Survey shows gaps in cybersecurity policies and employee commitment leave organizations in Saudi Arabia vulnerable

A recent Kaspersky survey entitled “Cybersecurity in the workplace: Employee knowledge and behavior”, showed that 45% of professionals in Saudi Arabia, consider cybersecurity rules in their company to be excessive or not fully appropriate. While 8.5% noted that their organizations do not have cybersecurity rules or that they are not aware of them.

These results show a disconnect between corporate cybersecurity policies and employee commitment to these rules, underscoring the risks associated with shadow IT and unmanaged device usage in the workplace.

Shadow IT is defined as the use of unauthorized software, devices, or services without IT oversight, and it has evolved into a critical business risk. While often driven by employee productivity needs, it creates blind spots for IT departments. The rise of hybrid work environments, increased reliance on cloud-based tools and the spread of AI tools have accelerated this trend. Without robust cybersecurity management and oversight, organizations face heightened exposure to ransomware attacks, data leaks, and regulatory penalties.

19% of survey respondents said there are no policies regarding the use of non-corporate devices in their company. 42% of employees admitted that they can use their own devices to access business information, provided they have some type of cybersecurity protection, even consumer-grade software. On the positive side, 20% said they can use their own device, but these must first pass more stringent corporate IT security checks; while 19% of respondents indicated that only devices provided by the IT function can be used for work purposes.

The situation is significantly better with permissions for employees to install software on corporate devices without IT department’s approval. 42% reported that only IT specialists in their company are allowed to install software, while in 38% of organizations only top management or designated users can do so. 9% of employees can install software that is approved by the IT team. However, 11% of respondents said that all users can install any software they need without IT agreement in their organization.

At the same time 25% of professionals surveyed acknowledged that within the past year they installed software on their work devices without IT supervision. That highlights a persistent shadow IT challenge that continues to expose organizations to security vulnerabilities, compliance risks, and data breaches.​
“Shadow IT is now a mainstream operational risk.

When one in five employees installs software without IT oversight, it signals a policy gap. Many organizations already have security policies in place, but employee perception must also be considered. Organizations should move beyond restrictive controls and instead implement intelligent, user-centric cybersecurity strategies that combine strategies that integrate technology with employee awareness and responsible use,” said Toufic Derbass, Managing Director for the META region at Kaspersky.
To help organizations strengthen their defenses, Kaspersky recommends the following:

• Conduct a Shadow IT audit to identify all unauthorized software, cloud services, and personal devices accessing corporate data.
• Implement robust monitoring and cybersecurity solutions, for example from the Kaspersky Next product line with EDR and XDR tiers, to gain visibility into unsanctioned app usage and device behavior.
• If employees are allowed to use personal devices, define clear minimum security requirements and enforce them through such solutions as mobile device management (MDM) or endpoint management tools.
• Complement user-friendly cybersecurity policies for employees with trainings that demonstrates real-life risks and ways to avoid them. Solutions such as Kaspersky Automated Security Awareness Platform can help.
  For employees Kaspersky experts advise:
• Understand your company’s cybersecurity policies. If anything is unclear, ask for clarification.
• Only use applications that have been approved by your IT department and request access to specific IT resources when needed.
• Use only authorized devices for work. If personal devices are allowed, make sure they meet all required security standards and have appropriate cybersecurity solutions installed.
• Store and share work files only through approved platforms.

*The survey was conducted by Toluna research agency at the request of Kaspersky in 2025. The study sample included 2800 online interviews with employees and business owners using computers for work in seven countries: Türkiye, South Africa, Kenya, Pakistan, Egypt, Saudi Arabia, and the UAE.