VAPT services in Dubai: start with who requires the test

Which rule is driving your penetration test?

Identify the driver before you ask for quotes. The last column is the question most UAE buyers forget to ask.

Sources: DESC’s Cyber Force programme with CREST; VARA’s rulebook section on testing and audit; and the UAE Information Assurance Regulation published by the federal government, now overseen through the UAE Cyber Security Council. Rules change; check the current text before you scope, and keep a copy of the clause that applies to you with the test records.

How remote penetration testing from India works for UAE companies

Almost everything internet-facing can be tested remotely, and internal networks can be reached through controlled access. What makes it safe and acceptable is the paperwork and the plumbing:

1. Written authorisation. A signed letter naming the systems, the dates, the source addresses and the people involved. For cloud-hosted systems, check your provider’s testing policy too.
2. Fixed source addresses. Testing comes from agreed IPs so your monitoring team or managed SOC can recognise it and still spot a real attack.
3. Internal access. For internal network or Active Directory testing, a VPN account or a jump host you control, switched off after the window.
4. Testing windows in UAE time. India is 1.5 hours ahead, so windows are agreed in Gulf Standard Time around your peak hours and change freezes.
5. Data handling. Screenshots and evidence are kept to the minimum needed, stored encrypted and deleted after the agreed period, under a data processing agreement that fits the UAE PDPL or your free-zone rules.
6. Emergency contacts. A named person on each side who can stop testing immediately.

Testing Arabic and bilingual applications

Applications built for the UAE often serve Arabic and English users, and that creates test cases a single-language checklist misses:

• Bidirectional text. Right-to-left override characters in names, file names or messages can disguise links and file extensions, or make audit logs misleading.
• Unicode handling. Arabic, Latin and look-alike characters in usernames and email addresses can allow impersonation or duplicate accounts if inputs are not normalised.
• Validation gaps between languages. The Arabic version of a form or app sometimes calls an older API or skips a check that the English version enforces.
• Search and filters. Mixed-script queries can break input handling in search, reporting and export features.
• Generated documents. Invoices, contracts and PDFs rendered in Arabic go through different libraries, with their own injection and access-control risks.

What a VAPT engagement for a UAE company includes

Reporting for UAE customers, auditors and boards

The same test often has three readers in a UAE organisation, and each needs something different from the report.

• Your engineers need each finding with evidence, steps to reproduce, the affected endpoint or screen in both language versions where relevant, and a fix written for your stack. Findings go straight into your tracker with severity-based target dates.
• Your customers and partners need an attestation letter: what was tested, when, by whom, the method and the fact that high-risk findings were fixed and retested. They should not receive the full report with exploit details.
• Your board, compliance officer or auditor needs the executive summary, the scope statement (including what was deliberately left out and why), the retest results, and how findings are tracked to closure in your risk register.

Ask for all three formats at scoping, not after the test. If your ISO 27001 or SOC 2 programme keeps evidence in a GRC tool, agree the export format too, so the test feeds the audit trail without anyone retyping it. And keep the reports: VARA and PCI DSS both expect testing to be repeated, and the previous report is the baseline the next one is measured against.

What drives the cost of VAPT in Dubai?

We quote a fixed price after scoping and do not publish rates. Effort depends on the number of applications, roles, API endpoints and mobile platforms, cloud accounts and internal network size, testing windows outside normal hours, report language and the number of retests. If an accredited provider is mandatory for your test, the comparison is between accredited firms; our quote is relevant only where the rule allows a qualified independent tester.

Questions to ask any VAPT provider in the UAE

1. Does the rule or contract behind this test require a specific accreditation, and do you hold it? Where can we verify it?
2. Which named testers will do the work, and how much of it is manual?
3. Will you provide a redacted sample report?
4. Is the retest of fixed findings included, and for how long?
5. How will evidence containing our data be stored and deleted?
6. From which IP addresses will you test, and how do you avoid disrupting production?
7. Will the report and attestation letter satisfy our customer, auditor or regulator? Have they accepted your reports before?