Red Hat Survey Shows Blind Spots in UAE Enterprise Software Supply Chains

Red Hat, the world's leading provider of open source solutions, has announced the results of a survey examining enterprise artificial intelligence (AI) adoption and risk management across 1,400 CIOs across 14 countries, including the United Arab Emirates (UAE).

The majority of UAE CIOs surveyed (91%)¹ report high confidence that their AI agents operate securely and in compliance with regulations, supported by guardrails and monitoring. However, the data highlights that this optimism can mask a lack of visibility:

• 42% of respondents report having a precise understanding of data flows within their organisation and the knowledge of where data is stored and processed.
• Only 33% have a comprehensive overview of their software supply chain as well as direct and indirect dependencies.
• Just one third (36%) continuously assess the risks posed by AI providers, beyond initial onboarding.

These results indicate that while survey respondents feel that their AI agents and environments have appropriate security and sovereignty controls, the reality shows a lack of auditable proof in these operations. The dynamic nature of AI innovation and market forces make it possible for a system to have high levels of security and compliance at deployment, but then be completely exposed soon after.

Small gaps in visibility, major risk to data

UAE enterprises are accelerating their AI adoption curve, with 38% of respondents stating they can fully rely on tested guardrails, continuous monitoring and automated intervention mechanisms. A further 53% of UAE companies are 'fairly confident' that they have security and compliance under control, but acknowledge minor gaps in their guardrails and monitoring.

In production environments, however, unmonitored data exchanges between enterprise platforms, cloud services, and external AI models can create risks. 50% of UAE companies report minor gaps in the visibility of data flow and 7% have already introduced AI functions without fully understanding the data flows. Notably, none of the respondents reported having only limited visibility into where data associated with embedded AI capabilities is processed, stored or shared.Comparatively, visibility varies widely across the Gulf region, with 42% of respondents in the UAE reporting comprehensive data-flow visibility, compared to 46% in Saudi Arabia. For UAE enterprises navigating an evolving regulatory environment, including the UAE's Federal Personal Data Protection Law (PDPL), establishing verifiable, lifecycle-wide data traceability remains essential to strengthen data governance, support compliance and minimise the risk of data exposure.

The great risk of indirect software dependencies

As many as 67% of UAE companies surveyed report that they are able to patch critical software vulnerabilities within 24 hours once a fix becomes available. The remaining companies take a few days.

However, most companies do not know exactly which software components are in use. Only 33% have a complete and constantly updated overview of all the open source components they use, including their origin, version numbers and direct and indirect dependencies. Across all the countries, the average figure is just under 33%.

Whilst 51% of UAE companies have a good overview of the components and versions, they note concessions when it comes to understanding origins and indirect dependencies. 16% of respondents lack a complete overview, partly because they focus on components from large projects or because visibility depends heavily on the specific applications or business units using them. Notably, all UAE respondents reported some level of tracking of their open source software supply chains, with none indicating a complete absence of systematic monitoring.

Indirect dependencies are common in many open source software projects, meaning that they incorporate libraries, frameworks and other components from other projects. These dependencies can often pose significant risks for an organization's IT estate, especially if they are not effectively evaluated (67%²).

Risk assessments as an ongoing rather than a one-off task

When it comes to assessing risks posed by AI providers, only 36% of UAE companies report that they are well-prepared and have measurable, continuously monitored criteria as part of their day-to-day AI operations. This mirrors findings in Saudi Arabia, where 36% of respondents also report continuous AI provider risk monitoring, highlighting a shared regional challenge in maintaining oversight throughout the AI lifecycle.

Although 50% of companies surveyed in the UAE conduct a risk assessment before implementing new AI technologies, they struggle to monitor and evaluate those risks afterward. A further 10% rely solely on an initial evaluation, which can be insufficient in the rapidly evolving world of AI, as models, data, regulatory requirements and threats change almost daily.

This challenge and the need to address it through measurably, internally-controlled methods is not lost on survey respondents. Only 4% of UAE companies rely solely on external audits, certifications and contractual assurances for their risk assessments. Notably, none of the respondents reported relying primarily on provider reputation, experience and established relationships, while none indicated having no formal approach to assessing and managing AI provider risks.

Quotes

Adrian Pickering, general manager, Middle East and North Africa, Red Hat

"Effective AI governance does not depend solely on policies and audit processes, but first and foremost requires comprehensive visibility. Companies need to know how data flows, which software components they are using and what risks AI providers pose - and this must be done throughout the entire lifecycle of AI agents. Before scaling up AI and agents, monitoring and governance mechanisms should always be established to identify risks early on, especially since AI makes it easier to discover and exploit vulnerabilities. Trustworthy software supply chains and community projects that quickly develop fixes, test them thoroughly and backport them to older versions reduce both security risks and operational risks."

Chris McBrayne, senior vice president and general manager, EMEA, Red Hat

"Although companies' self-assessments vary slightly when compared internationally, most are relatively confident that they can effectively monitor and control AI agents. However, this confidence in their own capabilities is not always justified, with our research showing a lack of comprehensive and continuous transparency regarding data flows, software dependencies and vendor risks. Open architectures with centralised management can, however, help companies maintain control and remain flexible when selecting models and providers."

1 Combines 'Very confident - we have tested guardrails, continuous monitoring and mechanisms to intervene or stop agents when required' and 'Fairly confident - we have guardrails and monitoring in place, but some gaps remain'

2 Combines 'We have good visibility into components and versions, but limited visibility into their origins or indirect dependencies', 'We know which major open source components we use, but do not have a complete view of the wider software supply chain', 'We have limited visibility into the open source components and dependencies used across our critical applications',' We do not systematically track our open source software supply chain'

Research was conducted by Censuswide among 1400 CIOs (25+) in the UK, France, Italy, Germany, Spain, UAE, Sweden, Turkey, Switzerland, Poland, South Africa, Netherlands, Belgium, Saudi Arabia between 24.08.2026-01.09.2026. Censuswide is a member of the Market Research Society and the British Polling Council, and a signatory of the Global Data Quality Pledge.