Sector context
This is our description, not a regulatory classification. Payment institutions and exchange houses move money for others over rails they do not own. Asset managers and brokers rely on custodians, trading venues and portfolio platforms. Insurers hold sensitive personal data and rely on brokers and claims partners. Fintechs often depend on a licensed partner for the regulated activity and on cloud and API providers for the rest.
Public data gives two views. Verizon’s 2026 DBIR executive summary covers the Financial and Insurance sector with 3,809 incidents, 1,300 of them with confirmed data disclosure. In that sector, initial access came from vulnerability exploitation in 22% of breaches, phishing in 20% and credential abuse in 15%. Third-party involvement was 34%. External actors were 88% and financial motive 98%. The dataset is global and weighted to the US. ENISA’s Threat Landscape 2026 (incidents in calendar 2025, collected mostly from open sources) puts finance and banking at 5.6% of recorded events. Within that, unauthorized access was 46%, DDoS 38.9% and fraud or impersonation 14.8%. ENISA covers the EU, not the UAE.
Our reading: neither source measures UAE firms. Together they show the same shape: attackers mostly reach financial firms from outside, through exposed systems, stolen access and partners, for money.
Five priorities
| # | Priority | What the evidence says | Question for the board |
|---|---|---|---|
| 1 | Exploited vulnerabilities in exposed systems | DBIR: 22% of FI breaches began with exploitation; across all sectors only 26% of critical KEV vulnerabilities were fully remediated, with a median of 43 days | How fast do we fix internet-facing flaws, and who proves it? |
| 2 | Third-party dependency | DBIR: 34% of FI breaches involved a third party (48% overall); only 23% of third parties fully fixed MFA gaps on cloud accounts | Which providers can stop a critical service, and do we hold exit plans? |
| 3 | Availability under hacktivist pressure | ETL 2026: ideology-driven attacks were 40.6% of finance and banking incidents, and 95.8% of those were DDoS claims | Can critical customer services stay up during a sustained DDoS? |
| 4 | Fraud and impersonation | ETL 2026: 14.8% of finance incidents were fraud or impersonation. CISA advisory AA23-320A documents help desk impersonation to reset passwords and move MFA | How does our help desk verify a caller before a reset? |
| 5 | Regulatory change and proof | CBUAE C 1/2026 and Decree-Law 6/2025 (see below) | Can we show evidence, not intent, for each new duty? |
Priority 3 needs care. ENISA counts reported incidents, and DDoS is the most frequent type but often brief. Frequency is a poor guide to impact. Priority 2 is the better planning signal because a provider failure can stop a service that you cannot restore alone.
Regulatory lens
| Instrument | What we verified | Status or limit |
|---|---|---|
| CBUAE Operational Risk Management Regulation C 1/2026 | Applies to Licensed Financial Institutions, defined to include banks, (re)insurers and other financial institutions licensed under the Central Bank Law. Requires Board-approved tolerance for disruption, ICT and cybersecurity management, third-party controls, and notification of significant events within 4 hours (Art. 15.2.1), a 24-hour summary (15.2.2) and 72 hours for high-risk Incidents (15.3). Replaces Circular 163/2018. | Rulebook header: effective 14 September 2026. Whether a given exchange house or payment provider is in scope depends on its license |
| Federal Decree-Law 6 of 2025 | Issued 8 September 2025, published in the Official Gazette on 15 September 2025 (No. 807), effective 16 September 2025. Article 61(1) lists licensed activities including open finance, currency exchange and money transfer, and stored value, retail payments and digital money. Article 184 gives one year from entry into force to reconcile positions, extendable by the Board of Directors. | The one-year period ran to mid-September 2026 (15 or 16 September, depending on how the day is counted). Two independent searches found no extension notice. That does not prove none exists |
| UAE PDPL, Decree-Law 45 of 2021 | Article 2(2) excludes personal banking and credit data that has its own legislation, and free-zone companies with special data protection laws | Which regime covers your data needs a legal check |
| EU DORA, Regulation 2022/2554 | Applies from 17 January 2025. Article 8(1): financial entities identify, classify and document ICT-supported business functions and supporting assets, and review that classification at least yearly. Article 28(1)(a): the entity stays fully responsible when it uses ICT services | Relevant to groups with EU entities |
| DFSA Rulebook GEN 5.5.19 (DIFC) | A DIFC firm must notify the DFSA as soon as reasonably practicable, and in any event no later than 72 hours, after it becomes aware, or has information that reasonably suggests, that a material Cyber Incident has occurred. Cyber risk framework in GEN 5.5.2, incident response plan in GEN 5.5.17 | Read in the DFSA Rulebook (version VER72/07-26) |
| CBUAE Open Finance Regulation C 03/2025 | Issued ‘10/7/2025’ (the page does not show whether this is 10 July or 7 October), status In-Force. It replaces C 7/2023, marked Repealed. Phase one covers all Banks, including foreign branches, and Insurance Companies. Later phases are announced by the Central Bank | Effective date and phase dates are not stated. Art. 38(1): the regulation comes into effect in phases as notified by the Central Bank |
Questions for the next planning cycle
-
For each critical service, who is the provider, where is it hosted and what is the tested exit plan?
-
What share of internet-facing systems rated critical was fixed inside your own target last quarter, and who verified it?
-
Has the help desk been tested with an impersonation call this year?
-
If you are a Licensed Financial Institution, which of the 4-hour, 24-hour and 72-hour notifications would your incident process meet today?
-
Which regulators supervise each licensed entity in the group, and how do their incident reporting deadlines differ?
About the evidence
DBIR and ENISA are not UAE data. The DBIR figures come from the executive summary, not the gated full report. ENISA’s open-source method does not give a complete picture, as ENISA itself says. The priorities table is Cybrilliant analysis.
Sources
-
Verizon, 2026 Data Breach Investigations Report, Executive Summary. Accessed 9 October 2026. verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf
-
ENISA Threat Landscape 2026, September 2026. Accessed 9 October 2026. enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202026_Final.pdf
-
Central Bank of the UAE, Operational Risk Management Regulation C 1/2026, Rulebook. Accessed 9 October 2026. rulebook.centralbank.ae/en/rulebook/operational-risk-management-regulation
-
UAE Federal Decree-Law No. 6 of 2025 (Central Bank law), UAE Legislation portal. Accessed 9 October 2026. uaelegislation.gov.ae/en/legislations/3284
-
UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection), UAE Legislation portal. Accessed 9 October 2026. uaelegislation.gov.ae/en/legislations/1972
-
Regulation (EU) 2022/2554 (DORA), EUR-Lex. Accessed 9 October 2026. eur-lex.europa.eu/legal-content/EN/TXT/ eur-lex.europa.eu
-
CISA, FBI and partners, Advisory AA23-320A, Scattered Spider (revised 29 July 2025). Accessed 9 October 2026. cisa.gov/news-events/cybersecurity-advisories/aa23-320a
-
DFSA Rulebook, GEN 5.5.19 (Cyber Risk Management), module version VER72/07-26. Accessed 9 October 2026. dfsaen.thomsonreuters.com/rulebook/gen-5519
-
CBUAE Rulebook, Open Finance Regulation C 03/2025. Accessed 9 October 2026. rulebook.centralbank.ae/en/rulebook/open-finance-regulation-0
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionManage Cyber Risk & ExposureKnow what attackers can reach and what it would cost.See how we work →Related service
Cyber Risk & Governance
Use this industry view to prioritize Financial Services cyber-risk decisions.