The UAE is where a strong test most often fails the compliance conversation, because there are more regimes to get wrong. We confirm which apply to you — DESC ISR for Dubai government suppliers, the UAE IA Regulation for federal and critical sectors, ADHICS for Abu Dhabi healthcare, DFSA rules in the DIFC, the PDPL everywhere — and map one engagement to all of them.
// 01 Who needs penetration testing in the UAE
Federal government entities and critical-infrastructure operators fall under the UAE Information Assurance Regulation. Dubai government and semi-government entities, and suppliers handling their data, answer to the DESC Information Security Regulation.
Abu Dhabi healthcare entities are bound by ADHICS. Firms in the DIFC answer to the DFSA and the DIFC data protection law. The UAE PDPL covers personal data nationally, and PCI DSS covers card data. Most medium and large UAE organisations have at least one driver.
// 02 Compliance drivers in the UAE
Each regime is broken down in our guides to DESC, UAE IA (NESA) and ADHICS.
DESC ISR
Dubai government entities and their suppliers must run regular technical assessments, including penetration testing and vulnerability scanning, under the Information Security Regulation.
UAE IA Regulation T7.7.1
A priority-one vulnerability management process for federal entities and critical infrastructure. Testing frequency is set by your risk assessment.
ADHICS OM 7.1
Healthcare entities must schedule yearly penetration testing, vulnerability assessment and web security assessment. The most explicit mandate in the UAE.
DFSA & DIFC
DIFC firms are expected to test the systems holding client and personal data proportionately. ADGM firms answer to the FSRA.
UAE PDPL
Federal Decree-Law No. 45 of 2021 requires appropriate technical measures for personal data. Testing evidences them.
PCI DSS v4.0
Annual internal and external CDE testing plus segmentation testing for merchants, acquirers and processors.
// 03 Penetration testing services in the UAE
Dubai engagements usually centre on web, API and cloud; Abu Dhabi healthcare and government add network and assessment schedules; banks and payment firms add red teaming.
Web application pen testing
Customer portals, e-government services and SaaS platforms tested against OWASP and business-logic abuse.
API pen testing
Payment, open-finance and partner APIs: authorisation flaws, token abuse and data exposure.
Network & AD pen testing
External perimeter, internal Active Directory and segmentation testing for UAE head offices.
Cloud pen testing
AWS, Azure and GCP configuration and identity testing, including UAE cloud regions.
// 04 Where we work in the UAE
We test organisations in every emirate. The regime that applies usually depends on where you are licensed.
Dubai & the DIFC
DESC ISR for government and suppliers, DFSA for the DIFC, plus PDPL and PCI DSS.
Abu Dhabi & ADGM
ADHICS for healthcare, UAE IA for federal entities and FSRA for ADGM firms.
Sharjah, Ajman, RAK, Fujairah
Manufacturing, logistics and free-zone businesses, typically driven by PDPL, PCI DSS and customer audits.
// 05 How we deliver in the UAE
External, web, API and cloud testing runs remotely from our Gulf base, one hour behind UAE time. Internal network, wireless and assumed-breach work is done on your premises on an agreed schedule.
Expect one to three weeks of active testing and four to six weeks end to end. Book six to ten weeks before any DESC, DFSA or audit date so findings are closed and retested in time.
Confirm your regimes
DESC, UAE IA, ADHICS, DFSA or PDPL: we agree which apply before scoping.
One scopeTest
Human-validated exploitation with critical findings reported within 24 hours.
ControlledMap and report
Findings mapped to each regime’s control references.
Audit-readyRetest
Free retest after remediation, with closure shown in the report.
Free retest// 06 Industries we secure in the UAE
// 07 Why CyberFortify in the UAE
A generic offshore vendor
A polished report with no regime mapping, which an ISR or DFSA reviewer bounces close to the deadline.
CyberFortify in the UAE
A CREST accredited Gulf team that maps findings to DESC, UAE IA, ADHICS, DFSA and PDPL. Arabic or English read-outs, fixed pricing and a free retest.
// 08 Frequently asked questions
Is penetration testing mandatory in the UAE?
It depends on who regulates you. ADHICS requires yearly penetration testing for Abu Dhabi healthcare; DESC ISR requires regular technical assessments for Dubai government suppliers; the UAE IA Regulation requires a risk-based vulnerability management process for federal and critical entities.
What is the DESC ISR?
The Dubai Electronic Security Center’s Information Security Regulation, which Dubai government entities and many suppliers must follow. It expects regular technical assessments, including penetration testing, with findings tracked to closure.
Does the UAE IA Regulation (NESA) require annual testing?
Not in so many words. Control T7.7.1 mandates a vulnerability management process at priority one and leaves frequency to your risk assessment. Most entities test at least annually.
Do you test on-site in Dubai and Abu Dhabi?
Yes. Most testing runs remotely; internal, wireless and assumed-breach work is delivered on your premises on an agreed schedule.
How much does a penetration test cost in Dubai?
Cost follows scope, not postcode: applications, roles, network size and whether cloud or OT are included. After a free scoping call we return a fixed price. See our cost guide.