Most information leaks inside UAE companies do not start with a sophisticated attacker in a hoodie typing in a basement. They start with a tired employee forwarding an attachment to the wrong WhatsApp group, a receptionist writing a password on a sticky note, or a sales manager handing a client file to a courier instead of walking it to the recipient. According to the IBM Cost of a Data Breach Report human error and compromised credentials are consistently among the top causes of breaches worldwide, and the Middle East is no exception.

The UAE also has one of the stricter data regimes in the region. Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data companies that mishandle personal information face real penalties and reputational damage. That makes everyday staff behaviour, not just the IT stack, a core compliance issue.

Why these small habits turn into big leaks

Each of these actions looks harmless in isolation. The damage shows up when they combine. An employee reuses the same password across the office CRM and a personal shopping site. The shopping site gets breached and the credentials end up on a dark-web dump. A few weeks later someone logs in to the CRM at 3 a.m. from an IP in another country and quietly exports the client list. There was no “attack” in any dramatic sense, only a chain of ordinary choices.

Shared passwords are especially dangerous because they destroy accountability. If three people know the login, no one can prove who exported the file, who changed the invoice, or who sent the email. Audit logs become useless. For regulated activities, from financial services at DIFC to healthcare in Abu Dhabi, that alone can trigger a compliance finding.

• One account, one person, one password. No exceptions for “just this week”.
• Two-factor authentication on every work system that supports it, ideally through an authenticator app rather than SMS.
• Document handovers go person to person. Not through assistants, not through drivers, not through group chats.
• Suspicious messages get reported, not forwarded. If in doubt, call the sender on a known number.

That quote captures the real pattern. Technology is rarely the weakest link. The weakest link is the small, informal shortcut that nobody writes down and nobody audits. Which is why cultural training, clear policies and, when something goes wrong, proper business investigation services matter as much as the firewall.

Concrete actions to lock things down this quarter

If you lead a team in the UAE and want to reduce leak risk without hiring a full security department, start with a short, enforceable checklist. These are the moves that give the biggest return for the least friction.

• Issue every employee a unique login for every system. Delete all shared “info@” or “admin” logins used for daily work.
• Turn on two-factor authentication on email, accounting software, HR system and cloud drives. Make it mandatory, not optional.
• Replace WhatsApp as a document channel with a controlled tool such as SharePoint, Google Workspace or a secure portal.
• Train staff to recognise phishing with real UAE examples: fake Etisalat bills, fake DHL customs notices, fake bank OTP messages.
• Write a one-page handover policy: sensitive documents are delivered in person to the named recipient, never left on a desk or passed through a third party.
• Run a quarterly access review. Remove accounts of people who have left, changed role or no longer need the system.
• When an incident happens, investigate it properly. Log who had access, when, and from where. Keep evidence before overwriting it.