Aligning with shifting cybersecurity priorities

Jose Thomas, Managing Director of Bulwark, discusses why cybersecurity must be embedded into digital transformation strategies from the outset, the growing risks posed by AI-driven threats and quantum computing, and the importance of skills development and collaboration in strengthening cyber resilience across the Middle East.

What does “Cyber First” mean in practice for organisation’s roadmap this year?

For us, “Cyber First” means embedding cybersecurity into the planning stage of every digital initiative of any organization, whether launching a customer application, adopting cloud services, deploying AI or connecting industrial assets. This is particularly relevant to the Middle East, where digital government, financial services, smart infrastructure and industrial transformation depend on public trust and reliable services.
Ultimately, “Cyber First” should deliver measurable results: fewer critical exposures, better-protected information, faster incident response and greater confidence in business continuity.

Which emerging threat worries you most right now: AI-driven deepfakes, GenAI abuse or next-gen ransomware?
All three are significant concerns, but I would highlight AI-driven deepfakes because they undermine the trust on which business decisions depend. Even with strong technical controls, an employee can be persuaded to transfer money, disclose confidential information or approve access by someone impersonating a trusted executive or business partner.
These threats also reinforce one another. GenAI can help attackers create persuasive communications; impersonation can secure an employee’s cooperation; and compromised access can enable data theft or ransomware. Organisations must combine technical protection with independent verification procedures and realistic awareness training. Employees must feel empowered to question unusual instructions, regardless of their apparent source.

Another strategic concern is the threat quantum computing poses to widely used public-key cryptography, making migration to post-quantum cryptography, or PQC, increasingly important. Attackers could collect encrypted information today and decrypt it in the future—a particular concern for government, financial, healthcare and critical infrastructure information that must remain confidential for many years.

Migration timelines are already taking shape internationally. Through our portfolio, Bulwark can help customers move from identifying their exposure to implementing quantum-resistant protection. ISARA Advance supports cryptographic discovery, inventory and risk assessment, helping organisations identify vulnerable cryptography and prioritise migration.

Our message is to begin preparing now: identify vulnerable cryptography, prioritise sensitive information and critical systems, assess vendor readiness and establish a phased migration roadmap. Quantum readiness requires sustained preparation, and waiting until a deadline approaches could leave organisations with insufficient time. With solutions from AppviewX, Utimaco and Nexus Group, we can help a phased transition towards quantum readiness and applicable compliance requirements.

How is your business helping GCC governments and enterprises close the region’s cybersecurity skills gap?
We see the skills gap needed to meet organization’s current cybersecurity objectives as a practical capability challenge. With 27 years in cybersecurity distribution, Bulwark support channel partners through technical enablement, vendor-led training, demonstrations, proof-of-concept engagements and pre- and post-sales assistance. Building capability within partners allows that expertise to reach a wider range of government and enterprise customers.

What role should public-private collaboration play in securing critical infrastructure across the Middle East?
In the Middle East, protecting energy, water, telecommunications, healthcare, transport and financial infrastructure is directly connected to economic stability and public safety. Public-private collaboration could be an ongoing operational partnership with clearly defined responsibilities. Collaboration should also extend to contractors, equipment suppliers and remote maintenance providers. Critical infrastructure resilience depends on the security of the wider supply chain. The ultimate test is whether essential services can continue operating safely during an attack and how quickly organisations detect, contain and recover from disruption.
For Bulwark, the opportunity is to support this ecosystem through specialist technologies with expertise and capable local partners.

What is one prediction you would make for the cybersecurity landscape over the next 12 months?
Most organizations will increasingly focus on how they can use AI while retaining control over their data, identities and business decisions. My prediction is that secure AI adoption will become a central board-level cybersecurity issue.

As AI assistants and agents gain access to internal information and workflows, organisations will need clear answers to practical questions: What information can the system access? Can it share confidential data externally? Can it initiate transactions or change records? Who approves sensitive actions, and how can those actions be audited? How to secure confidential information when employees start using online AI tools in their day-to-day work related activities. I expect the ability to demonstrate that control to become an important differentiator for both technology providers and the organisations adopting their solutions.

For Bulwark and our partners, this creates an opportunity to connect AI governance with established cybersecurity disciplines, including identity management, data security, application testing and continuous monitoring. information and operations.

What does “Cyber First” mean in practice for organisation’s roadmap this year?
For us, “Cyber First” means embedding cybersecurity into the planning stage of every digital initiative of any organization—whether launching a customer application, adopting cloud services, deploying AI or connecting industrial assets. This is particularly relevant to the Middle East, where digital government, financial services, smart infrastructure and industrial transformation depend on public trust and reliable services.Ultimately, “Cyber First” should deliver measurable results: fewer critical exposures, better-protected information, faster incident response and greater confidence in business continuity.

Which emerging threat worries you most right now: AI-driven deepfakes, GenAI abuse or next-gen ransomware?
All three are significant concerns, but I would highlight AI-driven deepfakes because they undermine the trust on which business decisions depend. Even with strong technical controls, an employee can be persuaded to transfer money, disclose confidential information or approve access by someone impersonating a trusted executive or business partner.
These threats also reinforce one another. GenAI can help attackers create persuasive communications; impersonation can secure an employee’s cooperation; and compromised access can enable data theft or ransomware. Organisations must combine technical protection with independent verification procedures and realistic awareness training. Employees must feel empowered to question unusual instructions, regardless of their apparent source.

Another strategic concern is the threat quantum computing poses to widely used public-key cryptography, making migration to post-quantum cryptography, or PQC, increasingly important. Attackers could collect encrypted information today and decrypt it in the future—a particular concern for government, financial, healthcare and critical infrastructure information that must remain confidential for many years.

Migration timelines are already taking shape internationally. Through our portfolio, Bulwark can help customers move from identifying their exposure to implementing quantum-resistant protection. ISARA Advance supports cryptographic discovery, inventory and risk assessment, helping organisations identify vulnerable cryptography and prioritise migration.
Our message is to begin preparing now: identify vulnerable cryptography, prioritise sensitive information and critical systems, assess vendor readiness and establish a phased migration roadmap. Quantum readiness requires sustained preparation, and waiting until a deadline approaches could leave organisations with insufficient time. With solutions from AppviewX, Utimaco and Nexus Group, we can help a phased transition towards quantum readiness and applicable compliance requirements.

How is your business helping GCC governments and enterprises close the region’s cybersecurity skills gap?
We see the skills gap needed to meet organization’s current cybersecurity objectives as a practical capability challenge. With 27 years in cybersecurity distribution, Bulwark support channel partners through technical enablement, vendor-led training, demonstrations, proof-of-concept engagements and pre- and post-sales assistance. Building capability within partners allows that expertise to reach a wider range of government and enterprise customers.

What role should public-private collaboration play in securing critical infrastructure across the Middle East?
In the Middle East, protecting energy, water, telecommunications, healthcare, transport and financial infrastructure is directly connected to economic stability and public safety. Public-private collaboration could be an ongoing operational partnership with clearly defined responsibilities. Collaboration should also extend to contractors, equipment suppliers and remote maintenance providers. Critical infrastructure resilience depends on the security of the wider supply chain. The ultimate test is whether essential services can continue operating safely during an attack and how quickly organisations detect, contain and recover from disruption.
For Bulwark, the opportunity is to support this ecosystem through specialist technologies with expertise and capable local partners.

What is one prediction you would make for the cybersecurity landscape over the next 12 months?
Most organizations will increasingly focus on how they can use AI while retaining control over their data, identities and business decisions. My prediction is that secure AI adoption will become a central board-level cybersecurity issue.

As AI assistants and agents gain access to internal information and workflows, organisations will need clear answers to practical questions: What information can the system access? Can it share confidential data externally? Can it initiate transactions or change records? Who approves sensitive actions, and how can those actions be audited? How to secure confidential information when employees start using online AI tools in their day-to-day work related activities. I expect the ability to demonstrate that control to become an important differentiator for both technology providers and the organisations adopting their solutions.

For Bulwark and our partners, this creates an opportunity to connect AI governance with established cybersecurity disciplines, including identity management, data security, application testing and continuous monitoring. information and operations.