As AI-powered systems move beyond generating information to executing real-world actions, organisations across the GCC and MENA region face growing pressure to strengthen security controls, manage autonomous decision-making and maintain human oversight.
The rapid adoption of artificial intelligence across the GCC and wider Middle East and North Africa (MENA) region is transforming business operations while introducing a new generation of cybersecurity challenges. As organisations increasingly integrate autonomous AI systems into their workflows, cybersecurity experts are highlighting the need for stronger safeguards to ensure these technologies operate within clearly defined boundaries.
According to Dr. Charalambos Theodorou, Founder and CEO of Xybern, a cybersecurity company focused on agentic security, one of the most significant developments is the transition from AI systems that primarily generate information to autonomous agents capable of independently executing actions.
While AI continues to improve automation, data analysis and operational efficiency, its growing ability to interact with applications, access resources and initiate workflows is creating new security considerations, particularly for businesses operating in regulated and high-consequence sectors.
“The most important change is the transition from AI systems that primarily generate information to systems that can increasingly take actions,” explains Dr. Theodorou.
As autonomous AI adoption accelerates, he believes cybersecurity strategies must evolve beyond traditional approaches to protecting data and identities, placing greater emphasis on controlling the authority granted to intelligent systems.
Autonomous AI Introduces New Security Challenges
Unlike traditional software, which generally follows predefined instructions and execution paths, autonomous AI agents can determine how to achieve specific objectives, select appropriate tools and execute tasks based on changing circumstances.
Although this flexibility offers significant opportunities for businesses, it also introduces risks associated with excessive permissions, inappropriate delegation of authority and unauthorised access to sensitive resources.
Dr. Theodorou highlights that organisations must distinguish between granting an AI agent access to a system and authorising it to perform particular actions within that system.
For example, an AI agent may require permission to retrieve or analyse information without necessarily being authorised to modify data, initiate transactions or execute high-consequence operational activities.
This distinction between authentication and authorisation is becoming increasingly important as autonomous technologies become more deeply integrated into enterprise environments.
While authentication confirms the identity of a user or system, authorisation determines whether a specific action should be permitted.
According to Dr. Theodorou, organisations cannot assume that an authenticated or trusted AI agent should automatically have permission to perform every action available within the systems it can access.
Instead, businesses need to establish clear operational boundaries and apply context-specific permissions that reflect the responsibilities assigned to each autonomous system.
Finding the Right Balance Between Automation and Human Oversight
As organisations explore the benefits of autonomous AI, maintaining an appropriate balance between operational efficiency and cybersecurity has become a central consideration.
Requiring human approval for every action performed by an AI agent could significantly reduce the efficiency gains associated with automation. However, allowing autonomous systems to operate without sufficient safeguards could expose businesses to unnecessary operational risks.
Dr. Theodorou advocates an approach based on controlled autonomy, where AI systems are permitted to execute routine and lower-consequence activities independently while more sensitive actions remain subject to additional safeguards or human approval.
“The goal is not maximum autonomy or maximum human intervention. It is controlled autonomy,” he explains.
Under this approach, organisations must carefully determine which activities can be delegated to AI agents, what conditions should govern their execution and when human intervention remains necessary.
The objective is to enable businesses to benefit from AI-powered automation without compromising control over critical operational decisions.
AI Strengthens Cybersecurity While Creating New Risks
Despite the emerging challenges, artificial intelligence is also becoming an increasingly valuable tool for strengthening cybersecurity capabilities.
AI-powered technologies can support security teams by analysing large volumes of information, identifying unusual patterns, prioritising alerts, assisting investigations and improving the efficiency of threat response.
As these technologies evolve, autonomous AI agents may also become more actively involved in operational cybersecurity workflows.
However, Dr. Theodorou cautions that there is a significant difference between an AI system recommending a security response and an autonomous agent independently executing that response within a live operational environment.
While autonomous execution can improve speed and scalability, it also requires more precise controls over what an AI system is permitted to do.
This highlights the importance of distinguishing between an AI system’s intelligence, its access to organisational resources and its authority to act.
The growing sophistication of AI technologies also presents challenges as malicious actors experiment with AI to increase the speed and scale of certain cyberattacks.
For businesses across the region, ensuring that cybersecurity capabilities develop alongside AI adoption will therefore be essential.
Agentic Security Emerges as a Critical Priority
As autonomous AI becomes more prevalent, a growing area of cybersecurity known as agentic security is gaining importance.
Agentic security focuses on establishing mechanisms that define and enforce what autonomous AI systems are authorised to do before they execute actions.
Xybern is developing authorisation infrastructure specifically designed for autonomous AI, enabling organisations to establish permissions, operational conditions and boundaries for intelligent agents.
According to Dr. Theodorou, this approach is particularly relevant to regulated and high-consequence environments, including government, defence, financial services, healthcare and cybersecurity, where unauthorised autonomous actions can carry significant operational consequences.
He explains that traditional cybersecurity infrastructure was largely designed around human users, applications and relatively predictable machine identities. Autonomous AI introduces a new category of actors capable of reasoning, selecting tools and determining how to pursue objectives dynamically.
As a result, organisations must rethink how authority is delegated to these systems and ensure that appropriate safeguards are enforced before potentially sensitive actions take place.
Beyond authorisation, data protection, transparency and accountability remain essential components of building trust in autonomous AI.
While data protection safeguards sensitive organisational and personal information, transparency enables businesses to understand how AI systems operate within their environments. Accountability ensures that organisations retain responsibility for the technologies they deploy and the authority delegated to them.
Preparing for the Cybersecurity Landscape of 2027 and Beyond
Looking ahead, the continued transition from AI assistants to autonomous agents is expected to become one of the most influential developments shaping enterprise cybersecurity.
As intelligent systems increasingly interact directly with business applications, infrastructure and operational processes, organisations will need to reassess how access, permissions and decision-making authority are managed.
Dr. Theodorou believes that the growing role of autonomous AI will require businesses to move beyond traditional security models and incorporate more precise authorisation mechanisms into their technology environments.
For business leaders considering autonomous AI adoption, he recommends treating these technologies as operational capabilities rather than simply additional software features.
Before granting AI agents access to production systems or sensitive workflows, organisations should clearly identify the tasks each system is expected to perform and limit permissions to those necessary for its responsibilities.
He also emphasises the importance of integrating cybersecurity considerations into AI system design from the outset, rather than addressing potential vulnerabilities after deployment.
Applying least-privilege principles, establishing operational boundaries and maintaining human approval for higher-consequence actions can help businesses adopt autonomous technologies while managing associated risks.
As AI adoption continues to accelerate across the GCC and MENA region, the ability to balance innovation with effective security governance is likely to become an increasingly important factor in organisational resilience.
For Dr. Theodorou, the principle guiding this transition is clear: “Autonomy should never mean unlimited authority.”
