Gulf outlets are running incompatible figures from the same cybersecurity study

Gulf News published the research under the line that the UAE has the highest cyberattack rate in the Gulf, giving the country 35 percent of regional attacks. TechITUp ME published the same vendor’s H1 2026 findings under the line that 50 percent of Gulf cyberattacks targeted the UAE and Saudi Arabia jointly. Nukta carried a version as well. All three pages registered a page age of roughly one week. The two framings are not reconcilable as stated: one attributes just over a third of regional incidents to a single country, the other splits half across two. They may rest on different cuts of the same underlying data — attacks on organisations versus attacks including individuals, or successful intrusions versus attempts — but nothing in the headline framings tells a reader which, and the number that gets quoted onward will be whichever one an outlet happened to see first.

The underlying release is the thing to read, and it is the thing nobody appears to be citing. Absent the primary document, three unresolved variables sit behind every percentage in circulation: the sample size, the precise months covered by “H1 2026”, and the definition of an attack being counted. A vendor percentage without a denominator is a marketing figure, and vendor threat statistics have a structural incentive to describe the market the vendor sells into as the most targeted one. That is not an accusation against Positive Technologies specifically; it is the standing condition of the genre.

Assessment: This is how a number becomes infrastructure. Within a fortnight one of these two percentages will be a line in a government press release or a conference keynote, cited to a regional newspaper rather than to the study, with the denominator permanently detached. The UAE and Saudi both have live national-cyber-strategy communications operations for which “most targeted in the region” is a useful frame — it justifies budget and signals seriousness simultaneously. The corrective is dull and available: go to the vendor’s own release, find the sample and the period, and refuse to publish the tile until you have both. We have not published one here.