Penetration testing in the UAE: what it costs, what you get and how to choose a provider

Sooner or later a UAE company is asked for a penetration test: by a regulator, a bank, a government client, a payment provider or an enterprise customer’s security questionnaire. The quotes that come back can differ several times over for what sounds like the same job, and the reports range from genuine attack narratives to a scanner export with a logo on the cover. This guide explains what you’re actually buying, which UAE rules require it, what tests cost here in 2026, how to scope one and how to choose a provider whose report will stand up to scrutiny.

Sources: Dubai Electronic Security Center, certified providers list (accessed October 2026) · PCI DSS v4.0.1 Requirement 11.4 explained, Stingrai · eShield IT Services, Penetration testing cost Dubai 2026

What a penetration test is, and what it isn’t

A penetration test is a time-boxed, authorised attempt by skilled people to break into a defined set of systems, chain weaknesses together and show what an attacker could actually reach. That last part is what separates it from a vulnerability scan, which lists known weaknesses automatically but doesn’t prove any of them can be exploited. Both have a place; they’re different purchases, and the most common buying mistake in this market is paying test prices for a scan.

Who in the UAE has to test, and how often

There’s no single federal rule requiring every company to commission a penetration test. Instead, the obligation arrives through your sector regulator, your clients or your payment setup. The main drivers in 2026 are below.

Sources: Gulf News, September 2026 (CBUAE Regulation C 1/2026) · DESC, Information Security Regulation · CREST, DESC Cyber Force certified companies · DoH Abu Dhabi, ADHICS v2 standard, control CO 7.1 · Stingrai, PCI DSS 11.4

Two points are easy to miss. ADHICS applies to technology and service providers, not just hospitals and clinics, so a technology provider in Abu Dhabi that processes health information falls inside it. And the standard cross-references the federal UAE Information Assurance control on technical vulnerability management (T7.7.1), which is the same family of controls government and critical-infrastructure clients use in their supplier questionnaires. This section is general guidance, not legal or regulatory advice; confirm the exact obligations with your regulator or adviser.

Outside regulated sectors, the most common trigger is commercial. An enterprise or government customer sends a security questionnaire, and “date of last independent penetration test and summary of findings” is one of the questions. Having a recent report, and evidence that the high-risk findings were fixed, often decides whether procurement moves forward.

Having a recent report, and evidence that the high-risk findings were fixed, often decides whether procurement moves forward.

What penetration testing in the UAE costs

Published price guides from UAE providers give useful ranges, but they disagree, because they price different things under the same name. The table puts three side by side.

Sources: eShield IT Services · Wattlecorp · Pentest.ae. All three are providers’ own published guides; treat them as market indications, not quotes.

What moves the price is effort, measured in tester days. eShield’s guide puts a single web application at five to eight business days of active testing plus three to five days of reporting, and enterprise engagements at three to six weeks. The number of user roles, the depth of business logic, whether testers get credentials and source code, compliance-specific report formatting, and the seniority of the people doing the work all add days. A quote far below the market usually means fewer days or more automation, and Pentest.ae suggests a healthy engagement is around 60 to 70 per cent manual work.

Sources: eShield IT Services · Pentest.ae

Use the estimator for a first budget. It applies eShield’s published ranges to your scope and adds a retest allowance.

Illustrative only, based on the ranges in eShield IT Services’ 2026 Dubai guide. Combined engagements may be priced below the sum of the parts; complex logic, many user roles or compliance reporting push towards the top.

Scoping: the decisions that set the price and the value

The scope document matters more than the provider’s brand. Start from the question you need answered (“can a customer see another customer’s orders?”, “could a stolen laptop reach payroll?”) rather than from a list of IP addresses. Then make five decisions explicitly.

• Knowledge level. Black box (no information) imitates an outsider but wastes days on discovery; grey box (test accounts for each role) gives the most findings per dirham for applications; white box (source code and architecture) suits high-risk products.
• Environment. Production gives real answers but needs agreed windows and a rollback contact; staging is safer only if it truly matches production.
• Third parties. Your cloud provider, payment gateway and SaaS tools have their own testing rules. Check them and get written permission where required before anyone touches them.
• Rules of engagement. Testing hours, out-of-bounds systems, whether denial-of-service or phishing is allowed, and who to call at 2am if something breaks.
• Authorisation. A signed letter from someone entitled to authorise testing of each system. Without it, the tester is legally exposed and so are you.

How to choose a provider

Accreditation is the first filter. CREST accredits penetration testing companies after a review of their operating procedures, personnel security, testing methodology and data security practices, and it runs a complaints process for clients. In Dubai, DESC’s CyberForce programme builds on CREST: if you’re a government, semi-government or critical-infrastructure entity, or are testing on behalf of one, the firm must be on DESC’s certified list, which currently names 32 penetration testing providers and 13 incident response providers.

Sources: CREST · DESC certified providers

Outside the CyberForce mandate, accreditation is a strong signal but not the whole answer. Ask who will actually do the work and what their individual certifications are; OSCP and similar hands-on qualifications show a tester can exploit, not just scan. Ask for a redacted sample report. And ask about independence: a firm that also manages your network or resells your cloud is marking its own homework.

And ask about independence: a firm that also manages your network or resells your cloud is marking its own homework.

Pentest.ae’s buyer guide lists warning signs worth checking before you sign.

• The provider can’t name the individual tester before the engagement starts.
• The sample deliverable is a Qualys or Nessus export with a branded cover page.
• Every finding carries an identical severity score with no justification.
• The firm shares ownership with your IT vendor, cloud reseller or auditor.
• Retesting is vague: no number of findings, no time window, no attestation letter.

Source: Pentest.ae, July 2026

What a good report contains

The report is the product. A board member should be able to read the first two pages and understand what an attacker could do; an engineer should be able to reproduce and fix every finding without calling the tester. Look for five elements: an executive summary in business language, findings with clear reproduction steps, severity scores (usually CVSS) with the reasoning shown, the business impact of each finding, and attack chains that show how lower-severity issues combine.

Source: Pentest.ae, July 2026

Chains are where the value sits. Three “medium” findings, such as a verbose error message, a predictable record ID and a missing permission check, can add up to one customer reading every other customer’s invoices. A scanner reports the three mediums; a tester reports the breach. If a sample report contains no chains at all, the engagement was probably mostly automated.

Insist the report also states exactly what was in scope, what was not, the test dates and the testers’ names. Auditors and customers will ask, and a report without them is hard to rely on a year later.

Retesting and staying tested between reports

A test without a retest is an expensive to-do list. PCI DSS makes this explicit in Requirement 11.4.4: exploitable findings must be corrected and testing repeated to verify the fix. Agree in the contract how many findings the retest covers, how long after the report it remains valid, and that it ends with a letter confirming which issues are closed. eShield suggests budgeting 20 to 30 per cent on top of the original price for retesting critical and high findings.

Sources: Stingrai, PCI DSS 11.4 · eShield IT Services

Between annual tests, three habits keep the report from going stale. Run automated vulnerability scanning on a schedule so new exposures surface within weeks rather than at next year’s test. Build security checks into your release pipeline, as described in our DevOps baseline for small teams. And trigger a focused test whenever something significant changes: a new payment flow, a migration to the cloud, a new admin portal.

Finally, treat the findings as a map of your weak points, not a one-off grade. Recurring issues in identity and access usually mean the underlying design needs work, which is where a zero trust approach for a small company pays off more than another round of patching.

Comparing cyber security companies in UAE? See what OXEDGE covers. Related OXEDGE service: cloud services in Dubai.

FAQ: Penetration testing in the UAE

Which companies in the UAE provide penetration testing services?

CREST accredits penetration testing companies, and for Dubai government, semi-government and critical-infrastructure work the firm must be on DESC’s CyberForce certified list, which currently names 32 penetration testing providers. Check accreditation first, then named testers, sample reports and retest terms.

How do I choose providers of penetration testing services for web applications?

Start with accreditation, then compare scope, named testers and sample reports. Ask whether the test is manual and proves what an attacker can reach, rather than a scanner export, and what retesting costs: budget 20 to 30 per cent extra. Quotes are comparable only when every provider prices the same scope.

Is penetration testing mandatory in the UAE?

There’s no single federal rule for every company. The obligation comes through your regulator, clients or payment setup: the CBUAE regulation in force from 14 September 2026 for licensed financial institutions, Dubai’s CyberForce programme since 1 July 2024, ADHICS in Abu Dhabi healthcare and PCI DSS for card data. This is general guidance, not legal advice.

How long does a penetration test take?

eShield’s guide puts a single web application at five to eight business days of active testing plus three to five days of reporting, and enterprise engagements at three to six weeks. More user roles, deeper business logic, access to credentials and source code, and compliance-specific report formats all add tester days, and tester days are what set the price.

What’s the difference between a vulnerability scan and a penetration test?

A vulnerability scan lists known weaknesses automatically but doesn’t prove any of them can be exploited. A penetration test is a time-boxed, authorised attempt by skilled people to chain weaknesses together and show what an attacker could reach. Pentest.ae suggests a healthy engagement is around 60 to 70 per cent manual work. Scans suit monthly or quarterly hygiene.

How often does PCI DSS require a penetration test?

PCI DSS v4.0.1 Requirement 11.4 asks for internal and external penetration tests every 12 months and after any significant change. Exploitable findings must be fixed and retested to verify the fix. Segmentation controls must be tested every 12 months, or every six months for service providers. It applies to anyone storing, processing or transmitting card data.