GISEC Global, the region's largest cybersecurity event, opened yesterday at Dubai Exhibition Centre in Expo City and runs until tomorrow. It is hosted by the UAE Cyber Security Council, with more than 750 cyber brands and visitors from over 180 countries, according to the organisers. On day one, Dubai Electronic Security Center launched SARAAB, an open-source AI model that detects deepfake videos, built by an Emirati team and described as the first of its kind developed by a government entity in the Arab region. A DESC official told Khaleej Times it is expected on Hugging Face by the end of 2026, with 91 percent detection accuracy.
Deepfakes get the headlines, and they deserve them. A convincing video of a CEO asking finance to move money was expensive two years ago. Now it is not. But for most UAE businesses, the attack that actually lands is older and duller: a stolen password, an outdated plugin, a fake website that looks exactly like yours. This is the checklist we use when we take over a client's website, with the UAE numbers and rules behind each item.
What the UAE's own numbers say
- Volume. In January 2025 the UAE Cyber Security Council said attacks on strategic sectors exceeded 200,000 a day. Misconfiguration accounted for 27 percent of the vulnerabilities exploited, phishing for 10 percent.
- Passwords. The Council's digital identity campaign states that 97 percent of cyberattacks target passwords, and that multi-factor authentication can prevent more than 99 percent of attacks.
- Scams. In the Council's 2024 State of Scams in the UAE, 27 percent of people surveyed had lost money, with an average loss of US$2,194. Almost half of scams were completed within 24 hours of first contact, WhatsApp was the most common channel, and half of respondents had met AI-related scams.
Read together, those figures describe the real threat to a business website: attackers do not need to break anything clever. They need one reused password, one setting left open, or one convincing copy of your brand.
1. Lock the accounts, not just the website
The website is rarely the first thing attacked. The accounts around it are. A hacker with your domain registrar login can point your domain anywhere. One with your hosting or email login does not need to touch the site at all.
- Turn on multi-factor authentication for the website admin, the hosting panel, the domain registrar, the DNS provider and the company email. In that order of forgetting, the registrar is the one most businesses miss.
- Enable the registrar lock on your domain, so it cannot be transferred without an extra confirmation.
- Remove former staff and agencies from every one of those accounts. Shared logins make this impossible, which is the argument for individual accounts.
2. Treat plugins and packages as the attack surface they are
The OWASP Top 10, the most widely used list of web application risks, added a new category in its 2025 edition: Software Supply Chain Failures, now ranked third. Security Misconfiguration moved to second, behind Broken Access Control. For a typical business website, that is a precise description of the risk: third-party plugins, themes and scripts that nobody updates, and settings nobody checked.
- Update the platform, plugins and themes on a schedule, not when something breaks.
- Delete, do not just deactivate, anything unused. A disabled plugin can still be exploited.
- Load third-party scripts only from sources you can name, and review the list twice a year.
This is also the honest trade-off between platforms. A WordPress site with forty plugins needs maintenance as a service. A custom-coded site has fewer moving parts but needs a developer for changes. We compared both in WordPress or custom-coded.
3. Close the settings attackers look for first
- HTTPS everywhere, with HTTP redirected and HSTS enabled. Google has used HTTPS as a ranking signal since 2014, and its page experience guidance still asks whether pages are served securely.
- Admin areas not publicly guessable: rate-limited logins, and where possible restricted by IP or behind single sign-on.
- Security headers set on the server: content security policy, frame protection and no MIME sniffing.
- Forms protected against spam and abuse with a honeypot or a challenge, and never emailing raw submissions to a shared inbox.
- Backups taken automatically, stored somewhere other than the same server, and restored once as a test. A backup that has never been restored is a hope, not a backup.
4. Make impersonation harder, and easier to disprove
Deepfakes and fake websites work because customers cannot easily tell what is real. Your website should be the place that settles it.
- Protect your email domain. Configure SPF, DKIM and DMARC so criminals cannot send email that appears to come from your company. Start DMARC in monitoring mode, then enforce it.
- Publish an official channels page. List your real phone numbers, WhatsApp business number, email domain, social accounts and bank details policy, and state clearly what you will never ask a customer to do. Given that WhatsApp is the most common scam channel in the Council's survey, this single page prevents a lot of damage.
- Watch for lookalike domains and fake social accounts using your brand. Under Article 11 of the UAE cybercrime law, creating a fake website, account or email and falsely attributing it to a person or company is a crime carrying a fine of AED 50,000 to 200,000. You have legal recourse; you need to notice first.
- Point customers to a checker. The Council's StaySafe tool lets anyone check whether a website or link is a scam. Link to it from your official channels page.
5. Know within hours if something goes wrong
Google tells site owners when it detects a problem. Search Console's Security issues report flags hacked content, malware and social engineering, and Google says affected pages can show a warning label in search results or a full warning page in the browser. After you fix it, the review can take several days or weeks. For a business that depends on search, that is weeks of customers being told your site is dangerous.
- Verify the site in Search Console and make sure alerts reach an inbox someone reads.
- Add uptime and change monitoring, so a defaced homepage is noticed in minutes, not by a customer.
- Keep server and application logs long enough to answer the question "what happened" a week later.
6. Have the breach plan written before you need it
If customer data is exposed, the law sets the first step. Article 9 of the UAE's Personal Data Protection Law requires a business to report a personal data breach to the regulator as soon as it becomes aware of it, with the detailed deadlines left to executive regulations. Businesses in DIFC and ADGM follow their own data protection laws instead. Either way, the plan should name who decides, who contacts the host and developer, who talks to customers, and where the backups are.
If you supply Dubai government, the bar is higher. DESC's Information Security Regulation applies to all Dubai Government entities, explicitly including their contractors, and DESC used GISEC to launch an auditor certification programme for it. Expect the security of a supplier's website and systems to be part of the conversation. We covered the related AI procurement rules in our piece on Dubai's agentic AI training, and the wider legal picture in what actually applies to your business.
What we would do this week
- Day one: multi-factor authentication on registrar, hosting, website admin and email. Registrar lock on.
- Day two: update everything, delete unused plugins, confirm HTTPS redirects and a tested backup.
- Day three: SPF, DKIM and DMARC in monitoring mode, and an official channels page live.
- Day four: Search Console verified with alerts on, uptime monitoring running.
- Day five: a one-page breach plan with names and phone numbers.
None of this needs a security operations centre. It needs someone to own it. Keeping client websites updated, monitored and backed up is part of our WordPress care and custom website work. If you are not sure who holds the keys to your domain, hosting and site today, send us the website and we will tell you what to lock first.