Pannysylvania Magazine

Dubai, UAE – September 15, 2026 – Cybersecurity strategies are often judged by what happens during an attack. Mohammed Saty believes leaders should look earlier.

For Saty, a strategic cybersecurity advisor and Director at PwC in Dubai, resilience can begin to weaken long before an incident occurs. The problem is not always a lack of technology, data, or security controls. In complex environments, organizations can have all three and still struggle to determine what matters most.

This challenge becomes more important as businesses, destinations, smart cities, critical infrastructure, and major developments become increasingly connected. Leaders may receive information about thousands of vulnerabilities, threats, assets, and third parties, but more information does not automatically create better decisions.

Strategic clarity means turning that complexity into priorities leaders can understand and act on. As Saty puts it, “Clarity turns complex cyber signals into decisive action.”

Why Cyber Strategy Fails Before the Attack

A cyber incident can expose weaknesses, but many of the decisions that determine an organization’s resilience are made well before an attacker arrives.

Leaders decide which assets receive the most protection, where security budgets are invested, which risks are accepted, how suppliers are managed, and which services must recover first after disruption. If those priorities are unclear, even a technically strong cybersecurity program can struggle under pressure.

This is especially relevant in complex destinations and large-scale developments.

A connected destination, for example, can bring together transportation, hospitality, entertainment, retail, public infrastructure, digital identity, payments, mobile services, and many third-party providers. Protecting every component in exactly the same way is neither practical nor necessarily useful.

The more important task is understanding what the destination cannot afford to lose.

Which services are essential to operations? Which systems support them? Which third parties create important dependencies? What would disruption mean for visitors, revenue, trust, safety, or reputation?

Answering those questions creates a clearer foundation for cybersecurity decisions.

Instead of starting with technology, leaders can start with the business outcome they need to protect.

What Leaders Miss in Their Risk Dashboards

Cybersecurity dashboards can give executives valuable visibility into risk. But visibility and clarity are not always the same thing.

A dashboard may show vulnerability counts, incidents, alerts, compliance measures, threat levels, and other indicators. The challenge is understanding what those numbers mean for the organization.

Ten vulnerabilities affecting a critical service may deserve more executive attention than hundreds affecting systems with limited business impact. A third-party issue connected to an essential destination service may matter more than a higher technical risk elsewhere.

Without business context, executives can be left with large amounts of security information but little guidance about the decision they actually need to make.

For Saty, the value of cyber reporting therefore depends on whether it helps leaders connect technical signals with business consequences.

A useful executive view should help answer practical questions. What could materially disrupt the organization? Which risks require action now? Where is investment most needed? What can be accepted? Who owns the decision?

That shift turns a cybersecurity dashboard from a collection of metrics into a tool for leadership.

The Cost of Seeing Every Threat Equally

Not every cyber threat carries the same consequence.

Treating threats as if they do can create a different kind of risk. Teams can become overwhelmed, resources can be spread too thinly, and genuinely important signals can disappear within the noise.

This becomes particularly challenging in large digital environments. Smart cities, tourism destinations, sporting venues, critical infrastructure, and major developments may contain thousands of connected assets operated by different organizations and suppliers.

Trying to give everything the same level of attention can make prioritization almost impossible.

A clearer approach starts with impact.

Leaders can identify the business services and experiences that matter most, map the technologies and third parties that support them, and then consider threats in the context of what could actually be disrupted.

This does not mean ignoring lower-level risks. It means understanding their relative importance so that people, investment, and attention can be directed where they have the greatest effect.

Cybersecurity becomes more useful to the business when it helps leaders distinguish between what is possible and what is important.

Resilience Requires Decisions, Not Just Defenses

Cyber resilience is sometimes treated as the ability to withstand an attack. In practice, it also depends on an organization’s ability to make decisions when conditions become uncertain.

When disruption occurs, leaders may need to decide which services to protect first, whether operations can continue safely, when recovery should begin, how partners should respond, and what information stakeholders need.

Those decisions become harder when priorities have not been established in advance.

For complex destinations, the challenge can extend across organizational boundaries. An incident affecting transportation, hospitality, payments, ticketing, or another connected service may require several organizations to coordinate quickly.

Resilience therefore depends not only on technical controls but also on shared understanding.

Leaders need clarity about critical services, dependencies, responsibilities, escalation paths, and acceptable levels of disruption. Building that understanding before an incident can make decisive action easier when time matters most.

Turning Cyber Complexity Into Business Confidence

The objective of cybersecurity is not to remove every possible risk. In highly connected environments, that is unrealistic.

The objective is to understand risk well enough to make better decisions about it.

For Saty, this is where strategic clarity can strengthen resilience. When executives understand what matters most, cybersecurity investment can become more focused, reporting more meaningful, and response decisions more deliberate.

That approach also allows cybersecurity to support innovation rather than slow it down.

Destinations, smart cities, sporting environments, and large-scale developments will continue adopting connected technology to create better experiences and new business opportunities. Leaders should not have to choose between transformation and security.

They need enough clarity to pursue both with confidence.

About Mohammed Saty

Mohammed Saty is a strategic cybersecurity advisor with more than 15 years of experience helping executives make confident decisions in complex environments. He combines deep technical expertise with a practical business perspective to turn cybersecurity, AI, and digital transformation challenges into clear priorities and actionable strategies.

His work spans complex environments, including smart cities, destination developments, major sporting events, critical infrastructure, and large-scale transformation. He has supported governments, ministries, and global organizations in aligning technology, risk, and business priorities to strengthen resilience and support long-term growth.

Originally from Khartoum, Sudan, Mohammed holds a Bachelor of Science in Mathematics from the University of Science and Technology. He is now a Director at PwC in Dubai, where his work has evolved from deep technical cybersecurity expertise into strategic advisory. Mohammed is known for asking the questions that uncover what matters, challenging assumptions, and making complex issues easier to understand and act on. His approach helps leaders build trust, make better investment decisions, reduce risk, and move forward with greater confidence.

Follow Mohammed Saty on LinkedIn for further perspectives on cybersecurity, destinations, technology, and executive decision-making.

Media Contact
Company Name: PwC Middle East
Contact Person: Mohammed Saty
Email: Send Email
City: Dubai
Country: United Arab Emirates
Website: https://www.pwc.com/m1/en.html