SANS Institute, a global leader in cybersecurity training and certifications, has announced the 2026 edition of SANS Gulf Region. The event every year brings together cybersecurity professionals for an extensive program of hands-on training designed to address the Middle East’s threat landscape. Taking place from October 31 to November 26, 2026, at the Hilton Dubai Jumeirah Beach Resort, the event will feature 13 specialized courses and two NetWars tournaments. The program will cover key areas such as AI security, advanced threat detection, industrial control systems security and cyber resilience.

As Middle East enterprises advance digital transformation and adopt more AI-driven technologies, cybersecurity investment continues to grow. According to Mordor Intelligence, the regional cybersecurity market is estimated to reach USD 23.54 billion in 2026, growing at a CAGR of 14.55% through 2031. However, there are still challenges in developing the expertise needed to secure complex digital environments. PwC’s 2026 Global Digital Trust Insights: Middle East findings reveals that 53% of regional respondents identified lack of knowledge in applying AI to cyber defense as a major hurdle, highlighting the need for specialized cybersecurity training to keep pace with technological advancements.

As AI is integrated into business processes, cybersecurity expertise should go beyond traditional threat detection and response to securing AI systems themselves. For going through this shift, SANS Institute has developed the AI Security Maturity Model – Gulf Region. The framework provides a structured approach to evaluating AI security readiness, identifying gaps and prioritizing improvements across AI protection, utilization and governance. It offers a clearer path towards building stronger, more mature AI security practices, while reinforcing the need for continuous, hands-on training.

“The Middle East has seen remarkable progress in digital transformation, but the pace of adopting technologies must be matched by an equally strong investment in cybersecurity capabilities,” says Ned Baltagi, Managing Director, Middle East, Turkey and Africa at SANS Institute. “As businesses incorporate AI and interconnected systems, the challenge is ensuring that they have the specialized skills and practical experience to manage the risks that come with it. This calls for a shift from reactive skills development to continuous, forward-looking training that anticipates how threats and technologies are evolving. With SANS Gulf Region 2026, we are putting this approach into practice, focusing on the skills and real-world challenges that matter most to companies across the region.”

This year’s curriculum covers five key areas, including Cyber Defense, Offensive Operations, Industrial Control Systems, Cloud and AI Security, and Leadership. The program introduces SEC545: GenAI and LLM Application Security, a new course focused on securing generative AI applications and large language models. Also, there are major updates to LDR519: Cybersecurity Governance, Risk, and Compliance. Six courses are focusing on AI, reflecting the growing importance of understanding and managing AI-related cybersecurity risks.

Other key training areas include network monitoring and threat detection, enterprise penetration testing, security automation for red, blue and purple teams, ICS/SCADA protection, and defensible security architecture built around Zero Trust principles. Together, these courses address a broad range of technical and strategic requirements, helping to strengthen capabilities across both traditional and new cybersecurity domains.

Complementing the training program, the event will feature two NetWars Core tournaments, giving participants an interactive environment to apply their skills to simulated cybersecurity challenges. This year’s AI-forward scenarios will explore areas like prompt injection, malware reverse engineering, MFA bypass, web application security and IoT vulnerabilities. Set within a fictional organization facing compromised systems and vulnerable AI models, attendees should investigate and respond to interconnected security threats.

The event will also host a series of evening community talks. Sessions will explore cybersecurity leadership, the role of AI in learning, and modern influence operations, with contributions from SANS experts including Mark Williams and Jeff McJunkin. The courses will be available in person and through online live sessions.

Through SANS Gulf Region 2026, SANS Institute continues its commitment to strengthening cybersecurity capabilities across the region, supporting businesses in developing the technical expertise, leadership skills and practical readiness needed to protect complex digital environments.

Kayvan Karim, Programme Director of MSc Software Engineering, School of Mathematical and Computer Sciences, Heriot-Watt University Dubai 

For the past few years, the AI infrastructure race has largely been measured in scale: more GPUs, larger data centres and greater power capacity. That expansion is continuing, but the economics are beginning to change. Competitive advantage may increasingly depend not only on securing additional power, but on extracting more useful AI work from the power already available. Part of the reason is a change like AI demand. We are moving from relatively simple prompt-and-response systems towards agents that can reason across multiple steps, call tools, inspect results, revise plans and continue working autonomously. Anthropic’s latest Economic Index notes that Claude usage is increasingly shifting towards long-running agentic tasks and that more computationally intensive conversations tend to be associated with higher-value outputs.

This transition could have significant implications for infrastructure demand. A chatbot might generate one answer to one prompt. An agent performing a software-development, research or business task may invoke a model dozens of times, maintain a large context, call external tools and generate many intermediate reasoning steps before producing an outcome. Demand may therefore grow in two ways: more people using AI and more inference, model calls, and tokens processed for each task. Major AI laboratories are already working on this efficiency problem. OpenAI says one of its primary inference objectives is to serve more tokens from the same hardware, using techniques including scheduling, caching, kernel optimisation and improved model implementation. It also describes GPT-5.6 as being trained to accomplish more work per token. Google DeepMind is pursuing a similar direction: its Gemini 3.6 Flash was designed for scaled agentic workloads and uses fewer output tokens than its predecessor on several evaluations. In contrast, its recent agentic video system reduced token consumption by up to 88% for that workload.

Other approaches address efficiency at the model architecture level. DeepSeek-V3, for example, uses a Mixture-of-Experts design with 671 billion total parameters but activates 37 billion per token, so only part of the network is used for each computation. Meta has similarly worked on inference efficiency through grouped-query attention and more efficient tokenisation; the Llama 3 tokeniser was reported to require up to 15% fewer tokens than Llama 2 for equivalent text. Taken together, these approaches show that model capability is increasingly being developed alongside the cost of delivering it.

Model-level efficiency, however, is unlikely to remove the infrastructure constraint on its own. Global data-centre electricity consumption was approximately 415 TWh in 2024, according to the International Energy Agency, and its base case projects this to reach around 945 TWh by 2030. AI is expected to drive most of that growth. Efficiency is therefore improving while aggregate demand continues to rise. One reason is the Jevons, or rebound, effect: efficiency improvements reduce the resources required for each unit of work, but lower costs can also encourage greater overall use. If agents become much cheaper to operate, organisations may respond by deploying more of them, running them for longer, or applying them to tasks that were previously uneconomic. Efficiency can reduce the compute required for an individual task while still increasing total demand.

That increased demand meets infrastructure that cannot expand as quickly. Models and software can improve quickly, but grids, substations, transformers and power-generation infrastructure usually have much longer development cycles. The IEA notes that while a data centre can sometimes be developed within two or three years, the broader energy infrastructure required to support it often involves longer planning and construction periods. Where grid capacity is constrained, each available megawatt becomes a more valuable production resource. The amount of power available remains important, but so does the amount of useful computation that can be produced within that power envelope.

That changes how we should understand capacity. Improvements in accelerator performance, model architecture, workload scheduling, caching, utilisation and inference software can increase computational output without increasing a site’s electrical connection. OpenAI’s recently reported Jalapeño inference hardware illustrates the direction of travel: the company says the chip can deliver more AI work per unit of power while increasing throughput and reducing latency. Efficiency can therefore act as a form of virtual capacity. If two operators each control 100 MW, but one can consistently deliver substantially more useful AI work within that power envelope, their nominal capacity may be identical while their productive capacity is not.

The same constraint applies to physical space and cooling. AI systems are concentrating more computational power into individual racks, increasing both power density and heat output. Packing more accelerators into the same building only creates useful capacity if the electrical and thermal infrastructure can support them. This is one reason liquid cooling is moving from a specialist technology towards a more central part of AI data-centre design. Microsoft, for example, has introduced a closed-loop chip-level cooling architecture that it says eliminates evaporative water consumption for cooling and could avoid more than 125 million litres of water annually per data centre. The example also shows why power, cooling, water use and rack density cannot be treated independently.

The same shift creates a measurement problem. Power Usage Effectiveness, or PUE, has been valuable for showing how much facility energy is required beyond the electricity IT equipment consumes. It does not, however, measure whether that IT equipment is producing useful work efficiently. Uptime Institute’s 2025 survey placed average PUE at around 1.54 and noted that the headline industry figure had changed little for six years. Uptime has consequently argued for productivity measures that relate computational work to energy consumption. For AI inference, tokens per kilowatt-hour might offer one operational measure. Still, even that is incomplete: an efficient model that solves a task in 1,000 tokens may be more valuable than one generating 10,000. A more useful long-term measure may therefore be useful AI work per unit of energy, water and infrastructure.

Capacity will remain essential. The AI industry will continue to build larger data centres, secure new power supplies and deploy large quantities of computing hardware. As agentic systems create more persistent inference demand and physical resources become harder to expand, however, efficiency may increasingly determine the productive value of that capacity. Operators that can support more useful computation within the same power, cooling, water, and space constraints can accommodate more workloads without waiting for equivalent growth in physical infrastructure.

For AI infrastructure, installed megawatts will remain a headline measure. The more consequential measure may increasingly be how much useful AI work those megawatts can support.

TrendAI™, the global AI security leader and enterprise business unit of Trend Micro  Incorporated (TYO: 4704; TSE: 4704), has announced new capabilities for TrendAI Vision One™. These include the private preview of Autonomous Vulnerability Discovery and expanded support for Claude’s Compliance API, which now covers Claude Code and Cowork sessions. Together, these services help enterprises identify exploitable vulnerabilities in source code before attackers do, investigate how AI agents operate, and maintain oversight as AI adoption scales.

The need for this oversight is growing rapidly across the region. According to research conducted by The Harris Poll for Dataiku, 62% of UAE chief information officers believe their organisation have more than 50 AI agents running in production, yet only 18% have a fully unified view of agents across platforms, data environments, and business applications. At the same time, AI is accelerating both how quickly code is written and how quickly attackers can identify flaws. Security teams therefore need to keep pace with AI adoption without losing visibility into what is happening across their environments.

The new capabilities extend TrendAI Vision One™ across both software development and AI agent activity. TrendAI Vision One™ Autonomous Vulnerability Discovery is powered by AESIR, TrendAI’s agentic exploit-remediation engine, which identifies and validates vulnerabilities, including zero-days. It also verifies fixes in customer source code. The engine uses purpose-built, multi-model AI architecture that relies primarily on Anthropic models and has outperformed single-model and agentic system scores on the CyberGym Leaderboard. Every finding is validated by experts from the TrendAI™ Zero-Day Initiative™ (ZDI), the world’s largest vendor-agnostic bug bounty programme. The Autonomous Vulnerability Discovery is deployed and operated on Amazon Bedrock from Amazon Web Services (AWS), enabling the full workflow to run within the customer’s AWS environment

In parallel, the expanded Claude Compliance API integration brings Claude Code and Cowork session records from Claude Enterprise into TrendAI Vision One™.  These records include prompts, responses, and tool calls, each tied to a verified user. It enables security teams to investigate AI activity in context, correlate it with endpoint, identity, cloud and network signals, and build custom detections for relevant agent behaviour.

Commenting on the announcement, Salah Suleiman, Managing Director, South Gulf, TrendAI™, said, “AI is changing both how software is built and how work gets done across the enterprise. Code is being written faster than ever, while AI agents are increasingly able to access systems, call tools and act on behalf of users. As organisations across the UAE and the wider region scale AI at pace, their security teams need to identify vulnerabilities early while maintaining clear visibility into what AI systems are doing and whether their actions align with organisational policies. With these additions to TrendAI Vision One™, we are helping organisations move faster with AI while maintaining the context, oversight and control needed to do so securely.”

TrendAI Vision One™ also continues to ingest activity logs from Claude Enterprise, covering user logins, administrative actions and configuration changes, as well as from Claude Platform, covering administrative, system and resource events. Autonomous Vulnerability Discovery is now available in private preview to select enterprise customers running on AWS, while Claude’s Compliance API integration in TrendAI Vision One™ is available to TrendAI Vision One™ customers using Claude Enterprise.