Identity is where most modern attacks begin, and it is the control plane that matters most. Our approach is to make strong, risk-based authentication default rather than the exception, to apply least privilege consistently so access reflects what a role genuinely requires, and to keep access under regular review so entitlements do not accumulate quietly over time. handling is defined up front, and models used in decision-making are subject to oversight, testing and accountability in line with regulatory expectations in the UAE. Equally important is discipline around what data may be used where. Applied that way, AI strengthens defence without introducing a new class of unmanaged risk. We also recognise that the pace of change here is unusual, so our governance is designed to be revisited frequently rather than set once. The organisations that will benefit most from AI are those that build the guardrails at the same time as the capability, not afterwards.

As digital banking services continue to expand, how do you balance delivering seamless customer experiences with maintaining robust security and regulatory compliance?

This is often framed as a trade-off, and in our experience that framing is wrong. Friction is not the same as security, and a poor experience does not make a customer safer. The better approach is to design security into the journey from the beginning rather than bolting it on at the end, so protection is present but largely invisible. Risk-based thinking helps routine, low-risk activity should feel effortless, while unusual or higher-risk activity warrants additional assurance. Customers accept a moment of verification when it is proportionate and clearly explained. Compliance follows the same logic. Regulatory requirements are best treated as design inputs at the concept stage, not as a gate before launch, which avoids late work and produces a more coherent outcome. Security, compliance and product teams working together from the start consistently deliver something better than any of them would in sequence. The banks that get this right will be those that treat security as part of the product proposition rather than a constraint upon it, because customers increasingly choose institutions they believe will protect them.

Identity has become the new security perimeter. How are you strengthening identity and access management across employees, customers and third-party partners?

Identity is where most modern attacks begin, and it is the control plane that matters most. Our approach is to make strong, risk-based authentication default rather than the exception, to apply least privilege consistently so access reflects what a role genuinely requires, and to keep access under regular review so entitlements do not accumulate quietly over time. Privileged access receives particular attention, since it carries the greatest potential impact. The same principles extend to third parties and service providers, who are granted defined and monitored access rather than broad standing entitlements. For customers, the focus is on strong yet usable, risk-based authentication supported by continuous monitoring of unusual activity, so protection does not come at the cost of convenience. Identity is not a project with an end date. It is an operating discipline that requires ongoing attention as the organisation, its partners and its technology continue to change. Getting identity right also simplifies much else, since clear, well-governed access reduces the surface that every other control must defend.

Financial institutions are increasingly embracing hybrid and multi-cloud environments. What are the biggest security challenges in securing cloudnative banking services, and how are you addressing them?

Cloud brings genuine advantages in scale, resilience and speed of delivery, but it changes the shape of the problem. The most common challenges are consistency and visibility. Controls that are well understood in one environment must be applied coherently across several, and misconfiguration rather than sophisticated attack remains the most frequent cause of exposure. Complexity is the real adversary. We address this by standardising common patterns, automating checks so drift is identified early, and building security into the delivery pipeline so issues surface before production rather than after. Clarity about the shared responsibility model matters enormously; providers secure the platform, but the configuration, data and access within it remain firmly ours. Data residency, sovereignty and regulatory obligations are considered from the outset. Cloud can be operated at least as securely as anything else, provided it is engineered deliberately rather than adopted incrementally. Skills matter as much as tooling here, and we continue to invest in ensuring our engineering and security teams share a common understanding of how these environments should be built and operated.

Regulators are placing greater emphasis on operational resilience alongside cybersecurity. How has this influenced your approach to incident response, business continuity and cyber recovery?

Regulators have rightly shifted the question from whether an organisation can prevent an incident to whether it can continue serving customers through one. That reframing is helpful. It moves

16 WWW. INTELLIGENTCISO. COM / MIDDLE-EAST