Quick answer: Zero trust for a 50-person UAE company is eight ordinary changes in the right order, mostly configuration of tools it already owns: one identity provider, MFA without exceptions, managed devices, least privilege, email defences, immutable backups, central logs, then segmentation. A dedicated zero trust platform is a second-phase purchase, not the starting point.
Zero trust is sold as an enterprise programme: a two-year roadmap, a platform licence and a team to run it. For a 30-to-150-person company in the UAE that is the wrong picture. Zero trust is a way of deciding who and what gets access to which systems, and the first eighty per cent of it is a sequence of ordinary changes that a small team can make in a quarter. This guide gives that sequence, in the order that removes the most risk soonest, with the UAE numbers that explain why it is worth doing now.
Source: Gulf News, August 2026 (UAE Cyber Security Council)
Source: Intelligent CIO, May 2025
Source: CPX UAE cybercrime statistics 2025
What zero trust actually means
The old model drew a wall around the office network and trusted everything inside it. That wall stopped meaning anything once staff worked from home, from cafés in JLT and from phones, and once the company’s systems moved to SaaS tools and cloud accounts. Zero trust replaces “inside the network” with three questions asked on every access: is this really the person or service it claims to be, is the device it is using in a known-good state, and does this identity need this particular resource right now? The US standards body NIST wrote the reference definition (SP 800-207); the practical version for a small company is: strong identity, healthy devices, least privilege, and logs that let you see what happened.
That wall stopped meaning anything once staff worked from home, from cafés in JLT and from phones, and once the company’s systems moved to SaaS tools and cloud accounts.
The numbers above are why it matters in the UAE specifically. Attack volume is enormous and increasingly automated, email impersonation is the fastest-growing technique, and the people most likely to be fooled are the ones with the most access: founders, finance, and the admin who set up the tools. Zero trust is, at its core, a way to make a single fooled person a contained problem rather than a company-wide one.
The order that removes the most risk first
| Step | What you do | Risk it removes | Effort for a 50-person company |
|---|---|---|---|
| 1. One identity provider | Put every staff account behind a single sign-on directory (Microsoft Entra or Google Workspace); connect every SaaS tool to it; delete local logins | Orphaned accounts, password reuse, the ex-employee who still has access | 2–3 weeks; mostly admin time |
| 2. Phishing-resistant MFA everywhere | Enforce MFA on the identity provider; prefer passkeys or authenticator apps over SMS; no exceptions for executives | The majority of account takeovers, including from stolen passwords | 1 week; the hard part is the exceptions people ask for |
| 3. Managed devices | Enrol company laptops and phones in device management; enforce disk encryption, updates, screen lock and a supported OS; block unmanaged devices from company data | Lost laptops, unpatched machines, malware on personal devices | 3–4 weeks including buying out of “bring your own laptop” |
| 4. Least privilege | Turn admin rights into roles; review who has them; put cloud and finance admin behind approval; remove standing access to production data | The blast radius of one compromised account | 2 weeks of reviews; ongoing quarterly |
| 5. Email defences | Configure SPF, DKIM and DMARC to reject; enable impersonation protection; external-sender banners; a one-click report button | Impersonation of your CEO to your finance team, and of your domain to your customers | 1 week |
| 6. Backups you have restored | Immutable, off-account backups of every system that matters; a restore test on the calendar | Ransomware becoming an existential event | 2 weeks; then monthly tests |
| 7. Logs in one place | Central sign-in, admin and cloud audit logs with alerts for the obvious (new admin, impossible travel, mass download) | Breaches that go unnoticed for months | 2–3 weeks; a managed service is reasonable here |
| 8. Segment what is left | Separate guest Wi-Fi, IoT and office devices from company systems; no flat network | Lateral movement from a compromised printer or camera | 1–2 weeks with your network vendor |
Notice what is not on the list: buying a “zero trust platform”. Steps one to seven can be done with the identity, device and email tools most companies already pay for. A dedicated access product (for internal apps, contractors and legacy systems) belongs in the second phase, once identity and devices are solid, because it depends on both.
Step by step, in more detail
Identity is the new perimeter, so start there
Every other control assumes you know who is asking. A single identity provider with single sign-on into every tool means one place to create an account, one place to remove it, one place to see who has what. The most common finding in our first-week audits is a tool that was never connected: an old design platform, a shared marketing login, a courier portal with a password on a sticky note. Inventory every SaaS subscription on the company card and connect or close it.
MFA without exceptions
The exception request will come from the person whose account is most valuable. Hold the line. Use authenticator apps or passkeys; SMS codes are better than nothing but are the first thing an attacker targets with SIM swaps and are common in UAE fraud cases. For shared mailboxes and service accounts, convert them to delegated access rather than shared passwords.
Devices you can vouch for
A managed device means the company can confirm it is encrypted, patched, has endpoint protection running and can be wiped if lost. Conditional access then does the real work: company data opens only on devices that pass. This is the change that most improves security per dirham, and the one that meets most resistance, because it means a company laptop for everyone who touches customer data. Budget for it.
Least privilege, reviewed
Standing admin rights are the fuel for every serious incident. Convert them to roles, grant elevated access for a task and a time, and log it. The same rule applies to your cloud console, your payment gateway dashboard, your CRM exports and your bank portal. The finance team in particular should have dual approval for payments above a threshold; the “CEO on WhatsApp asking for an urgent transfer” fraud works because one person could act alone.
Email: make impersonation fail
Impersonation attacks rose 75 per cent in the UAE in 2024. DMARC set to reject stops others sending as your domain; impersonation protection in your mail platform catches look-alike names and domains; an external banner and a report button give people a fast way to be suspicious. Pair it with a rule in finance: no payment detail changes are accepted over email or chat without a call-back to a known number.
Backups that survive the attacker
UAE organisations that pay ransoms pay a high share of what is demanded, and the median demand runs above a million dollars. The only reliable defence is a backup the attacker cannot reach or alter, in a separate account with immutability turned on, covering SaaS data as well as servers, and restored successfully in a test at least quarterly. If you have not restored from it, you do not have a backup; you have a hope.
Source: Ransomware statistics compilation citing Sophos State of Ransomware 2025, UAE figures
Visibility, then segmentation
Central logs turn “we think something happened” into “this account signed in from a new country at 03:14 and downloaded 4,000 records”. Start with sign-in logs, admin actions and cloud audit trails; add endpoint alerts; buy monitoring from a managed provider if nobody in-house will watch the screen. Segmentation of the office network comes last because, once devices and identity are controlled, the office network is just another untrusted network.
Contractors, agencies and the systems you do not own
Small UAE companies run on outside help: a freelance designer with access to the brand drive, an agency with admin on the website, an accountant with the bank portal login, a courier integration with an API key that was created two years ago. Each is an identity, and each needs the same treatment as staff: a named account in your directory rather than a shared login, access scoped to the one system they need, an expiry date, and removal the day the engagement ends. For agencies with admin on your website or cloud, insist on their own MFA-protected accounts rather than a password you hand over, and rotate every API key and shared secret when a contract changes hands. The most common breach path we see in the UAE mid-market is not a sophisticated attack; it is a former supplier’s credentials that still work.
The most common breach path we see in the UAE mid-market is not a sophisticated attack; it is a former supplier’s credentials that still work.
| Outside party | Typical access today | Zero-trust version |
|---|---|---|
| Web or marketing agency | Shared WordPress admin, shared ad-account login | Named accounts with MFA, editor rather than admin where possible, removed at contract end |
| Accountant or bookkeeper | Bank portal credentials, full accounting admin | Read-only bank access, accounting role limited to their function, dual approval on payments |
| Freelancers | Files emailed around, personal Google Drive links | Guest access to one shared folder with expiry; no company data on personal drives |
| Integrations and APIs | Long-lived keys nobody remembers creating | Keys scoped per integration, stored in a secrets manager, rotated on a schedule and on staff change |
The same principles inside your product
If you build software for customers, zero trust applies to the product as well as the office. Services should authenticate to each other rather than trusting the network they share; customer data should be reachable only through APIs that check who is asking, not through a database open to anything inside the cloud account; admin tools should sit behind the same identity provider as everything else, with actions logged. The UAE’s data protection regime expects “appropriate technical and organisational measures”, and the sector regulators for finance and health go further. A product built on these lines passes an enterprise customer’s security questionnaire on the first attempt, which in this market is often the difference between winning the contract and being politely dropped.
What it costs and what it replaces
For a 50-person company already on Microsoft 365 or Google Workspace, most of the first seven steps are configuration of licences it owns, plus company devices for staff who do not have them, plus a managed detection service if in-house monitoring is unrealistic. The recurring cost is typically a few hundred dirhams per person per year on top of existing licences; the one-off cost is the laptops and the two or three weeks of someone’s time to do the reviews. Compare that with the regional average breach cost of roughly USD 7.2 million in IBM’s 2025 study, or, for a company your size, with the cyber insurance questionnaire you will not pass without these controls.
Source: IBM Cost of a Data Breach 2025, Middle East figure, via Bright Defense
Where you stand today
0 of 10
- Every staff account lives in one identity provider and every SaaS tool signs in through it
- MFA is enforced for everyone with no exceptions, using apps or passkeys rather than SMS
- Company data opens only on managed, encrypted, patched devices
- No one has standing admin rights; elevated access is granted per task and logged
- DMARC is set to reject and finance verifies payment changes by call-back
- Backups are immutable, in a separate account, and were restored in a test this quarter
- Sign-in, admin and cloud logs are central and someone is alerted on anomalies
- Guest, IoT and office networks are separate from company systems
- Leavers lose all access the same day through one action
- We have an incident runbook with a named owner and a 72-hour notification target
Seven or more and you are ahead of most companies your size in the region. Four or fewer and the next phishing email that lands is a coin toss.
OXEDGE runs this sequence for UAE companies as a fixed-scope engagement: audit, the eight steps, and a handover to your team or a managed provider. If you would rather know your score before deciding, the checklist above is the first meeting.
Questions UAE buyers ask
What are the primary cyber security threats facing businesses in the UAE?
The article cites 600,000 cyberattacks blocked in the UAE every day, a 32 per cent rise in ransomware attacks in 2024 and a 75 per cent rise in email impersonation. Its source also reports 83 per cent of UAE CISOs naming human error as the leading risk, which is why the people with the most access are the likeliest targets.
Do we need to buy a zero trust platform?
No. Steps one to seven can be done with the identity, device and email tools most companies already pay for. A dedicated access product for internal apps, contractors and legacy systems belongs in the second phase, once identity and devices are solid.
Which zero trust step should a small company do first?
Start with one identity provider and single sign-on into every tool, because every other control assumes you know who is asking. Connect or close every SaaS subscription on the company card, then enforce MFA with no exceptions.
Why is SMS not enough for MFA?
SMS codes are better than nothing, but they are the first thing an attacker targets with SIM swaps and are common in UAE fraud cases. Use authenticator apps or passkeys instead.
What does zero trust cost for a 50-person company?
For a company already on Microsoft 365 or Google Workspace, most of the first seven steps are configuration of licences it owns. The article puts the recurring cost at a few hundred dirhams per person per year on top of existing licences, plus company laptops and two or three weeks of someone’s time.
