AmCham Saudi Arabia Committees
Thought Leadership Piece
Technology Committee
Cyber-Resilience Is Becoming the Operating System of Saudi Arabia’s AI Economy
At the AmCham Saudi Arabia Tech Committee’s LEAP reception, Securing Tomorrow: How Cyber-Resilience Accelerates Saudi Arabia’s AI Future, government and industry leaders considered a deceptively simple question: what if cybersecurity is not the brake on innovation, but what allows the Kingdom to accelerate safely?
That question is becoming increasingly important as the Kingdom advances its ambitions in artificial intelligence, cloud computing, smart infrastructure and digital services. Technology alone will not determine the pace at which these ambitions translate into adoption. Trust will.
Citizens, businesses and regulators need confidence that data remains secure, identities are protected, critical systems can withstand disruption and increasingly autonomous technologies operate within appropriate boundaries.
Saudi Arabia’s next cybersecurity challenge is therefore larger than defending a digitising economy. It is about building the trust architecture through which an increasingly autonomous economy can operate.
From protecting information to governing action
For decades, cybersecurity was largely organised around networks, users and data. Organisations protected their perimeter, controlled access and classified information according to sensitivity.
That model is now evolving.
Cloud services, interconnected technology ecosystems and increasingly autonomous AI systems are making organisational boundaries more fluid. More importantly, AI is beginning to change the nature of the security question itself.
The question is now: who, or what, is authorised to act, and with what consequences?
An AI system summarising internal documents presents a fundamentally different risk from one capable of initiating transactions or interacting with critical infrastructure. Yet both might use similar underlying technologies. That suggests a potential evolution in the way organisations think about classification.
We have long classified data according to sensitivity and applied protections accordingly. In an AI-enabled economy, we may increasingly need to classify workloads according to consequence.
Such an approach could consider the authority delegated to a system: what it can access, what decisions it can initiate, whether its actions affect other systems or the physical world, and how easily those actions can be reversed. Controls could then be calibrated to the consequence of the workload rather than applied uniformly simply because AI is involved.
Put differently, the future of AI cybersecurity may be about matching security to delegated authority and Saudi Arabia is already addressing the broader challenge of securing AI. In July 2026, the National Cybersecurity Authority opened its draft AI Cybersecurity Guidelines for public consultation. The Guidelines explicitly encompass generative and agentic AI and are structured around cybersecurity governance, defence, resilience and third-party cybersecurity.
Resilience as an economic capability
As digital environments become more interconnected, effective cybersecurity must include the ability to contain disruption, maintain critical functions and recover quickly.
This logic is already visible in Saudi Arabia’s strategic approach. The National Cybersecurity Strategy sets out the ambition for a “resilient, secure, and trusted Saudi cyberspace” that enables growth and prosperity. Its goals include adaptive risk management, cyber ecosystem assurance, dynamic defence, collaborative security and cyber ecosystem development.
The relationship between resilience and growth will become more important as AI moves beyond software and into infrastructure and services with real-world consequences. Cybersecurity cannot simply be added after deployment. Trust needs to be designed in from the outset.
Trust is becoming a market
The economic opportunity is already visible. The National Cybersecurity Authority reports that Saudi Arabia’s cybersecurity market reached SAR 15.2 billion in 2024, up 14% from 2023. Private-sector organisations accounted for 68% of expenditure, while the sector’s combined direct and indirect contribution to Saudi GDP reached approximatelySAR 18.5 billion.
The next phase of this market is likely to extend beyond conventional network defence. There is an opportunity around securing AI workloads and agents, managing human and machine identities, strengthening cloud and operational resilience, and addressing risk across complex technology supply chains. There is also a policy opportunity at play.
A workload-classification approach, for example, could provide one way of reconciling innovation with proportionate security. Rather than treating every AI deployment as equivalent, policymakers and businesses could consider whether safeguards should increase with the authority entrusted to a system and the consequences if that authority is misused.
This is not currently a formal Saudi regulatory model. It is, however, a question that deserves attention as AI increasingly moves from generating content to exercising agency.
Sovereignty without isolation
Saudi Arabia has clear interests in developing domestic technological capability, protecting sensitive information and maintaining appropriate control over critical systems. At the same time, international technology, investment, expertise and standards can contribute to the Kingdom’s digital ambitions.
These objectives should not be framed as opposites.
A more compelling model is sovereignty without isolation: clarity about the capabilities and outcomes that require sovereign control, alongside openness to trusted international collaboration. That creates a particularly important role for the Saudi and American business communities.
The opportunity, in addition to supplying cybersecurity products, is to help secure AI and cloud infrastructure, enable critical-infrastructure resilience, support skills and capability development, interoperability, standards and sustained public-private dialogue.
The next phase of the Saudi-US technology relationship can therefore be about building trust together, combining international capabilities with Saudi priorities, expertise and governance.