Red Hat Survey Finds Gaps in UAE Enterprises’ AI and Software Supply Chain Oversight
A survey of 1,400 chief information officers (CIOs) across 14 countries, including the United Arab Emirates (UAE), has identified gaps in enterprise oversight of artificial intelligence (AI) systems and software supply chains, despite high confidence in existing security controls. The research by Red Hat found that 91% of UAE CIOs surveyed were confident that their AI agents operated securely and complied with regulations. However, only 42% said they could accurately trace where data was stored and processed within their organisations.
The survey also found that just 33% of respondents had a comprehensive overview of their software supply chains, including direct and indirect dependencies. Meanwhile, 36% continuously assessed risks associated with third-party AI providers after implementation. The findings highlight differences between organisations’ confidence in their AI governance measures and their ability to maintain visibility into data flows, software components and external providers as systems evolve.
Among UAE respondents, 38% said they could fully rely on tested safeguards, continuous monitoring and automated intervention mechanisms to manage AI security and compliance. Another 53% reported being fairly confident in their controls but acknowledged some gaps in monitoring and safeguards. The survey also identified limitations in tracking data exchanges between enterprise platforms, cloud services and external AI models. According to the findings, 50% of UAE respondents reported minor gaps in data-flow visibility, while 7% had introduced AI functions without fully understanding the associated data flows.
The ability to track how data is stored, processed and shared is particularly relevant to organisations operating under regulatory requirements such as the UAE’s Federal Personal Data Protection Law (PDPL). Although 67% of UAE respondents said they could patch critical software vulnerabilities within 24 hours of a fix becoming available, only 33% maintained a complete and continuously updated inventory of their open-source software components, including their origins, versions and dependencies.
A further 51% reported having a good overview of software components and versions but acknowledged limitations in tracking their origins and indirect dependencies. The remaining 16% lacked a complete overview, with visibility varying according to the projects, applications or business units involved. All UAE respondents reported some level of systematic tracking of their open-source software supply chains, although the extent of that oversight varied.
Indirect dependencies can introduce additional security risks because open-source projects frequently incorporate libraries, frameworks and other components developed by separate projects. Organisations may therefore need to assess vulnerabilities beyond the software they use directly. The survey found that half of UAE respondents conducted risk assessments before implementing new AI technologies. However, only 36% reported having measurable criteria and continuous monitoring processes for evaluating AI providers during ongoing operations.
Another 10% relied solely on an initial assessment, potentially leaving subsequent changes to AI models, data practices, regulatory requirements and threat conditions outside regular reviews. Only 4% of respondents relied exclusively on external audits, certifications and contractual assurances to assess AI-related risks. No respondents reported relying primarily on a provider’s reputation, experience and established relationships, or having no formal approach to assessing and managing AI provider risks.
The findings point to the need for organisations to maintain oversight of AI systems and their providers throughout deployment and operation, rather than treating risk assessment as a one-time exercise. Adrian Pickering, General Manager, Middle East and North Africa, Red Hat, said, “Effective AI governance does not depend solely on policies and audit processes, but first and foremost requires comprehensive visibility. Companies need to know how data flows, which software components they are using and what risks AI providers pose – and this must be done throughout the entire lifecycle of AI agents. Before scaling up AI and agents, monitoring and governance mechanisms should always be established to identify risks early on, especially since AI makes it easier to discover and exploit vulnerabilities. Trustworthy software supply chains and community projects that quickly develop fixes, test them thoroughly and backport them to older versions reduce both security risks and operational risks.”
Chris McBrayne, senior vice president and general manager, EMEA, Red Hat, said, “Although companies’ self-assessments vary slightly when compared internationally, most are relatively confident that they can effectively monitor and control AI agents. However, this confidence in their own capabilities is not always justified, with our research showing a lack of comprehensive and continuous transparency regarding data flows, software dependencies and vendor risks. Open architectures with centralised management can, however, help companies maintain control and remain flexible when selecting models and providers.”
