Proofpoint doubles UAE footprint as agentic AI rewrites cyber risk

Proofpoint, the US-headquartered human-and-agent cybersecurity company, used its annual Protect Dubai 2026 conference to signal a markedly enlarged commitment to the UAE and Saudi Arabia, citing a near-doubling of protected employees and a sharp jump in enterprise penetration as evidence that the agentic era is turbocharging regional security spending.

The numbers are striking. Proofpoint says it now protects more than 2.3 million employees across the Middle East, up from 1.2 million a year ago. Its share of UAE- and Saudi Arabia-based Forbes Global 2000 companies using its platform has risen from 50% to 73% in a single year. The company attributes the acceleration to two converging pressures: organisations modernising legacy security stacks, and an urgent scramble to govern the AI agents now embedded inside their workflows.

The agentic threat surface takes shape

Proofpoint's own research adds useful calibration to the growth story. Its 2026 AI and Human Risk Landscape report found that 80% of UAE organisations surveyed are already piloting or deploying autonomous AI agents, a pace that outstrips most Western markets. Its parallel Voice of the CISO study recorded 73% of UAE chief information security officers classifying generative AI as a material security risk, a 19-percentage-point jump in a single year, with 75% specifically worried about customer data leaking through public AI tools.

Those figures reframe what has historically been a compliance-driven conversation in the Gulf into something closer to existential infrastructure risk. Proofpoint's response is a pair of product systems announced earlier at its San Diego event: an Agentic Data and AI Security system that treats AI models and sensitive data as a unified risk surface, and an Agentic Collaboration Security system that uses intent-based detection to catch threats moving across email, collaboration platforms and the browser. The Dubai data centre, opened in 2025, underpins both by allowing regional customers to keep data on-shore, an increasingly non-negotiable requirement under UAE and Saudi data-residency rules.

Gulf AI ambition meets the security infrastructure gap

The strategic read-across here extends well beyond cybersecurity vendors. The Gulf Cooperation Council states, Saudi Arabia's Vision 2030 prominently among them, are committing sovereign capital at scale to AI infrastructure: data centres, foundation-model development, and agentic automation across government and enterprise. That ambition creates a structurally enlarged attack surface and a governance vacuum that Western security vendors are now racing to fill.

Proofpoint is not alone in this pivot. The Gulf cybersecurity market has attracted significant attention from Palo Alto Networks, Microsoft's security division, and regional challengers, all of whom are repositioning around AI-era threats. For cross-sector investors, the relevant signal is that AI infrastructure spending in the GCC is now inseparable from security infrastructure spending: the two budget lines are converging. Sovereign wealth allocators building exposure to Gulf digital transformation plays will need to price in security-layer capex as a structural component, not an afterthought.

The threefold increase in Proofpoint's certified regional partner engineers is a quieter but equally telling indicator. Channel depth is typically a lagging signal of market maturity; its rapid expansion here suggests the UAE and Saudi enterprise base is moving from early adoption to standardised procurement. That dynamic rewards incumbents with established local infrastructure and regulatory credentials, precisely the moat Proofpoint has been building since the 2025 Dubai data centre launch.

For CISOs and technology leaders operating across the Gulf, the immediate question is governance architecture: how do you apply human oversight to an AI agent that acts faster than any approval workflow? Proofpoint's intent-based detection approach is one answer, but the broader industry has yet to converge on a standard. That gap is both a risk and, for the vendors and investors positioned around it, a significant commercial opportunity.