Executive Summary
This analytical paper examines the roles and structures of intelligence agencies in the Gulf Cooperation Council (GCC) states and Iran within a complex regional context where conventional military conflict intersects with proxy wars and cyberattacks. In this environment, security is no longer measured by the size of armies or defense spending, but by the effectiveness of intelligence institutions in managing risks and preempting threats.
The study traces the structural evolution of Gulf intelligence systems, highlighting how strategic and technological partnerships with the United States, the United Kingdom, and Israel have driven substantial modernization. However, these partnerships have also introduced strategic dependencies that undermine sovereign and security decision-making, leaving Gulf states exposed to shifting geopolitical dynamics beyond their control.
The paper discusses the GCC’s ongoing failure to overcome deep-rooted coordination challenges. Persistent political rifts and diverging national priorities continue to obstruct the formation of a unified and effective intelligence system. Each Gulf state still operates according to its own threat perceptions, reducing regional intelligence cooperation to ad hoc coordination rather than a foundation for collective security.
By contrast, the paper explores Iran’s ideologically driven intelligence model, characterized by institutional integration between the Ministry of Intelligence and the Quds Force of the Islamic Revolutionary Guard Corps (IRGC), alongside other intelligence bodies. This framework grants Iran a significant degree of flexibility in managing the so-called “shadow war” through a regional network of proxies. However, it has also generated internal organizational chaos due to competing power centers and overlapping mandates, resulting in major intelligence failures—particularly in the face of recent Israeli operations.
The study highlights cyberwarfare as a central arena in the Gulf-Iran security landscape, where digital infiltration and information warfare are deployed with impact comparable to airstrikes or special operations. These tools have enabled both sides to penetrate critical infrastructure, influence public opinion, and reshape the contours of confrontation, blurring the lines between military and civilian, overt and covert.
While some Gulf states and Iran expand their intelligence reach through hard power, Oman exemplifies an alternative path. Muscat employs its intelligence apparatus as an instrument of mediation and confidence-building, demonstrating that intelligence can function as a platform for de-escalation, not merely as a tool of coercion and penetration.
The paper concludes that building a more effective intelligence architecture in the Gulf requires the establishment of a joint regional intelligence center dedicated to information-sharing, coordination, and early warning. This would help transcend internal disputes and narrow the trust deficit among GCC capitals. It also argues that launching a preventive intelligence dialogue with Iran, under the sponsorship of neutral parties such as Oman, could help reduce tensions and lay the groundwork for field-level understandings in conflict zones.
Furthermore, the study calls for diversifying Gulf technological partnerships by engaging with emerging global powers, thereby reducing dependency and addressing internal vulnerabilities within intelligence systems. In Iran’s case, the paper recommends restructuring institutional relations between the Ministry of Intelligence, the IRGC, and the police intelligence services to reduce organizational disorder and improve operational efficiency. This should be accompanied by a decisive and strategic approach to technical cooperation with China and Russia that strengthens Iranian autonomy and technological capabilities.
The paper is divided into seven main chapters. It begins with an analytical overview of the evolving security doctrines in the Gulf and Iran, followed by a detailed review of the intelligence structures in GCC states and an institutional analysis of Iran’s system. Subsequent chapters examine the patterns of cooperation and competition among Gulf states, the intensifying cyberwarfare between the two blocs, and the theaters of confrontation across regional hotspots. The final chapter offers reform-oriented proposals to strengthen intelligence governance in a region that oscillates between fragility and stability.
I. Introduction
The regional security landscape in the Gulf Cooperation Council (GCC) states and Iran is shaped by a complex web of evolving variables and challenges. These range from direct military escalation and conventional threats, to proxy wars in Yemen and Iraq, and extending into cyber conflicts and intelligence rivalries.
In this increasingly entangled environment, security equations are no longer determined solely by military size or firepower. Instead, the capacity to collect and analyze intelligence has emerged as a pivotal force in shaping rapid response strategies. Intelligence agencies have become the extended arm of political systems, serving as the primary instrument for protecting national interests.
Over the past decade, Gulf intelligence structures have undergone notable development, marked by the expansion of their operational mandates and tools. This progress includes enhanced capabilities in analyzing “dark metadata” and coordinating early warning systems through joint platforms with Western allies. The threat posed by Iran and its regional axis has further incentivized Gulf states to deepen their intelligence partnerships with the United States and the United Kingdom.
Iran, for its part, has adopted an ideologically grounded intelligence model that integrates the Ministry of Intelligence with the IRGC’s Quds Force. This has provided Tehran with a high degree of operational flexibility across a vast network of regional proxies. The Iranian system has demonstrated effectiveness in exploiting internal and regional contradictions to shape what is known as the “shadow war”—a strategy in which financial resources and political/media networks in countries such as Iraq, Lebanon, and Yemen are used to recruit local agents under the pretext of supporting resistance movements.
However, this model is not without its burdens. International sanctions have restricted Iran’s ability to modernize its technical infrastructure. At the same time, competition among domestic intelligence bodies has created redundancy and conflicting mandates, impairing the state’s capacity to respond swiftly to external threats.
Despite structural and ideological differences between Gulf systems and those of their Western partners and Iran, significant points of convergence exist. Intelligence competition now extends across proxy battlefields where money and information serve as force multipliers. It also manifests in the realm of targeted assassinations and special operations designed to neutralize military and political figures or cripple sensitive information systems.
This introduction sets the analytical framework for understanding how the Gulf–Iran regional environment has moved beyond traditional military confrontations. It now exists within a more sophisticated sphere, where the stability of the region depends significantly on the effectiveness, coherence, and foresight of its intelligence institutions.
II. Intelligence Agencies in the Gulf Cooperation Council (GCC) States
Saudi Arabia: Institutional Cohesion and Western Partnerships
Saudi Arabia’s intelligence landscape is composed of multiple agencies with complementary mandates, all reporting directly to the country’s senior leadership and administratively overseen by the Council of Ministers.
Externally, the General Intelligence Presidency (GIP) serves as the primary body responsible for collecting and analyzing foreign intelligence, monitoring cross-border threats, and tracking logistical support networks linked to entities deemed hostile to the kingdom.
Domestically, several agencies operate under the umbrella of the Presidency of State Security, established by royal decree on July 20, 2017. This body reports to the Council of Ministers and oversees all aspects of internal security. The State Security Presidency is tasked with combating terrorism and domestic espionage and with collecting intelligence on individuals or groups considered threats to the state. It supervises specialized security institutions, including the General Directorate of Investigations (known as Mabahith), the Special Security Forces, and the Special Emergency Forces. It also incorporates analytical and technical support centers such as the National Information Center and the National Security Center.
While these agencies exhibit a functional division of labor, coordination challenges persist. Sensitive files occasionally suffer from jurisdictional overlap, which may hinder rapid responses to sudden threats. Moreover, security priorities are often determined by circumstantial or personal assessments rather than strategic consensus.
Despite these issues, Riyadh benefits from consistent training programs organized by American and British intelligence academies, aimed at strengthening its personnel’s capabilities in data collection, strategic analysis, and threat assessment. Saudi Arabia also maintains close intelligence cooperation with the United States, which includes information-sharing and access to advanced surveillance technologies—particularly satellite imagery and remote sensing tools—used to monitor communications and the movements of adversarial groups in areas such as the Gulf, northern Yemen, and southern Iraq. This partnership represents a critical force multiplier for Saudi intelligence in an environment marked by volatility and protracted conflict.
United Arab Emirates: Centralized Control and Technological Sophistication
The United Arab Emirates’ intelligence system is anchored in the State Security Department (SSD), which operates under the direct authority of the head of state. The SSD is responsible for domestic intelligence gathering and wields expansive powers to monitor internet activity and telecommunications.
Alongside the federal apparatus, each emirate maintains its own internal intelligence body. Among the most prominent is the Dubai State Security Agency, which operates semi-independently while maintaining coordination with the federal SSD.
On the signals intelligence front, the Signals Intelligence Agency (SIA)—formerly the National Electronic Security Authority, established in 2012—focuses on intercepting communications and tracking cyber threats. Its mission includes the surveillance of encrypted communications and providing strategic intelligence through advanced data analytics to support national security operations.
Militarily, the General Directorate of Military Intelligence, under the Ministry of Defense, oversees the collection of strategic and tactical intelligence on external threats, armed groups, and regional military dynamics.
Since 2010, the UAE has undertaken a strategic overhaul of its intelligence infrastructure by recruiting Western experts and establishing a strategic analysis center in Abu Dhabi. This facility hosts specialists in artificial intelligence and data science, allowing for real-time coordination with Western agencies and the exchange of sensitive intelligence files.
Technological innovation has become a central pillar of the UAE’s intelligence posture. The signing of the Abraham Accords in 2020 catalyzed deeper cooperation with Israel, particularly with the Shin Bet and Mossad. These partnerships have extended into areas such as aviation security and the development of digital espionage tools.
Despite these advancements, the UAE’s intelligence apparatus faces several challenges. Chief among them is striking a balance between an open economic model that attracts foreign investment and the strict surveillance needed to monitor financial flows. This tension occasionally raises questions about financial transparency.
Additionally, the country continues to rely partially on foreign technical experts, especially in highly specialized fields. This reliance introduces potential vulnerabilities, particularly when these experts leave their posts, taking institutional knowledge with them. Furthermore, regional sensitivities persist, particularly among Oman, Qatar, and to some extent Saudi Arabia, which occasionally reassess the scope and depth of their intelligence cooperation with Abu Dhabi.
Qatar: An Intelligence Hub Amid Regional Vetoes
Qatar’s State Security Bureau was established in 2004 through the merger of the General Intelligence Directorate and the Department of Investigation and State Security. Subordinate to the Ministry of Interior, this agency is tasked with collecting domestic and foreign intelligence and plays a central role in countering internal crises, espionage, and threats to national security.
The agency conducts threat assessments and internal investigations related to suspected subversion, foreign influence, or espionage. Parallel to this entity is the Military Intelligence Directorate, an independent body reporting directly to the Emir. It focuses on collecting strategic and operational intelligence related to regional military threats and securing the safety of Qatar’s armed forces, installations, and infrastructure. It also produces assessments on both security and military developments.
A third intelligence body, the Financial Intelligence Unit, specializes in gathering and analyzing financial data to detect money laundering and terrorism financing.
Qatar has leveraged its extensive diplomatic networks with Islamist movements and its role as a mediator between adversaries—such as Hamas and Israel, the United States and the Taliban, and at times Iran—to build multi-layered intelligence channels. Its hosting of U.S. military bases has provided access to satellite surveillance and intelligence systems, which have improved the precision and scope of its intelligence capabilities.
Nevertheless, the 2017 Gulf crisis—during which Saudi Arabia, the UAE, Bahrain, and Egypt severed ties with Doha—exposed the geopolitical risks associated with Qatar’s intelligence activities. The country was accused of supporting political Islam groups, which led to a significant reduction in its intelligence-sharing with other GCC states. Qatar continues to navigate a delicate balance between maintaining its security autonomy and addressing the persistent regional pressure, which forces Doha into an internal dialogue over how to rebuild trust with its neighbors. This has required the state to manage a broad and sometimes contradictory array of international relationships.
Kuwait: Between Democratic Mandates and Security Pressures
Kuwait’s State Security apparatus faces an inherent structural challenge due to the tension between its elected political system—under which the National Assembly exercises oversight over security agencies—and the demands of confronting sectarian extremism.
Although relatively small in size compared to its Gulf counterparts, Kuwait’s intelligence service plays a vital role in maintaining internal stability. Since 2014, it has expanded its intelligence activities, particularly through cooperation with U.S. and British agencies, focusing on tracking terrorism financing and monitoring suspicious financial transactions linked to extremist networks.
However, the agency’s operational priorities are often shaped by political considerations and parliamentary pressure. The recent suspension of certain constitutional provisions and the dissolution of the National Assembly granted Kuwait’s security services broader latitude, albeit temporarily, to maneuver amid ongoing national debates about balancing public liberties with internal security.
Technically, Kuwait’s intelligence capabilities remain limited—particularly in areas such as big data analytics and advanced cyber surveillance—lagging behind the rapid modernization seen in Saudi Arabia, the UAE, and Qatar. As a result, the agency often finds itself torn between preserving domestic political equilibrium and responding effectively to emergent threats. This limits its regional impact, even if it remains relatively competent in managing internal security.
Bahrain: National Security Entangled with Sectarian Dimensions
Bahrain presents a unique intelligence case where political and sectarian dynamics are deeply intertwined. In a nation where the Shi’a population forms a numerical majority under a ruling Sunni alliance, any Shi’a-led political mobilization is often perceived as a direct extension of Iranian influence.
Since the 2011 uprising, Bahrain’s National Intelligence Agency has adopted a proactive surveillance posture focused on monitoring social media and deploying advanced eavesdropping technologies—developed through partnerships with Gulf and Israeli firms—to track opposition activists and preemptively disrupt potential protest movements.
This heavy-handed approach has come at a cost. The agency’s reliance on Saudi and Emirati technical support has created a persistent structural fragility. This is most evident in the perception among Bahrain’s Shi’a community that security institutions serve Sunni-centric geopolitical priorities rather than addressing inclusive national concerns.
In parallel, Bahrain maintains a Strategic Security Agency operating under the Supreme Defense Council. It is tasked with evaluating strategic threats, coordinating with allied states, and overseeing high-level counterterrorism operations.
On the military side, the Directorate of Military Intelligence—under the Bahrain Defense Force—monitors tactical and strategic threats, provides assessments to the military command, and manages aerial and technical reconnaissance units to support battlefield operations and detect suspicious military activity.
Oman: Intelligence of Neutrality and Subtle Influence
Oman has deliberately charted a distinct intelligence path from its Gulf neighbors by using its security institutions to preserve neutrality and facilitate mediation, rather than engaging directly in regional confrontations.
Its intelligence networks maintain open communication channels with all sides—Iran, the Gulf states, and the West. This role was pivotal during the Iran nuclear negotiations (JCPOA) between 2013 and 2015, when Oman served as a quiet intermediary between Washington and Tehran—a role it continues to play today in coordination with the Ministry of Foreign Affairs.
Domestically, Oman’s Internal Security Service handles internal surveillance and intelligence collection, counterterrorism, and the monitoring of threats to national stability. It reports to the Royal Office, which oversees intelligence policy and coordinates security efforts among various agencies.
Militarily, the Military Intelligence Directorate operates under the General Staff of the Sultan’s Armed Forces, collecting strategic and operational intelligence related to regional military activity and coordinating with regional and international partners.
The Sultan’s Special Forces—a paramilitary unit—also performs certain intelligence-related functions, though it is not a standalone intelligence agency.
Oman’s intelligence system enjoys a high level of international trust, positioning Muscat as a neutral and non-threatening intelligence actor. This reputation has allowed it to safeguard its interests and project “strategic neutrality” as a source of influence and strength.
III. The Iranian Intelligence Apparatus: Extensive Operations, Minimal Coordination
The roots of institutional intelligence work in Iran trace back to the reign of Shah Mohammad Reza Pahlavi, who established the SAVAK in 1957 with direct support from the U.S. Central Intelligence Agency and Israel’s Mossad. SAVAK functioned as a harsh internal surveillance tool targeting dissidents, communists, and nationalists, as well as monitoring any potential threats to the monarchy.
SAVAK gained notoriety for its brutality against opponents and its extensive domestic spying capabilities. Following the Islamic Revolution, SAVAK was dissolved and replaced with a new ideologically driven institution: the Ministry of Intelligence and National Security, which was officially established in 1984. This ministry assumed responsibility for domestic security, counter-espionage, and foreign intelligence operations.
The ministry underwent repeated restructuring to align with the nature of religious governance, combining the traditional functions of political security with the revolutionary state’s ambitions to build support networks beyond Iran’s borders.
Alongside the ministry, the Quds Force—part of the Islamic Revolutionary Guard Corps (IRGC)—emerged as an intelligence and operational body with an offensive character. It specializes in managing foreign proxies, conducting covert operations and assassinations, and coordinating the activities of groups and organizations affiliated with Iran. Over time, the relationship between the two institutions became functionally redundant—at times competitive, at others cooperative.
Loyalty to the Supreme Leader, the Islamic Revolution, and its principles and objectives is one of the core criteria for recruitment, which grants the system internal ideological cohesion. However, this also poses challenges when dealing with civilian institutions and technocratic sectors, and it limits opportunities for advancement within the intelligence establishment to favoritism, personal endorsements, and recommendations from high-ranking state officials.
Iran suffers from a proliferation of security decision-making centers. The Ministry of Intelligence, the Quds Force, IRGC Intelligence, and the Police Intelligence Unit all have overlapping jurisdictions, resulting in duplicated tasks and conflicting analyses and operations. This was starkly evident during the war with Israel on June 13, 2025, when these agencies failed to detect dozens of Israeli-affiliated sleeper cells operating inside Iran—cells that were equipped with advanced drones, communications systems, and tactical gear. The agencies also failed to anticipate the full range of Israeli strikes, which targeted high-ranking officials across Iran’s military and political structures.
Despite this, Tehran has demonstrated significant proficiency in managing proxy networks, especially by leveraging ideologically aligned militias and local allies to protect its interests without direct engagement in what has come to be known as the “shadow war.” While operationally capable, Iran’s intelligence services have in recent years experienced major leaks and security breaches—some attributed to Mossad—that have revealed weaknesses in internal safeguards and a decline in institutional discipline and coordination.
Parallel to its technological inferiority compared to the West, Iran has developed effective cyber-offensive tools (such as the Shamoon virus and cyberattacks on Saudi oil facilities) in cooperation with the IRGC. These capabilities have positioned Iranian intelligence as a consequential actor on the electronic warfare battlefield.
