulatory framework.

At Property Finder, this environment has been a true enabler of scale. Our ability to innovate is tied directly to the sophistication of Dubai’s digital infrastructure. Whether it is the Dubai Land Department’s (DLD) open approach to rental market data or the visionary Real Estate Evolution Space (REES) initiatives for property tokenization, the government provides a transparent framework that allows us to test, iterate, and scale digital solutions with absolute confidence.

The Shift from Intuition to Intelligence

The UAE real estate market has grown significantly more complex. Our data shows that between 2022 and 2025, the number of active agents rose by 30% annually, while listings increased by 34%. Yet, simultaneously, buyer behavior became more surgical; engagement per listing dropped by 36% as users began spending less than 40 seconds per listing.

In such a fast-paced environment, “intuition” is no longer enough. This is where Dubai’s digital ecosystem shines. It empowers companies to move toward intelligence-led execution.

By leveraging millions of data points, we launched SuperAgent, MENA’s first AI-driven agent ranking platform. This tool assesses responsiveness and listing quality to highlight top performers, rewarding professionalism and guiding brokers on how to prioritize leads effectively. This level of transparency replaces guesswork with measurable insights, allowing us to stay ahead of the market rather than merely reacting to it.

Practical AI: Engineering Trust

The international tech community is currently grappling with how to move AI beyond the hype into functional utility. In Dubai, the Smart City 2030 vision provides the perfect backdrop for this. This initiative isn’t just about gadgets; it is a city-wide integration of AI into the very fabric of our buildings: driving energy efficiency, enhancing safety via smart sensors, and increasing property values through technology-driven living.

We believe that for AI to be effective, it must be grounded in real-world expertise. Our AI-driven Home Valuation feature is a prime example. While our algorithms process decades of proprietary data and live market signals in seconds, we combine that “machine intelligence” with human context to ensure the results are accurate and reliable. This is critical in a dynamic market where historical data alone can be misleading. Today, a user in Dubai can monitor a portfolio with clarity on potential returns and near-term value trends, making the real estate experience more predictive and transparent.

A Coordinated Ecosystem for Global Ambition

Scaling a high-growth tech business requires more than just good code; it requires a trusted network of stakeholders. Dubai offers an unparalleled concentration of capital and expertise, with strong relationships between tech leaders and global investors such as Mubadala, Blackstone, and Permira.

When you combine this capital with milestones like a 100% paperless government and the rapid adoption of Web3, you get an ecosystem that simplifies the administrative weight of business to empower the core mission: innovation and global expansion.

My Message to Tech Leaders

To the founders, CTOs, and innovators looking at the global map: look closely at the momentum in the Middle East. Dubai’s Digital Strategy 2030 is not about digitizing existing services; it is about reimagining what a city can be when it is built on a digital-first foundation.

The city offers the structure to protect your business and the speed to accelerate it. We have moved from a market of “potential” to a market of “proven impact.”

In a world where uncertainty is the norm, Dubai provides clarity. It brings together the key ingredients required to turn ambition into tangible outcomes: data, infrastructure, capital, and collaboration. More importantly, it aligns these elements within a cohesive strategy that prioritises innovation and resilience in equal measure.

For those seeking to lead the next wave of digital transformation, Dubai provides the most fertile ground to turn bold ambitions into a global reality.