As app portfolios outpace traditional App Security models, UAE enterprises face mounting scan overhead and rising platform costs. Here, Asma Zubair, Director of Product Management at Qualys, explores how AI-powered adaptive scanning offers a smarter path forward, tailoring detection plans to each application’s current state and building lasting trust between security and engineering teams.

In the tech-savvy United Arab Emirates (UAE), where digital services and AI-enabled transformation are central to public- and private-sector competitiveness, enterprise applications have become the front door to customer experience. On Google Play alone, according to one source, as of February 2025, more than 820 Emirati developers had uploaded upwards of 2,300 apps, accounting for more than 2 million downloads. Unfortunately, the security provisions that protect those apps from adversarial interference have been unable to scale in parallel. Application portfolios now span business units, cloud environments, APIs, and frequent release cycles. Security programs must therefore scan more assets, more often, without slowing down the teams that build them.

This misalignment has not occurred because of inaction or underinvestment. It has occurred because app ecosystems’ growth has outpaced that of security models. If an organization builds a large enough app portfolio across business units, regions, development teams and perhaps even brands, scale emerges as a problem. Available time and resources may be dwarfed by the ecosystem. Full scans remain necessary for validation and compliance, but they are often too broad and time-consuming to run before every release. In API-heavy, cloud-native, and multi-cloud environments, the challenge is even harder: the estate changes continuously, and static scan profiles can become stale as quickly as applications are updated.

It is likely that AppSec reviews will reveal gaps that can no longer be mitigated by old measures, the problem is operational, not theoretical. Many organizations try to compensate with adjacent approaches like policy-as-code, external attack surface management, IDE-based scanning, or automated remediation. These approaches matter, but only address certain parts of the development lifecycle. They help define policy, discover assets or respond to detected issues. We are still left with the scaling issue and how it affects scanning efficiency.

A helping hand from adaptive scanning

The core challenge is how to optimize vulnerability testing for each application, without relying on static scan profiles that must be manually updated with each version. AI-powered scan optimization addresses this by profiling an application and generating a detection plan appropriate to its current version — structure, technology stack, and observed behavior. While periodic full scans will still be needed for major technology, functionality or architecture changes in the application, the AI approach is a major step towards addressing application estate sprawl.

Under this model, there will be reduced dependency on manually maintained scan templates and static detection profiles. The AI-powered scanning system profiles each application and creates its own detection plan, prioritizing relevant checks based on application behavior and structure. By combining validation and operational scans, security teams get appropriate coverage across releases, and the engineering function does not face the unwelcome friction of running full scans before the deployment of every new version. Bench tests have shown that scan times decrease by up to 80%, while meaningful coverage is maintained.

This strategy does not skip checks; it conducts them where they matter most. In some environments, high-frequency scanning can increase cost because platforms such as CMS systems, API gateways, or cloud infrastructure may be priced or constrained by request volume. In others, excessive scan traffic consumes application capacity or forces security teams to negotiate scan windows based on operational limits rather than risk. DevSecOps can review whether scan frequency has a direct relation to platform cost and bring this up at the next budget meeting. Then they can encourage decision makers to migrate from static, one-size-fits-all scan configurations to the more dynamic AI-driven profiling. AI can drill down into an application’s stack dependencies and tailor a scan to fit the chain. This will reduce redundant or low-value checks, lowering scan overheads, without turning routine security testing into a manual tuning exercise.

For AppSec leaders, this creates a stronger business case. The discussion is no longer only about finding vulnerabilities. It is also about reducing unnecessary scan load, controlling platform costs, and making security testing sustainable at enterprise scale. To validate the value added by automation, scan duration, request volume, scan completion rates, detection quality and coverage quality over time should be evaluated together to ensure that reductions in scan traffic do not degrade detection accuracy. When AppSec scales up, the organization will discover that redundant scan loads are reduced, which lowers infrastructure and platform costs. So, when bringing a security case to stakeholder colleagues, AppSec managers are backed by a robust, cost-based narrative.

Building trust across builds

DevSecOps must make security testing compatible with CI/CD build pipelines, so that comprehensive protections remain in place as app demands grow. This may be as straightforward as establishing scan times that are acceptable for development teams and fit in with their release schedules. If this compatibility cannot be achieved, pressured engineering teams will come up with ways to circumvent security testing requirements. AI-powered scan optimization can be used to automate the scoping of each scan to the application’s current version. By making scans laser-relevant to the application’s current state, the scans will be fast enough to run for every build, while remaining accurate enough to be trusted.

UAE enterprises and their DevSecOps teams have an opportunity to address the AppSec burden before it becomes too overwhelming to address. AI can automate the mundane, repetitive scan-planning tasks, leaving security teams to get involved at prearranged critical validation milestones. The result will be a more sustainable application security operating model: one that supports faster releases, broader coverage, lower operational friction, and stronger trust between security and engineering.

By Asma Zubair, Director of Product Management, Qualys

Related post

View all