Sovereignty. In the Gulf

In the Gulf, an interesting phenomenon is taking place. The ambition for digital transformation is immense. The UAE, Saudi Arabia and other countries in the region are heavily investing in digital infrastructure, cloud computing, cybersecurity, artificial intelligence and digital government. Technology is not just viewed as an IT budget item, but has become a core element of a broader economic and national transformation. Naturally, the concept of sovereignty has entered this conversation.

The Gulf has spent decades building an economy deeply tied to the global market. Its digital economy is no different. Global tech companies have provided infrastructure, platforms, expertise and investment in the region, making it possible to run crucial workloads close to the organizations and their customers. However, this digital transformation has created a larger attack surface.

A recent report by Dark Reading, citing research from Positive Technologies and Check Point, reveals that the UAE and Saudi Arabia accounted for roughly half of all cyberattacks recorded in the Gulf during the first half of 2026. The report indicates a shift from highly visible attacks like DDoS attacks and website defacements to more targeted intrusions, persistence, and data gathering.

This is significant because digital transformation brings more valuable targets. In April, the Handala group, linked to Iran, claimed to have breached three major UAE organizations: Dubai Courts, the Dubai Land Department, and the Roads and Transport Authority, causing the destruction and theft of large volumes of data. Although the accuracy of these claims is debatable, the fact remains that a significant cyberattack was publicly attributed to organizations responsible for important public services in the UAE.

In September, Amazon Web Services (AWS) was still unable to restore access to its Bahrain infrastructure and one of three availability zones in the UAE, following damage caused during the US-Iran war. These incidents demonstrate the real-life challenges the Gulf faces in addressing digital security.

The UAE has developed a sophisticated policy framework for cloud security. Its National Cloud Security Policy covers data location and sovereignty, interoperability and portability, cloud resilience, supply-chain security, and operational sovereignty. Saudi Arabia has taken a similar approach, with its Cloud First Policy prioritizing cloud solutions for government IT investments and positioning the National Information Center's Deem Cloud as a national government cloud platform.

Bahrain has also been actively pursuing cloud adoption, with its Cloud First Policy integrating cloud computing into public-sector IT planning and partnering with AWS as its official cloud infrastructure provider for the public sector.

While these policy initiatives are expected, the real challenge arises when the ambition meets an unforeseen event. When policy ambition encounters an event that was not accounted for in the initial plans, sovereignty transforms from a theoretical concept into an operational problem. This is where sovereignty becomes particularly intriguing.