# Penetration testing in the UAE: what it costs, what you get and how to choose a provider

> Which UAE rules require a penetration test, what tests cost in 2026, how to scope one and how to choose a provider whose report stands up, with a budget estimator.

- Page: https://oxedge.com/insights/penetration-testing-in-the-uae/
- Markdown: https://oxedge.com/insights/penetration-testing-in-the-uae.md
- Language: en-AE
- Type: Insight (article)
- Published: 2026-10-01 (Updated: 2026-11-06)
- Author: Haris Qarni, Founder & Director (https://oxedge.com/about/haris-qarni/)
- Category: Security & Cloud
- Publisher: OXEDGE (Oxedge FZE LLC), digital agency in Dubai, UAE: https://oxedge.com/
- Contact: info@oxedge.com · WhatsApp +971 50 815 3521 · https://oxedge.com/contact/

---

**Quick answer:** Penetration testing in the UAE typically costs AED 8,000–25,000 for one web application and AED 35,000–90,000 for a full VAPT at a mid-size organisation, plus 20 to 30 per cent for retesting, according to eShield's 2026 Dubai guide. Insist on manual testing, not a scanner export, and choose a CREST-accredited firm.

Sooner or later a UAE company is asked for a penetration test: by a regulator, a bank, a government client, a payment provider or an enterprise customer's security questionnaire. The quotes that come back can differ several times over for what sounds like the same job, and the reports range from genuine attack narratives to a scanner export with a logo on the cover. This guide explains what you're actually buying, which UAE rules require it, what tests cost here in 2026, how to scope one and how to choose a provider whose report will stand up to scrutiny.

**32**: Penetration testing firms certified under Dubai's CyberForce programme

**12 months**: Longest gap PCI DSS allows between internal and external penetration tests

**AED 5,000**: Below this, one 2026 Dubai pricing guide says a meaningful-scope quote should raise concern

**30%**: Upper end of the retest add-on the same guide suggests budgeting

Sources: [Dubai Electronic Security Center, certified providers list (accessed October 2026)](https://www.desc.gov.ae/regulations/certified-providers/) · [PCI DSS v4.0.1 Requirement 11.4 explained, Stingrai](https://www.stingrai.io/blog/pci-dss-penetration-testing-2026) · [eShield IT Services, Penetration testing cost Dubai 2026](https://eshielditservices.com/penetration-testing-cost-dubai-2026/)

## What a penetration test is, and what it isn't

A penetration test is a time-boxed, authorised attempt by skilled people to break into a defined set of systems, chain weaknesses together and show what an attacker could actually reach. That last part is what separates it from a vulnerability scan, which lists known weaknesses automatically but doesn't prove any of them can be exploited. Both have a place; they're different purchases, and the most common buying mistake in this market is paying test prices for a scan.

| Type | Question it answers | Typical scope | When you need it |
| --- | --- | --- | --- |
| Vulnerability assessment | Which known weaknesses exist? | Automated scanning with light validation | Monthly or quarterly hygiene; not a substitute for a test |
| External network test | What can someone on the internet reach and exploit? | Public IPs, VPN, mail and remote-access gateways | Annually and after infrastructure changes |
| Internal network test | If one laptop is compromised, how far can an attacker go? | Office network, Active Directory or Entra ID, servers | Annually; after mergers or office moves |
| Web application test | Can users see or change data they shouldn't? | A web app across its user roles, including business logic | Before launch and after major releases |
| API and mobile test | Can the app's back end be abused directly? | API endpoints, authentication, the iOS or Android client | Any product with a [mobile app](https://oxedge.com/mobile-app-development-dubai/) or partner API |
| Cloud configuration review | Are identities, storage and networks in AWS, Azure or Oracle set up safely? | IAM, storage policies, exposed services, logging | After migration and annually |
| Red team exercise | Would we detect and stop a determined, realistic attacker? | Objective-based, often including phishing and physical access | Mature organisations with a security operations function |

## Who in the UAE has to test, and how often

There's no single federal rule requiring every company to commission a penetration test. Instead, the obligation arrives through your sector regulator, your clients or your payment setup. The main drivers in 2026 are below.

| Driver | Who it covers | What it asks for |
| --- | --- | --- |
| CBUAE Operational Risk Management Regulation (C 1/2026), in force 14 September 2026 | All licensed financial institutions, not only banks | Periodic testing that includes a penetration test by an independent external party, with results presented to the board |
| Dubai Information Security Regulation (ISR), maintained by DESC | Dubai Government Entities, including consultants and contractors engaged with them | Minimum information security controls for government information; the full text is available from DESC on request |
| Dubai CyberForce programme (DESC with CREST), mandatory from 1 July 2024 | Dubai government, semi-government and critical information infrastructure entities | Penetration testing and incident response only from certified companies |
| ADHICS v2 (Department of Health Abu Dhabi), effective August 2024 | Healthcare facilities, payers and healthcare technology and service providers in Abu Dhabi | Yearly schedules of vulnerability assessment and penetration testing of systems, internet-facing web and mobile apps and connected medical devices; testing before production roll-out |
| PCI DSS v4.0.1, Requirement 11.4 | Anyone storing, processing or transmitting card data, and their service providers | Internal and external tests every 12 months and after significant change; retest fixes; segmentation tests every 12 months, or six for service providers |

Sources: [Gulf News, September 2026 (CBUAE Regulation C 1/2026)](https://gulfnews.com/business/banking/uae-overhauls-bank-risk-rules-4-hour-reporting-cyber-tests-and-tougher-penalties-1.500675080) · [DESC, Information Security Regulation](https://www.desc.gov.ae/regulations/standards-policies/) · [CREST, DESC Cyber Force certified companies](https://www.crest-approved.org/desc-cyber-force-certified-companies/) · [DoH Abu Dhabi, ADHICS v2 standard, control CO 7.1](https://www.doh.gov.ae/-/media/Feature/Resources/Standards/ADHICS-v2-standard.ashx) · [Stingrai, PCI DSS 11.4](https://www.stingrai.io/blog/pci-dss-penetration-testing-2026)

Two points are easy to miss. ADHICS applies to technology and service providers, not just hospitals and clinics, so a technology provider in Abu Dhabi that processes health information falls inside it. And the standard cross-references the federal UAE Information Assurance control on technical vulnerability management (T7.7.1), which is the same family of controls government and critical-infrastructure clients use in their supplier questionnaires. This section is general guidance, not legal or regulatory advice; confirm the exact obligations with your regulator or adviser.

Outside regulated sectors, the most common trigger is commercial. An enterprise or government customer sends a security questionnaire, and "date of last independent penetration test and summary of findings" is one of the questions. Having a recent report, and evidence that the high-risk findings were fixed, often decides whether procurement moves forward.

> Having a recent report, and evidence that the high-risk findings were fixed, often decides whether procurement moves forward.

## What penetration testing in the UAE costs

Published price guides from UAE providers give useful ranges, but they disagree, because they price different things under the same name. The table puts three side by side.

| Test | eShield, Dubai, May 2026 | Wattlecorp, April 2025 | Pentest.ae, July 2026 |
| --- | --- | --- | --- |
| Web application | AED 8,000–25,000 | AED 15,000–30,000 | AED 25,000–55,000 (one app, one user role) |
| API | AED 10,000–28,000 | Not listed separately | AED 75,000–180,000 for web, API and cloud identity combined |
| Mobile app (one platform) | AED 12,000–30,000 | Not listed separately | Not listed separately |
| External network | AED 12,000–35,000 | AED 20,000–50,000 (network) | Not listed separately |
| Internal network | AED 18,000–50,000 | Included in network range | Not listed separately |
| Cloud | AED 15,000–40,000 | AED 2,200–3,700 basic scan; up to AED 150,000 comprehensive | Included in combined range |
| Full VAPT, mid-size organisation | AED 35,000–90,000 | AED 9,000–180,000 typical overall | AED 250,000–600,000 full-stack enterprise |
| Red team | AED 80,000–200,000+ | Not listed | AED 600,000+ at very large scale |

Sources: [eShield IT Services](https://eshielditservices.com/penetration-testing-cost-dubai-2026/) · [Wattlecorp](https://www.wattlecorp.com/vapt-cost-guide/) · [Pentest.ae](https://pentest.ae/blog/best-penetration-testing-companies-uae-2026/). All three are providers' own published guides; treat them as market indications, not quotes.

What moves the price is effort, measured in tester days. eShield's guide puts a single web application at five to eight business days of active testing plus three to five days of reporting, and enterprise engagements at three to six weeks. The number of user roles, the depth of business logic, whether testers get credentials and source code, compliance-specific report formatting, and the seniority of the people doing the work all add days. A quote far below the market usually means fewer days or more automation, and Pentest.ae suggests a healthy engagement is around 60 to 70 per cent manual work.

Sources: [eShield IT Services](https://eshielditservices.com/penetration-testing-cost-dubai-2026/) · [Pentest.ae](https://pentest.ae/blog/best-penetration-testing-companies-uae-2026/)

Use the estimator for a first budget. It applies eShield's published ranges to your scope and adds a retest allowance.

Illustrative only, based on the ranges in [eShield IT Services' 2026 Dubai guide](https://eshielditservices.com/penetration-testing-cost-dubai-2026/). Combined engagements may be priced below the sum of the parts; complex logic, many user roles or compliance reporting push towards the top.

## Scoping: the decisions that set the price and the value

![Abstract illustration: a ring enclosing several varied rounded forms, with one form sitting just outside the ring](https://oxedge.com/wp-content/uploads/2026/10/penetration-testing-in-the-uae-scope.jpg)

*A test is only as useful as its boundary: too narrow and it proves nothing, too wide and it proves nothing deeply.*

The scope document matters more than the provider's brand. Start from the question you need answered ("can a customer see another customer's orders?", "could a stolen laptop reach payroll?") rather than from a list of IP addresses. Then make five decisions explicitly.

- **Knowledge level.** Black box (no information) imitates an outsider but wastes days on discovery; grey box (test accounts for each role) gives the most findings per dirham for applications; white box (source code and architecture) suits high-risk products.
- **Environment.** Production gives real answers but needs agreed windows and a rollback contact; staging is safer only if it truly matches production.
- **Third parties.** Your cloud provider, payment gateway and SaaS tools have their own testing rules. Check them and get written permission where required before anyone touches them.
- **Rules of engagement.** Testing hours, out-of-bounds systems, whether denial-of-service or phishing is allowed, and who to call at 2am if something breaks.
- **Authorisation.** A signed letter from someone entitled to authorise testing of each system. Without it, the tester is legally exposed and so are you.

## How to choose a provider

Accreditation is the first filter. CREST accredits penetration testing companies after a review of their operating procedures, personnel security, testing methodology and data security practices, and it runs a complaints process for clients. In Dubai, DESC's CyberForce programme builds on CREST: if you're a government, semi-government or critical-infrastructure entity, or are testing on behalf of one, the firm must be on DESC's certified list, which currently names 32 penetration testing providers and 13 incident response providers.

Sources: [CREST](https://www.crest-approved.org/guidepoint-security-awarded-crest-accreditation-for-penetration-testing/) · [DESC certified providers](https://www.desc.gov.ae/regulations/certified-providers/)

**How OXEDGE does this**

We make sure the test you buy answers the question your regulator, client or board is asking.

- A scoping workshop that maps your systems to the driver (CBUAE, ISR, ADHICS, PCI DSS or a customer questionnaire) and produces the scope, rules of engagement and authorisation letter.
- Provider shortlisting against accreditation, named testers, sample reports and retest terms, so quotes are comparable like for like.
- A remediation sprint after the report: fixes prioritised by real exploitability, applied in your code, cloud and identity setup, then retested.
- A short evidence pack for auditors and customers: summary, remediation status and retest attestation.

[Data & Cybersecurity at OXEDGE →](https://oxedge.com/solutions/data-cybersecurity/)

Outside the CyberForce mandate, accreditation is a strong signal but not the whole answer. Ask who will actually do the work and what their individual certifications are; OSCP and similar hands-on qualifications show a tester can exploit, not just scan. Ask for a redacted sample report. And ask about independence: a firm that also manages your network or resells your cloud is marking its own homework.

> And ask about independence: a firm that also manages your network or resells your cloud is marking its own homework.

Pentest.ae's buyer guide lists warning signs worth checking before you sign.

- The provider can't name the individual tester before the engagement starts.
- The sample deliverable is a Qualys or Nessus export with a branded cover page.
- Every finding carries an identical severity score with no justification.
- The firm shares ownership with your IT vendor, cloud reseller or auditor.
- Retesting is vague: no number of findings, no time window, no attestation letter.

Source: [Pentest.ae, July 2026](https://pentest.ae/blog/best-penetration-testing-companies-uae-2026/)

## What a good report contains

The report is the product. A board member should be able to read the first two pages and understand what an attacker could do; an engineer should be able to reproduce and fix every finding without calling the tester. Look for five elements: an executive summary in business language, findings with clear reproduction steps, severity scores (usually CVSS) with the reasoning shown, the business impact of each finding, and attack chains that show how lower-severity issues combine.

Source: [Pentest.ae, July 2026](https://pentest.ae/blog/best-penetration-testing-companies-uae-2026/)

Chains are where the value sits. Three "medium" findings, such as a verbose error message, a predictable record ID and a missing permission check, can add up to one customer reading every other customer's invoices. A scanner reports the three mediums; a tester reports the breach. If a sample report contains no chains at all, the engagement was probably mostly automated.

Insist the report also states exactly what was in scope, what was not, the test dates and the testers' names. Auditors and customers will ask, and a report without them is hard to rely on a year later.

## Retesting and staying tested between reports

A test without a retest is an expensive to-do list. PCI DSS makes this explicit in Requirement 11.4.4: exploitable findings must be corrected and testing repeated to verify the fix. Agree in the contract how many findings the retest covers, how long after the report it remains valid, and that it ends with a letter confirming which issues are closed. eShield suggests budgeting 20 to 30 per cent on top of the original price for retesting critical and high findings.

Sources: [Stingrai, PCI DSS 11.4](https://www.stingrai.io/blog/pci-dss-penetration-testing-2026) · [eShield IT Services](https://eshielditservices.com/penetration-testing-cost-dubai-2026/)

Between annual tests, three habits keep the report from going stale. Run automated vulnerability scanning on a schedule so new exposures surface within weeks rather than at next year's test. Build security checks into your release pipeline, as described in our [DevOps baseline for small teams](https://oxedge.com/insights/devops-baseline-for-small-teams/). And trigger a focused test whenever something significant changes: a new payment flow, a migration to the cloud, a new admin portal.

Finally, treat the findings as a map of your weak points, not a one-off grade. Recurring issues in identity and access usually mean the underlying design needs work, which is where a [zero trust approach for a small company](https://oxedge.com/insights/zero-trust-for-a-50-person-company/) pays off more than another round of patching.

Comparing [cyber security companies in UAE](https://oxedge.com/cyber-security-uae/)? See what OXEDGE covers. Related OXEDGE service: [cloud services in Dubai](https://oxedge.com/solutions/cloud-devops/).

## FAQ: Penetration testing in the UAE

### Which companies in the UAE provide penetration testing services?

CREST accredits penetration testing companies, and for Dubai government, semi-government and critical-infrastructure work the firm must be on DESC's CyberForce certified list, which currently names 32 penetration testing providers. Check accreditation first, then named testers, sample reports and retest terms.

### How do I choose providers of penetration testing services for web applications?

Start with accreditation, then compare scope, named testers and sample reports. Ask whether the test is manual and proves what an attacker can reach, rather than a scanner export, and what retesting costs: budget 20 to 30 per cent extra. Quotes are comparable only when every provider prices the same scope.

### Is penetration testing mandatory in the UAE?

There's no single federal rule for every company. The obligation comes through your regulator, clients or payment setup: the CBUAE regulation in force from 14 September 2026 for licensed financial institutions, Dubai's CyberForce programme since 1 July 2024, ADHICS in Abu Dhabi healthcare and PCI DSS for card data. This is general guidance, not legal advice.

### How long does a penetration test take?

eShield's guide puts a single web application at five to eight business days of active testing plus three to five days of reporting, and enterprise engagements at three to six weeks. More user roles, deeper business logic, access to credentials and source code, and compliance-specific report formats all add tester days, and tester days are what set the price.

### What's the difference between a vulnerability scan and a penetration test?

A vulnerability scan lists known weaknesses automatically but doesn't prove any of them can be exploited. A penetration test is a time-boxed, authorised attempt by skilled people to chain weaknesses together and show what an attacker could reach. Pentest.ae suggests a healthy engagement is around 60 to 70 per cent manual work. Scans suit monthly or quarterly hygiene.

### How often does PCI DSS require a penetration test?

PCI DSS v4.0.1 Requirement 11.4 asks for internal and external penetration tests every 12 months and after any significant change. Exploitable findings must be fixed and retested to verify the fix. Segmentation controls must be tested every 12 months, or every six months for service providers. It applies to anyone storing, processing or transmitting card data.

**Work with OXEDGE**

Buy the right penetration test once, and close what it finds.

We start by identifying which rule or client is driving the test and turning that into a scope providers can quote against fairly. You leave the first conversation knowing what to test, roughly what it should cost and what a credible report must contain.

[Start a project](https://oxedge.com/contact/) [Explore Data & Cybersecurity](https://oxedge.com/solutions/data-cybersecurity/)