Issue 01 · MENA Edition · April 2026 Independent Research · No Sponsor Influence
The API Security Briefing
By Prophaze Research Vol. 1 / No. 1
Book a Demo
The Briefing · Issue 01

The API security crisis no one in MENA wants to discuss out loud.

Eighty-eight percent of Saudi organisations were attacked last year. The average breach cost is now SAR 27M. And the regulators are no longer asking nicely. A five-part briefing from the front lines of the GCC API security conversation.

The number that should keep every CISO awake
57%

of organisations suffered an API-related breach in the past two years. Of those breached, 73% experienced three or more separate incidents.

Source: Traceable AI · 2025 State of API Security Report
01
Part One · The Hidden Sprawl

The APIs your team doesn't know exist are the ones attackers find first.

In every cybersecurity conversation across the Gulf, there is a question that produces uncomfortable silences. How many APIs are running in your production environment right now? The honest answer, almost always, is some version of: more than the documentation says.

This is not a failure of competence. It is a structural consequence of how modern software is built. Development teams ship endpoints in days; security teams catalogue them in weeks. Test environments become permanent. Microservices replace monoliths and bring their own internal APIs along with them. Third-party integrations create new ingress paths that no one fully owns.

The numbers are not subtle. Per Traceable AI's 2025 research, organisations now run an average of 131 third-party APIs alongside their internal estate — and only 16% of those organisations say they can meaningfully mitigate the risks from those external integrations. The remaining 84% are operating with attack surfaces they cannot fully see.[1]

For the Gulf specifically, the consequences are not theoretical. Cyfirma's 2025 Saudi Arabia threat landscape report documented multiple high-profile breaches affecting delivery platforms, recruitment databases, government departments, and e-commerce backends — many of them tracing to unsecured or undocumented API endpoints. In several cases the database itself was not the original target; an exposed API was.[2]

The Numbers Behind Part One
131
Average number of third-party APIs in a modern enterprise environment
Traceable AI · 2025
30%+
Share of all data breaches now traced to API incidents — up from under 20% two years ago
SQ Magazine · 2026
63%
Security teams who now rank APIs as their single biggest data-exposure risk
SQ Magazine · 2026
15%
Organisations who say they are highly confident handling AI-driven API threats
SQ Magazine · 2026
02
Part Two · What Legacy Cannot See

Fifty-three percent of buyers will tell you the secret out loud.

The most striking finding in Traceable AI's research is not that organisations are being breached. It is that they have stopped pretending their existing defences are adequate. Fifty-three percent of organisations now openly admit that traditional WAFs and WAAPs are inadequate for detecting or preventing fraud at the API level.[3]

That number deserves a second look. A majority of security teams are saying — on the record, in vendor-funded surveys, in front of their CFOs — that the security stack they currently pay for cannot solve the problem in front of them. This is not a marketing claim. It is the buyers themselves describing the gap.

The reason is architectural. Legacy WAFs were designed for a different world: HTTP traffic to a small number of public-facing web applications, defended at the perimeter. Modern enterprise traffic is something else entirely — east-west flows between microservices, GraphQL queries that legacy parsers cannot inspect, GenAI agents making millions of authenticated calls without human oversight, and Kubernetes orchestrators spinning up endpoints faster than any rule-based engine can catalogue them.

The result is a category of attack — broken object-level authorisation, business logic abuse, authenticated bot fraud — that legacy WAFs were structurally never built to catch. Per Traceable, 95% of API attacks in 2025 came from authenticated sessions. The attacker already had valid credentials. The WAF did exactly what it was designed to do. The breach happened anyway.

§ § §
"

We spent three million dollars on security tools, we are still not compliant with SAMA, we still got breached, and my team is exhausted.

— CISO at a Dubai-based financial institution, quoted in Seceon Middle East Cyber Resilience Report 2025
03
Part Three · The Regulators

In Saudi Arabia and the UAE, compliance is no longer aspirational.

For most of the past decade, the cybersecurity regulatory conversation in the Gulf was framed around frameworks and intent — "alignment with international best practices," "voluntary adoption," "phased compliance roadmaps." That era has ended.

In January 2025, the Saudi Central Bank issued enhanced cybersecurity rules granting the National Cybersecurity Authority direct enforcement powers, including financial penalties of up to SAR 25 million — roughly USD 6.7 million per incident — for non-compliance.[4] This is not a recommendation. It is a quarterly board-meeting item.

Compounding the pressure: the NCA's Essential Cybersecurity Controls Version 2 (ECC-2), issued in 2024, expanded the framework to 114 controls across five domains — governance, asset management, risk management, people security, and technology protection. ECC-2 is mandatory not only for government entities but for any organisation owning, operating, or hosting Critical National Infrastructure, plus their full supply chains. The cryptography and application-security controls speak directly to runtime API behaviour.[5]

The Saudi Central Bank's SAMA Cybersecurity Framework — which is now mandatory for every licensed bank, insurer, and fintech in the Kingdom — covers cybersecurity governance, risk management, incident response, third-party security, and data privacy in a way that materially overlaps with NCA ECC-2. Dual compliance is not a convenience; it is a requirement. Non-compliance has, in documented cases, resulted in license suspension.

The Compliance Stack · KSA & UAE

Six frameworks with teeth.

KSA
NCA ECC-2

Essential Cybersecurity Controls, Version 2 (2024). 114 controls covering governance, application security, cryptography, and incident response. Mandatory for government, CNI & their supply chains.

Fines up to SAR 25M
KSA
SAMA Cybersecurity Framework

The Saudi Central Bank's framework for banks, insurers, and fintechs. Covers third-party risk, data privacy, and runtime application monitoring. Non-compliance can suspend operating licenses.

Licence Suspension
KSA
Cloud & Data Cybersecurity Controls

CCC-1:2020 and DCC-1:2022 mandate explicit encryption controls for data in transit and at rest, plus application-layer cryptography aligned with NCS standards.

Mandatory · Government Audited
KSA
SDAIA Cloud Mandate

By 2030, 80% of government workloads must reside on sovereign local cloud infrastructure. Vendors lacking data-residency support are effectively excluded from public-sector procurement.

Deadline · 2030
UAE
NESA & CBUAE Open Finance Regulation

UAE Information Assurance Standards (federal) and the Central Bank's Open Finance Regulation (April 2024). Mandate runtime application security controls and API security for licensed financial institutions.

Active Enforcement
UAE
PDPL & Abu Dhabi Digital Strategy

Personal Data Protection Law in active enforcement. Abu Dhabi Digital Strategy 2025–27 allocates USD 3.5 billion to digital infrastructure including cybersecurity hardening.

USD 3.5B Allocated
04
Part Four · The Hybrid Trap

Most GCC enterprises are running two security stacks that don't talk to each other.

If you ask a CISO at a Saudi bank or an Emirati insurance company to describe their current security architecture, you will almost always hear some version of the same story. There is an on-premises stack — usually mature, often older, defended by a legacy WAF that has been in production for years. There is a cloud stack — newer, more dynamic, running across AWS, Azure, or Google Cloud, defended by whatever native controls came with the platform. And there are the APIs that connect them.

This is the structural blind spot. Two policy engines, two log streams, two operational teams, and a population of API endpoints sitting in the middle that neither side fully owns. Per Seceon's 2025 review of more than fifty Middle East organisations, the typical enterprise runs 8 to 12 disconnected security tools, manages three separate dashboards, retains two compliance consultants — and still faces more than 200 daily alerts. After eighteen months of spending USD 2–5 million annually, many of these organisations remained both non-compliant and unsuccessfully breached.[6]

The Dubai CISO quoted earlier in this briefing is not an outlier. The frustration is regional. And the architectural diagnosis is consistent: the gaps between the systems are where attackers operate, while security teams are buried in noise from inside the systems they can already see.

The way out is not another tool. It is a single platform that can see the API layer everywhere applications run — Kubernetes clusters, cloud workloads, bare metal, hybrid integrations — with one policy engine and one unified inventory. The challenger vendors that solve this architecturally, rather than by stitching legacy products together, are the ones GCC CISOs are now actively evaluating.

Vaisakh T R · Founder & CEO, Prophaze · Photographed Milpitas, CA
Part Five · The Founder's Note

Why we built Prophaze the way we did — and what we're getting wrong by being too quiet about it.

When my co-founder and I started Prophaze in 2019, we did not set out to build a "next-generation WAF." We set out to solve a problem that legacy WAF vendors were structurally not going to solve — because their architectures, their pricing, and their go-to-market motions were all built around a different decade.

The decision that defined us was choosing to build Kubernetes-native from day one. Not as a deployment option. As the foundation. If your applications live in containers — and increasingly, they all do — your security has to live there too. Bolting an appliance in front of a Kubernetes cluster and calling it a WAF is, at this point, an architectural insult to the engineers running modern infrastructure.

The second decision was harder. We chose to deliver Prophaze as a fully managed offering. Not a product you buy and try to operate yourself with a stretched two-person security team. A managed service operated by people who do this all day, priced at a fraction of what the legacy WAF vendors charge for software you still have to run yourself.

The thing we have been bad at — and this briefing is part of correcting it — is telling the story of why these decisions matter in markets like Saudi Arabia and the UAE, where data sovereignty is no longer optional, hybrid infrastructure is the rule rather than the exception, and CISOs are being asked to demonstrate continuous runtime API visibility to regulators who can suspend their employer's operating licence.

If any of that resonates, the full CXO Wire interview goes deeper into the technical and architectural decisions behind Prophaze. There is no demo at the end of it. Just the story.

Read the full CXO Wire interview
Talk to Prophaze

Ready to see it on your APIs?

Book time directly with the Prophaze team — no forms, no waiting on a follow-up email. Pick a slot below.

Also in this Series
View All Briefings →
Forthcoming · Issue 02
The Bot Economy: Why 53% of GCC enterprises are now under continuous API bot attack.

Bot-driven attacks now constitute over 60% of malicious API traffic. The economics, the vectors, and what mitigation actually looks like.

Forthcoming · Issue 03
Inside SAMA's 2026 audit cycle — what BFSI CISOs are quietly preparing for.

A field report based on conversations with twelve security leaders at Saudi banks and insurance firms preparing for the next mandatory audit.

Featured · CXO Wire
The full Vaisakh T R interview: building a challenger in a market dominated by incumbents.

A long-form conversation on Kubernetes-native security, managed-service economics, and why "next-gen WAF" is the wrong category name.