Penetration testing in the UAE

Regulations we test against

UAE Information Assurance standard

The UAE IA standard, first issued by the former National Electronic Security Authority and still often called "the NESA controls", sets the baseline for federal entities and critical-infrastructure operators. Federal government entities also work to the Information Assurance Regulation published by the TDRA. Our reports map each finding to the relevant control, so your compliance team can close it against the standard without a second mapping exercise.

Dubai: DESC Information Security Regulation

Dubai government entities, and the semi-government companies that serve them, align to the Dubai Electronic Security Center's Information Security Regulation (ISR). Where you are in scope we report against the ISR domains as well as the federal standard, in a single report.

Central Bank of the UAE

Banks, finance companies and payment service providers licensed by the CBUAE are expected to test their digital channels independently and to evidence remediation. Our banking reports are built for that evidence trail, with the retest result in the same pack.

Data protection onshore and in the free zones

The federal Personal Data Protection Law applies onshore, while the DIFC and ADGM run their own data protection regimes. Findings that expose personal data are flagged against the regime your entity falls under, which matters for groups with both onshore and free-zone companies.

PCI DSS and ISO/IEC 27001

Card processors and merchants fall under PCI DSS requirement 11, and most UAE enterprises hold ISO/IEC 27001. Findings carry both references.

What is usually in scope

UAE scopes are usually broad: digital banking channels with their APIs, customer mobile apps on both platforms, cloud workloads in the hyperscalers' UAE regions, and the corporate perimeter with its VPN, email and identity provider. Free-zone authorities add multi-tenant portals used by thousands of registered companies. Retail and logistics groups add payment integrations, loyalty platforms and warehouse automation networks. Internal assessments cover Active Directory, segmentation between business units and the remote access used by managed service providers. Clients rolling out AI assistants or LLM features increasingly add those to scope; see AI security.

Delivery model

Most UAE work runs remotely from Muscat: same time zone, about an hour by air when an on-site day is needed. For internal network and wireless tests we travel to Dubai, Abu Dhabi or Sharjah, or ship a hardened drop-box that arrives within about two days. Evidence can be stored in the UAE on request.

Working with UAE procurement

Many UAE organisations buy through a supplier registration portal or a local integrator. We contract from Oman directly or through your preferred procurement partner, and send the security questionnaire answers, tester CVs and a sample report at scoping so the start date does not slip. Testing runs with daily syncs on your channel, and confirmed criticals are reported the same day. The report is in English with an Arabic executive summary on request, walked through with engineers and with the risk function, and the free retest follows your fix plan within 90 days.

Time-zone coverage

Gulf Standard Time, UTC+4, identical to Muscat, with no daylight saving on either side. Most UAE clients now work Monday to Friday while our office works Sunday to Thursday; we cover the overlap by default and schedule Friday sessions when your change window needs one.

Recent engagements

Tier-1 bank, mobile banking application

Certificate pinning bypass, insecure local storage and a business-logic flaw in transfers. Two criticals and five highs, all retested clean before the next app release.

Free-zone authority, company services portal

Access-control findings across a multi-tenant portal that let one registered company read another's documents. Remediation was walked through with the vendor in the room.

Logistics operator, OT segmentation

Warehouse automation network zoned away from the corporate estate, and vendor remote access moved behind a jump host.

All engagements are anonymised and described with client approval.

Why Vulnera here

The UAE market has many providers. Clients choose Vulnera for senior-only testers, findings reproduced before they are reported and a free retest, delivered from the same time zone at regional rates. We know the Fortinet and Cisco edges that front most UAE estates, Arabic-speaking testers are available for interviews and workshops, and our red team runs longer objective-based exercises when a scoped penetration test is not enough.