Security decisions often sit with a founder, CTO or external IT provider rather than a dedicated CISO. For SMEs and software companies operating in the UAE, Saudi Arabia and Oman, four developments bring practical questions into focus: who can reach your systems, where work data goes, and whether the technology supporting your team still receives security fixes.
BeyondTrust: a fresh disclosure requires a look back
On 15 October, BeyondTrust disclosed CVE-2026-102764 in Remote Support. Mandiant reported exploitation in late August, including persistent access and log deletion. The fresh development is the public disclosure and investigation guidance; the underlying intrusion activity predates this week. Neither report identifies a GCC victim. [1][2]
For an SME using outsourced IT, applicability depends on whether its provider uses the affected technology and what that access can reach. A compromised support appliance could put connected systems or credentials at risk. Ask the provider to confirm the product, hosting model, patch status and exposure window.
BeyondTrust lists Remote Support versions through 26.2.3 as affected. Self-hosted deployments on 24.3.1–26.2.3 need the BT26-05-RS patch; older deployments must upgrade before applying it. The vendor says SaaS tenants were patched by 9 October. A hosted service being patched does not resolve questions about earlier exposure. [1][2]
Where exposure or suspicious activity warrants investigation, preserve evidence and follow the vendor and Mandiant guidance. External logs matter because on-appliance records can be deleted. Separate patch verification from the assessment of earlier access. [2][3]
UAE AI research: put a named owner behind each tool
New research from Microsoft, CPX and IDC, announced on 16 October, surveyed 175 senior security and technology executives across UAE enterprises. CPX reports that 43% of CIO respondents acknowledged regular employee use of unapproved AI tools. These are vendor-backed enterprise survey findings; applicability to smaller businesses will vary. [4][5]
For a software house, the immediate issue is whether code, customer records or support tickets enter an AI service without an approved handling decision. Potential consequences include disclosure of confidential material and difficulty answering a customer’s security questionnaire.
The study recommends an inventory of AI systems and their data, approval processes and permission boundaries. Start with the tools employees actually use, record an accountable owner and decide what information each tool may receive. Include integrations and AI agents that can read repositories or take actions. [4]
UAE-hosted threat intelligence: ask for the full data path
On 15 October, WAM reported that the UAE Cyber Security Council and etisalat UAE had developed Discovery Secure, a UAE-developed and UAE-hosted threat-intelligence platform. It remains at proof-of-concept stage. The announcement describes controlled access, traceability and governance; it does not establish general commercial availability. [6]
For businesses comparing security providers, this is a useful prompt to make hosting claims specific. Azure’s own documentation, for example, distinguishes regional services, replication and service-specific exceptions. A region label alone does not describe every data flow. [7]
Ask where assessment evidence, reports, logs and backups reside; where AI processing occurs; and who can access them for support. Request answers for the service and configuration being purchased. Clear answers can reduce procurement uncertainty.
Windows: check the edition as well as the update status
Microsoft’s 13 October notice confirmed the end of updates for Windows 11 version 24H2 Home and Pro. The October security update is the final monthly update for those editions. Version 24H2 Enterprise and Education have a different lifecycle and remain supported into October 2027. [8][9][10]
For an SME whose staff or contractors use Windows Pro, a device can have October’s updates installed while still needing a supported feature release for future protection. This is a servicing milestone, not evidence that a device has been compromised.
Ask IT to identify the edition and feature version, check upgrade eligibility and application compatibility, and schedule the move to a supported release. Record exceptions and an owner. Avoid treating every device labelled “Windows 11” as having the same support deadline. [8][9][10]
Three actions for this week
- Verify support access: identify relevant remote-support services and obtain patch and exposure evidence from the responsible provider. Escalate investigation questions separately. [1][2]
- Map work data: list AI tools and security-service data flows, with owners, permissions and documented handling decisions. [4][7]
- Close support gaps: check Windows editions and versions, then assign dates and owners for required upgrades. [8][9][10]
A useful customer question for an MSP or software partner is: “Which external tool can reach our systems or receive our data, and who can show that its controls are working?”
If the review uncovers uncertain application exposure or access controls, use the findings to scope an authorised security assessment with Nordic Defender. MSPs supporting GCC customers can discuss assessment collaboration around a defined customer need through the same assessment route. [11]
Sources
1. BeyondTrust — Security advisory BT26-05: CVE-2026-102764 — Published / updated 15 October 2026.
2. Google Threat Intelligence Group / Mandiant — ARMORY CASTLE Exploits BeyondTrust — Published 15 October 2026.
3. BeyondTrust Security Team — ARMORY CASTLE and BT26-05: What Security Teams Need to Know — Disclosed 15 October 2026; last updated 16 October 2026, 12:00 p.m. EDT.
4. CPX, reporting research with Microsoft and IDC — New IDC study identifies governance gap as AI adoption accelerates across UAE enterprises — Published 16 October 2026.
5. CPX / Microsoft / IDC — Securing AI in the UAE Enterprise — public report summary — Page dated 14 October 2026.
6. Emirates News Agency (WAM) — Cyber Security Council, etisalat UAE develop Discovery Secure platform to strengthen cyber threat intelligence visibility — Published 15 October 2026, 18:55 UAE time.
7. Microsoft Azure — Data residency in Azure — Publication / update date not stated; standing service documentation.
8. Microsoft Learn — Windows message center — Windows 11, version 24H2 (Home and Pro) and Windows 10 LTSB 2016 have reached end of updates — Relevant announcement dated 13 October 2026, 10:00 Pacific Time.
9. Microsoft Lifecycle — Windows 11 Home and Pro — release support dates — Page publication / update date not stated; live lifecycle schedule.
10. Microsoft Lifecycle — Windows 11 Enterprise and Education — release support dates — Page publication / update date not stated; live lifecycle schedule.
11. Nordic Defender — Penetration Testing as a Service