Connect with us

Tech Features

Making Sense of Identity Threat Risks

Published

on

phishing

By David Warburton, Director, F5 Labs

The growing maturity of cloud computing, including shifts towards decentralized architectures and APIs, has highlighted the complexity of managing credentials in increasingly interconnected systems. It has also underlined the importance of managing non-human entities like servers, cloud workloads, third-party services, and mobile devices.

F5 Labs’ 2023 Identity Theft Report defines identity as an artifact that an entity uses to identify itself to a digital system – such as a workload, a computer, or an organization. Examples of digital identities include username/password pairs and other personally identifiable information or cryptographic artifacts such as digital certificates.

Digital identities cannot stand on their own. They require a system to accept and validate them. In other words, for a digital identity to function there must be at least two parties involved: an entity and an identity provider (IdP) that are responsible for issuing and vetting digital identities. However, not all organizations that provide resources are IdPs—many digital services rely on third-party IdPs such as Google, Facebook, Microsoft, or Apple to vet identities.

Based on our recent analysis, the three most prominent forms of attack in the identity threat arena currently are credential stuffing, phishing, and multi-factor authentication (MFA) bypass.

Credential stuffing

Credential stuffing is an attack on digital identity in which attackers use stolen username/password combinations from one identity provider to attempt to authenticate to other identity providers for malicious purposes, such as fraud.

It is a numbers game that hinges on the fact that people reuse passwords,
but the likelihood that any single publicly compromised password will work on another single web property is still small. Making credential stuffing profitable is all about maximizing the number of attempts, which requires automation.

Phishing

Phishing is perhaps rivaled only by denial of service (DoS) attacks in being fundamentally different from other kinds of attacks. It is an attack on digital identity, to be sure, but since it usually relies on a social engineering foothold, it is even more difficult to detect or prevent than credential stuffing.

Phishing attacks have two targets: there is the end user who is in possession of a digital identity, and there is the IdP, which the attacker will abuse once they’ve gotten credentials. Depending on the motives of the attacker and the nature of the system and the data it stores, the impact of a successful phishing trip can land primarily on the user (as in the case of bank fraud), solely on the organization (as in the case of compromised employee credentials), or somewhere in the middle.

On the attacker side, phishing can range from simple, hands-off solutions for unskilled actors to custom-built frameworks including infrastructure, hosting, and code. The most hands-off setup is the Phishing-as-a-service (PhaaS) approach in which the threat actor pays to gain access to a management panel containing the stolen credentials they want, and the rest is taken care of by the “vendor.”

Dark web research indicates that the most popular subtype of phishing service is best described as phishing infrastructure development, in which aspiring attackers buy phishing platforms, infrastructure, detection evasion tools, and viable target lists, but run them on their own.

Brokering phishing traffic, or pharming, is the practice of developing infrastructure and lures for the purposes of driving phishing traffic, and then selling that traffic to other threat actors who can capitalize on the reuse of credentials and collect credentials for other purposes.

Finally, the attacker community has a niche for those who exclusively rent out hosting services for phishing.

The most important tactical development in phishing is undoubtedly the rise of reverse proxy/ man-in-the-middle phishing tools (sometimes known as real-time phishing proxies or RTPPs), the best known of which are Evilginx and Modlishka.  This is largely because it grants attackers the ability to capture most multi-factor authentication codes and replay them immediately to the target site facilitating MFA bypass but also making it less likely that the user victim will detect anything is amiss.

Multi-factor authentication (MFA) bypass

Recent years have seen attackers adopt a handful of different approaches to bypassing multi-factor authentication. The differences between these approaches are largely driven by what attackers are trying to accomplish and who they are attacking.

Nowadays, the reverse proxy approach has become the new standard for phishing technology, largely because of its ability to defeat most types of MFA.

MFA bypass tactics include:

  • Malware. In mid-2022, F5 malware researchers published an analysis of a new strain of Android malware named MaliBot. While it primarily targeted online banking customers in Spain and Italy when it was first discovered, it had a wide range of capabilities, including the ability to create overlays for web pages to harvest credentials, collect codes from Google’s Authenticator app, capture other MFA codes including SMS single-use codes, and steal cookies.
  • Social engineering. There are several variations of social engineering for bypassing MFA. Some target the owner of the identity, and some target telecommunications companies to take control of phone accounts.
  • Social Engineering for MFA Code—Automated. These are attacks in which attackers make use of “robocallers” to make phone calls to the target, emulating an identity provider and asking the victim for an MFA code or one-time password (OTP).
  • Social engineering for MFA code—Human. This is the same as the above approach except that the phone calls come from humans and not an automated system.
  • SIM swaps. In this kind of attack, a threat actor obtains a SIM card for a mobile account that they want to compromise, allowing them to assume control of the victim’s phone number, allowing them to collect OTPs sent over SMS. There are several variations of this approach.

So, what does it all mean?

Identity threats are constant and continuous. Whereas a vulnerability represents unexpected and undesirable functionality, attacks on identity represent systems working exactly as designed. They are therefore “unpatchable” not only because we can’t shut users out, but because there isn’t anything technically broken.

This brings us back to the question of what digital identity really is. To go from real, human identity to digital identity, some abstraction is inevitable (by which we mean that none of us is reducible to our username-password pairs). We often teach about this abstraction in security by breaking it down to “something we know, something we have, and something we are.” It is this abstraction between the entity and the digital identity that attackers are exploiting, and this is the fundamental basis of identity risk.

By thinking about digital identities in this way, what we are really saying is that they are
a strategic threat on par with, but fundamentally different from, vulnerability management. With nothing to patch, each malicious request needs to be dealt with individually, as it were. If modern vulnerability management is all about prioritization, modern identity risk management is essentially all about the ability to detect bots and differentiate them from real human users. The next logical step is quantifying the error rate of detecting these attacker-controlled bots. This is the basis on which we can begin to manage the risk of
the “unpatchables.”

Tech Features

THE RISE OF THE AUTONOMOUS ECONOMY: A 2025 RETROSPECTIVE FROM THE MIDDLE EAST

Published

on

Kayvan Karim, Assistant Professor at School of Mathematical and Computer Sciences, Heriot-Watt University Dubai

The year 2025 will likely be remembered as the moment the global economy stopped simply automating tasks and started handing over the keys to autonomous agents. For decades, the promise of automation was simple: machines doing repetitive work faster than humans. But the last twelve months have ushered in a fundamental paradigm shift. We have moved from the era of static scripts to the age of “Agentic AI”, systems that don’t just follow orders but perceive, reason, and act to achieve complex goals.

In their 2025 Technology Trends report, Accenture’s analysts have termed the explosion of these capabilities as “The Binary Big Bang”. As generative AI becomes central to enterprise technology, the cost of development has plummeted, leading to a proliferation of new systems where digital agents act autonomously. These systems have given rise to Agentic AI, which acts as a proactive partner rather than a passive interface. These agents are now capable of “Superagency,” a collaboration architecture that orchestrates multi-agent systems to handle complex workflows that require specialised knowledge across different domains.

This shift is nowhere more palpable than in the Middle East. From the giga-projects of Saudi Arabia to the smart logistics hubs of Dubai, the region is leveraging this technological inflection point to decouple its economic future from hydrocarbons and rebuild it on a foundation of silicon and code.

The Economics of Intelligence

The catalyst for this revolution is a dramatic collapse in the cost of cognitive labour. When examining the economics of intelligence, Stanford University reported in its 2025 AI Index Report that the catalyst for this explosion in autonomy is the radical democratisation of computing power. Between late 2022 and late 2024, the inference cost for a system performing at the level of GPT-3.5 dropped over 280-fold. This trend accelerated through 2025, with hardware costs declining by approximately 30% annually and energy efficiency improving by 40% each year.

These economic shifts have lowered the barriers to entry, moving advanced AI from the realm of massive research labs to the operational budgets of mid-sized enterprises. As Menlo Ventures noted in their mid-year update, enterprise spending on model APIs more than doubled to $8.4 billion in the first half of 2025 alone, signalling a decisive shift from experimental “training” budgets to production-grade “inference” budgets.

The Middle East’s Sovereign Pivot

In the Gulf Cooperation Council (GCC), this technological wave is being ridden with strategic intent. The region is not content to merely import Western or Eastern models; it is building its own “Sovereign AI.”

In the UAE, the Technology Innovation Institute (TII) has continued to push boundaries with its Falcon series. As highlighted by ITU in 2025, the Falcon LLM has evolved into a multi-modal framework capable of processing vision and audio, enabling it to interpret complex documents and charts locally without data leaving the country. Similarly, G42’s Inception has solidified Jais’s position as the world’s premier Arabic-centric model. By integrating Jais into the Microsoft Azure Model Catalogue, they have provided generative AI access to over 400 million Arabic speakers, ensuring that the nuances of the region’s language and culture are preserved in the digital age.

Saudi Arabia has matched this ambition with the launch of Humain, a PIF-backed AI champion. According to Reuters reports from late 2025, Humain is not only building massive data centre capacity but is also developing a voice-first operating system designed to replace traditional icon-based interfaces. This aligns with the Kingdom’s broader Vision 2030 goals, where AI is expected to contribute over $135 billion to the economy.

From Automation to Autonomy in Industry

The distinction between “automation” (following rules) and “autonomy” (making decisions) is best illustrated in the region’s critical infrastructure.

In the energy sector, Saudi Aramco and Yokogawa achieved a historic milestone at the Fadhili Gas Plant. As reported by Oilfield Technology, they successfully deployed autonomous control AI agents that utilise reinforcement learning to optimise the Acid Gas Removal unit actively. Unlike traditional systems, these agents adapt to changing environmental conditions without human intervention, reducing chemical and steam consumption by up to 15%.

Similarly, ADNOC partnered with G42 and Microsoft to launch “EnergyAI.” This agentic system automates complex tasks such as seismic analysis and geological modelling, compressing workflows that used to take months into mere days.

In logistics, the shift is physical. DP World has revolutionised container handling at Jebel Ali with the BoxBay system. As described by Marine Insight, this high-bay storage technology stacks containers up to 11 tiers high in a steel rack, allowing fully automated cranes to access any container without having to reshuffle others. This change increases terminal capacity by 300% and creates a safer, more efficient operating environment.

The GenAI Divide: Enterprises vs. SMEs

While giants like Aramco and DP World forge ahead, the picture for Small and Medium Enterprises (SMEs) is more complex. Project NANDA’s 2025 research highlights a “GenAI Divide,” revealing that while 95% of organisations are investing in AI, only 5% are extracting significant value.

For SMEs, the barriers are talent and infrastructure. However, the rise of Low-Code/No-Code platforms is providing a bridge. As reported by Gulf News, Zoho has seen 50% growth in the region, driven by businesses modernising legacy systems without the need for expensive engineering teams.

To further support this sector, the Saudi SME Bank launched Phase II of its Agency Model in 2025. By partnering with crowdfunding platforms like Manafa and Lendo, they have allocated SAR 240 million specifically to finance SME growth and digital transformation.

The Future of Work: A Divergent Path

The impact on the job market is profound. The World Economic Forum’s “Future of Jobs 2025” report predicts a divergent effect: while routine roles in administration and manual labour are declining, demand for AI and big data specialists is surging.

In the GCC, this dynamic intersects with nationalisation agendas. Governments are using AI to solve the skills mismatch. The Massar Al Ghurair platform, launched in the UAE in 2025, uses AI algorithms to match Emirati youth with career paths and upskilling opportunities. By automating career counselling and recruitment, the region aims to replace low-skilled expatriate labour with high-skilled local talent.

Looking Ahead to 2026

As we look toward 2026, the focus will shift from adoption to governance and integration. Gartner forecasts that IT spending in the MENA region will reach $169 billion in 2026, an 8.9% increase mainly driven by AI infrastructure.

We can expect the realisation of “Cognitive Cities.” In Saudi Arabia, NEOM is moving from earthworks to deploying a cognitive operating system that predicts resident needs. Meanwhile, Dubai’s Cashless Strategy aims to have 90% of all transactions be digital by 2026, creating a data-rich environment for further autonomous innovation.

The year 2025 was the year the machines started to think. The year 2026 will be the year we learn to live and work alongside them.

Continue Reading

Tech Features

Why 92% of People Never Achieve Their Dreams — And How AI Can Help Change That

Published

on

Why So Many Companies Fail, Even with Massive AI Investments


Artificial intelligence is emerging as an unexpected ally in one of humanity’s oldest struggles: turning dreams into reality. After years spent working with thousands of entrepreneurs, corporates, startups, and students, individuals standing at every possible crossroad of ambition, uncertainty, and reinvention, a pattern has surfaced with striking consistency. Most people are not held back by the size of their dreams. They are held back by the psychological distance between who they are today and who they hope to become. AI, with its growing ability to illuminate patterns, reduce overwhelm, and bring the future self-closer, is beginning to reshape this fundamental human challenge.

Across conversations in boardrooms, incubators, classrooms and quiet mentoring sessions, this distance appears in countless forms. A bright student maps out a compelling future but loses momentum within days. A corporate leader imagines a more meaningful life but finds the path too overwhelming. An entrepreneur gains clarity but cannot sustain action long enough to see results. Ambition is abundant. Follow through remains elusive.

Sajith Ansar,
Founder and CEO, Unlimits

The research behind this is both revealing and deeply human. Studies from UCLA, Stanford and other behavioral laboratories demonstrate that individuals act more consistently when they feel emotionally connected to their future self. Yet most people experience that version of themselves not as an extension of who they are, but as a stranger, someone they hope to meet one day but rarely feel responsible for today. As behavioral economists often explain, we don’t make sacrifices for strangers. And so the dream, however sincere, slips into the long grass of “someday. “This explains why nearly 92% of people fail to achieve the goals they set each year. Dreams are not the problem. The disconnect is.

People blame discipline or lack of motivation, but the truth is simpler. The human mind is wired to favor the familiar. The comfort zone, often demonised, is really just biology ­trying to protect us from the uncertain. Yet underneath those instincts lies an innate desire for growth, a longing to expand, to evolve, to become the person one senses they could be.

For years, the missing ingredient was structural support. A vision, no matter how inspiring, cannot survive without a scaffold. People needed a way to break overwhelming goals into manageable steps. They needed reflection, accountability, and a rhythm that kept intention alive long enough for identity to shift. Most never had access to that level of support. This is where AI has quietly begun altering the landscape of human development.

In recent global surveys, nearly 40% of people expressed willingness to use AI for emotional clarity, self-reflection, and goal-setting. The World Health Organization launched pilot programmes using conversational AI to support mental wellness in regions with limited resources. Early research across Stanford and MIT shows that AI-assisted coaching improves consistency, habit adherence, and long-term follow through. The reason is not complicated. AI offers something the human mind struggles to maintain: clarity without fatigue.

It notices emotional cycles, the midweek dip, the avoidance that follows stressful meetings, the patterns that appear but go unrecognised. It highlights the small behaviours that shape larger outcomes. It breaks down a daunting dream into a sequence of steps simple enough to act on. And it does this with presence, available at the precise moment a person needs support, rather than during a weekly appointment.

What emerges is a new kind of ecosystem. The integration of AI into mobile technology has made tools for self-improvement astonishingly accessible. Personalised guidance, once available only to those who could afford coaching or therapy, now exists in people’s pockets. It is immediate, responsive, and deeply personal. This accessibility represents the democratisation of personal transformation, a shift as meaningful as AI’s impact on coding, business building, or creative work.

Yet AI alone is not the solution. Its impact is most profound when it works alongside the wisdom of coaching, the emotional insight of reflection, and a clear vision of one’s future self. When these elements converge, something remarkable happens: people stop dreaming abstractly and begin acting concretely. They replace “someday” with “today.” The future stops feeling distant. Action becomes less of a battle and more of a natural extension of identity.

This convergence of psychology, coaching and intelligent technology represents one of the most significant shifts in human development in decades. It finally offers a way to bridge the space between intention and behaviour, a gap that has defeated generations of dreamers.

If most people never achieve their dreams, it is not because those dreams are unreachable. It is because the scaffolding required to turn dreams into daily behaviour has been missing.

But that is beginning to change.

With the right structure, the right clarity, and the right support, both human and technological, more people can finally walk into the future they have imagined for far too long. The promise of AI is not that it will change who we are, but that it may help us become who we were always capable of being.

Continue Reading

Tech Features

DIGITAL INFRASTRUCTURE OF THE FUTURE: GOVERNMENTS AND CORPORATIONS DOUBLE DOWN ON CLOUD, AI & CONNECTIVITY

Published

on

By Dr. Fadi Alhaddadin, Assistant Professor at School of Mathematical and Computer Sciences, Heriot-Watt University Dubai

In 2025, governments and enterprises globally made unprecedented investments in cloud data centres, artificial intelligence, and connectivity to drive growth and secure sovereignty, manage latency, and build the foundation for a new era of digital infrastructure.

In a decisive shift toward future-ready infrastructure, both governments and the private sector have invested billions into expanding cloud capacity, scaling AI, and strengthening connectivity. This year’s investments reflect a strategic convergence: countries want control, companies want capacity, and both want the low-latency, high-power compute necessary for emerging AI-driven services. According to Microsoft’s official announcement, the company committed USD 15.2 billion to expand its AI and cloud infrastructure in the United Arab Emirates, marking one of the largest digital investments in the region. Such investment highlights how global tech giants are increasingly treating the Middle East as a priority market for sovereign-like cloud architecture.

The Sovereign Cloud Race

In parallel, governments are not just buying cloud, they’re building sovereign clouds. A sovereign cloud is a cloud computing infrastructure physically located within a country’s borders, subject to its jurisdiction, and often tailored for regulated or sensitive workloads. This type of cloud helps governments and regulated industries meet data residency, security, and compliance demands. Many governments are negotiating contracts or building partnerships with hyperscale providers to deploy sovereign cloud; Microsoft has expanded its sovereign-cloud services for government agencies.  However, it is worth mentioning that building sovereign clouds is expensive, energy-intensive, and may lead to vendor lock-in if not managed with competition and resilience in mind.

These are cloud platforms designed to reside entirely within national borders, under local jurisdiction, and subject to domestic regulation. The UK announced a major national AI and cloud package in 2025 that couples public procurement reform, research grants, and cloud infrastructure deals, aligning enterprise modernization with national strategic priorities. Companies like Microsoft and Palantir have responded by tailoring their offerings. Microsoft expanded its sovereign cloud portfolio, providing government agencies with specialized contracts and pricing, while Palantir has embedded its analytics platforms into secure, regulation-aware cloud environments for defence and intelligence users.

As sovereign needs grow, hyperscale cloud providers are racing to build data centres in strategic markets. Google stated in its public briefing that it will invest €5.5 billion in Germany to expand data-centre capacity and strengthen the country’s AI and cloud infrastructure. This emphasises its commitment to AI infrastructure in Europe. At the same time, Oracle confirmed through its company announcement that it will invest USD 5 billion in the United Kingdom to expand its cloud infrastructure and support the country’s growing demand for sovereign and secure cloud services.

AWS announced that it has launched a new “Mexico (Central)” region as part of a long-term plan that includes more than USD 5 billion of investment, and that it is also building a Taipei region with three availability zones to serve customers in Taiwan locally and reduce latency. The provider’s expansion into markets like Mexico and Taiwan illustrates how providers are balancing commercial demand with sovereign or regulated-sector requirements.

The future of digital infrastructure is not only vertical but horizontal: low-latency connectivity and edge computing are just as important as data centres. Dubai, for instance, announced a major hyperscale data-centre project in conjunction with its AI ambitions, highlighting how smart cities are weaving together cloud, 5G, and datacentre capacity. Telecom operators globally also stepped-up investments in 5G deployment, edge compute nodes, and fibre networks which is critical for AI workloads that require real-time responsiveness, such as industrial automation or smart-city services.

Infrastructure alone is not enough. This year, governments also heavily invested in capacity-building: AI skilling programs, public sector procurement reform, and governance frameworks became part of the digital infrastructure agenda. According to the Stanford HAI AI Index 2025, regulatory activity surged globally, while investments in AI research and public-sector readiness spiked. Likewise, OECD guidance such as Governing with Artificial Intelligence emphasised that infrastructure must be paired with governance, procurement rules, and data-management policies to ensure trust and long-term value.

What This Means for Business and Citizens

These investments yield several major impacts:

  • For regulated sectors such as government, finance, and defence, more local cloud capacity means access to advanced compute without compromising on compliance or data residency.
  • For AI-first products, building infrastructure close to end users cuts latency and cost, making real-time and mission-critical applications more feasible.
  • For competition, the concentration of compute in a few hyperscalers raises pressing questions about vendor lock-in, resilience, and market power.
  • For national sovereignty, governments are not just consumers but active shapers of cloud infrastructure through sovereign cloud projects and public-private partnerships.

One emerging model: states acting both as customers (buying cloud) and guardians (regulating, building, and participating in infrastructure). If done right, this could deliver both cutting-edge technology and safeguard public interests. If misaligned, it risks reinforcing dependence on a small number of foreign providers.

Risks and Tensions: Who Controls the Cloud?

The scale of these infrastructure projects brings serious challenges. Building datacentres at this scale stresses energy grids and raises sustainability concerns. Meanwhile, smaller countries worry about over-reliance on foreign cloud providers and whether they’ll truly get local control. Switzerland’s example illustrates these trade-offs well: Microsoft pledged substantial investment there for AI and cloud capacity while emphasizing data-locality for sensitive sectors which is a delicate balance between growth and sovereignty.

Toward a Resilient, Equitable Digital Future

The pattern that emerged this year is clear: infrastructure, policy, and people must all evolve together. Hyperscalers are building, governments are investing, and both are increasingly thinking in terms of long-term digital sovereignty as well as economic opportunity.

If countries can align public policy with private investment especially on cloud, AI, and connectivity, they could host world-class AI platforms while preserving public governance. But the risk is real: if power remains concentrated, the dividends of this digital transformation may not be as widely shared.

Continue Reading

Trending

Copyright © 2023 | The Integrator