In the first half of 2025 the UAE was reported to rank ninth globally and second in the Middle East and Africa for the frequency of customers impacted by cyber activity, at 11.7%. Saudi Arabia ranked twenty-third globally and fifth regionally at 5.6%.
Read The Denominator
"Customers impacted" means customers of the research publisher. The 11.7% is the proportion of that vendor’s UAE customer base which experienced something the vendor classified as an impact.
A global ranking built on that denominator compares vendor customer bases, which differ by country in size, sector mix, organisation size and product configuration. A vendor whose UAE customers are large financial institutions and whose customers elsewhere are small businesses will produce a ranking that reflects its sales history.
This Is The Most Citable And Least Reliable Figure Format
A national ranking with a decimal place invites quotation in exactly the places the corpus warned about at 25-1123 and 25-1117: insurance pricing, supplier due diligence, investment risk.
The corpus has now applied this objection to Latin America at 25-1117, the United States at 25-0718, Asia-Pacific at 25-1206 and Africa at 25-1019. It is not a regional criticism. It is that almost every published national cyber ranking is a ranking of measurement.
What Could Be Said Instead
That 11.7% of one vendor’s UAE customers experienced a classified impact in six months, which is a real and useful number for those customers and for that vendor.
It becomes unreliable the moment it is turned into a position on a list of countries. Graded medium: the figure is accurately reported and the ranking derived from it is not supportable.
Built on published research reporting, listed below. It examines the basis of a ranking rather than disputing the underlying measurement. Corrections: corrections@forensicpost.com.