AI-agent security for UAE firms: act now or wait?

Should UAE businesses buy AI-agent security now?

Most UAE businesses should not rush to buy AIR or a similar specialist platform. They should first find out whether AI agents are already using company data, external tools or employee-owned accounts. If agents are connected to important systems, a controlled security review is justified now.

AIR has emerged from stealth with $50 million raised across two seed rounds. The first raised $10 million and was led by Sequoia. The second raised $40 million and was led by Greenoaks. The company was founded by Yair Saban and Niv Hoffman, who previously worked in Israel’s Unit 8200 intelligence corps.

The immediate issue is not whether your business uses AI. It is whether an AI agent can act through tools that nobody has properly approved.

What does AIR’s AI-agent security platform do?

AIR focuses on the software supply chain around AI agents. That includes skills, plugins, Model Context Protocol servers, sub-agents and other add-ons. These components give an agent new instructions, data sources or actions.

According to AIR’s announcement, its product is designed as a firewall for the context an agent receives. The company says it can discover agents across an organisation, inspect the components they use and filter untrusted inputs before they reach the agent.

TechCrunch reports that AIR also has an enforcement layer. It can intercept actions such as loading a skill or retrieving content from the internet. Components are checked against a whitelist, and the company maintains a marketplace of add-ons it has assessed.

That is different from a one-off software scan. AIR’s argument is that an approved add-on can become risky later. A downloaded package may change. A developer account may be compromised. External instructions may also change after deployment. The security process therefore has to repeat throughout the component’s lifecycle.

What does AIR’s funding mean for business buyers?

The funding does not create a new requirement for every company. It does show that a distinct security category is forming around AI-agent tools. AIR says it has more than 20 customers, with about a quarter being large enterprises. It has seen especially strong demand from financial services and pharmaceutical companies.

AIR also says its system currently filters out about 27% of the add-ons and skills it finds online. That figure comes from the company’s own assessment, so it should be treated as a product claim rather than an independent industry benchmark.

For a UAE business, the practical change is a shift in the control question. It is no longer enough to ask which AI model an employee is using. You also need to ask which agent is running, what permissions it has, which tools it can call, where those tools came from and whether they can change without review.

That matters most when an agent can access customer records, finance data, product catalogues, internal documents, email or business systems. Businesses already reviewing ERP and automation options should include agent permissions and third-party add-ons in the same conversation.

When should UAE businesses act on AI-agent security?

Act now if your team is allowing agents to take actions rather than simply answer questions. Start with an inventory. Identify sanctioned and unsanctioned AI tools. List every connected data source and external service. Remove unnecessary permissions. Require approval before a new plugin, skill or MCP server is connected.

You do not need AIR to complete that first exercise. A written register, named owner and approval process may be enough for a smaller company. If you are already running several agents across departments, or the agents can reach sensitive systems, specialist tooling becomes easier to justify.

The market is still young. AIR has competitors offering discovery, access controls, runtime monitoring and MCP protection. AIR’s stated difference is continuous vetting of the add-on ecosystem, rather than discovery alone. That is a sensible problem to solve, but the company is only now coming out of stealth and has disclosed an early customer base.

The honest answer for most small and mid-sized UAE firms is therefore not yet. Do the control work first. Revisit specialist products when you can describe the agents, permissions and add-ons that need monitoring.

For a deeper look at the decision, see whether UAE businesses need AI-agent security yet. Paknology has a commercial interest when an AI-control project forms part of wider ERP and automation work. If you only need a basic register and approval process, a cheaper internal process may serve you better.

What should UAE businesses do next?

Ask each department to list its AI agents, connected tools and data access. Put an owner against every item, block unapproved connections and only then assess whether a specialist security platform is warranted. If the work sits within a broader automation project, talk to us about the systems and controls involved.