The UAE says attack attempts quadrupled to 800,000 a day. The number that matters is hours.

Nine attempts a second ^[17] is not a figure a duty roster meets directly; it is a filtering budget. Analysts working in shifts have held the line so far, by the council's own account ^[5], which means the automation in front of them decides what a human ever sees. Escalation thresholds tuned when the inbound rate was a quarter of the current one are now, in practice, a sampling rate rather than a queue.

The phishing side decays quietly. Awareness training teaches staff to notice the tells of a hand-written lure, and the council describes mail that is composed by a model, alongside automated flaw hunting and malware assembly ^[2]. Palo Alto Networks reports the same drift across the Gulf toward AI-assisted scams, password theft and fake corporate sites ^[12]. A control that depends on the attacker being careless has a shelf life.

The reporting also contains its own brake. The 800,000 figure in the August 10 statement is the figure Al Kuwaiti had already given in April ^[20], so four months of public record show a plateau rather than a climb. And the July intrusions at financial firms, assembled from phishing, software flaws and malicious code, were contained with no disruption to services ^[3]. The attempt rate is where it was in spring; the disruption column is still empty.

Vibin Shaju of Trellix calls the state actors' use of the technology a practical force multiplier rather than a fully autonomous weapon ^[11], which is the operationally useful framing. Multipliers change tempo and volume, not intent, and intent is where defenders get planning leverage. Haider Pasha of Palo Alto Networks names telecoms, energy and government services as the most tempting targets precisely because taking them down spreads damage past the first victim ^[14]. That is a target list, and lists can be pre-staged against.

Set against the speed story: the Justice Department's August 18 indictment of 17 Iranians covers a campaign running since 2013 that prosecutors say took research and designs from 144 U.S. universities and 42 companies ^[9]. Thirteen years ^[19]. The expensive part of that case was persistence, not tempo. A program re-pointed entirely at the hours-scale window ^[8] leaves the slow campaign funded by nobody.

The camera intrusions are the detail worth keeping. Check Point traced attempts on internet-connected cameras in the UAE, Qatar, Kuwait and Bahrain to Iranian operators starting February 28, and assessed that they wanted footage to correct missile targeting and estimate damage after strikes ^[16]. The asset that mattered there sat outside the data centre, and it was not the kind of thing a patch calendar is built around.