'Zero trust policy': UAE cybersecurity experts say staff awareness could cut attacks by half

Companies need to educate, train and create awareness among staff against cyber threats because this will eliminate a significant amount of cyberattacks, industry executives said on Wednesday.

“Firms need to educate their people about cyberattacks. If all people know about cyber threats, then half of cyberattacks can be eliminated automatically. Even if it still happens, then large firms must have a rapid response team which will definitely help. You should also have a zero trust policy in place in your organisations,” said Padam Kafle, head of innovation, Aster Digital Health.

Kafle was speaking during a panel discussion at the FutureSec Summit 2024 organised by on Wednesday. Dozens of public and private sector executives attended and spoke at the one-day summit.

He noted that the first criterion of how well prepared firms are to deal with cyber threats is how quickly they can detect and recover from the cyber attack.

Jayakumar Mohanachandran, group chief information officer, Buzeki Enterprises, said human is the weakest link in the organisation, but companies can turn them strongest by raising awareness and training.

“But it is ignored by many organisations and the importance of this is very high in the age of artificial intelligence (AI). You can bring a lot of simulation and training with the help of AI itself. If firms integrate cybersecurity into everything, they will rarely miss training and awareness. It should be comprehensive and you make sure that all employees go through it. It is not just junior staff who might have clicked on phishing email, it can go up to senior level also,” he said.

Mohanachandran elaborated that some firms hide cyberattacks fearing damage to brand reputation. However, he stressed collaboration and awareness among industry players as well.

Muhammed Mobin, SVP of cybersecurity, Novigo Solutions, said that a chief information security officer’s (CISO) focus should centre on risk management by identifying and mitigating cyber threats, alongside strong data protection to maintain confidentiality and regulatory compliance.

“An effective incident response and recovery plan is also crucial, enabling swift detection and containment of security issues. Promoting a culture of security awareness through regular training minimises human error, and aligning security with business goals ensures protection and operational efficiency work hand-in-hand,” said Mobin.