Penetration Testing in Dubai and the UAE: 2026 Rules, Costs and How to Choose a Provider

Penetration testing rules in Dubai and the UAE depend on who you are. Dubai Government entities, and anyone accessing their information or systems, follow the DESC Information Security Regulation, and penetration tests for Dubai Government entities must come from a Dubai Cyber Force certified provider. Central Bank-licensed payment firms and Abu Dhabi health providers have sector rules. Organizations within the scope of the UAE PDPL need measures to test and evaluate their security controls.

This guide explains each framework with a link to the official source, then covers what a manual penetration test costs in AED and how to choose a provider.

Which Dubai and UAE regulations cover penetration testing?

Six frameworks shape penetration testing in the UAE: the DESC Information Security Regulation, the Dubai Cyber Force program, the UAE Information Assurance Standard, ADHICS for Abu Dhabi healthcare, the CBUAE payment regulations, and the UAE PDPL. Which ones apply depends on your sector and customers, not only on where your office is.

Framework	Who it applies to	What it says about testing	Official source
DESC Information Security Regulation (ISR)	Dubai Government entities and anyone accessing their information or systems	Mandatory security regulation; pentest providers for this work fall under Dubai Cyber Force	DESC
Dubai Cyber Force	Pentest and incident response providers to Dubai Government entities; DESC also applies it to semi-government and CII engagements	Providers must meet DESC’s certification requirements; for Dubai Government work, CREST certification or a CREST-accredited employer	DESC certified providers
UAE Information Assurance Standard	UAE government entities and critical entities under the national CIIP policy	Technical controls include technical vulnerability management	UAE Cyber Security Council
ADHICS v2	Abu Dhabi entities handling health information	Vulnerability assessments and penetration tests conducted periodically	Department of Health, Abu Dhabi (DoH)
CBUAE payment regulations	Stored value facility licensees; larger payment service providers	Regularly assess the need for penetration and cyber-attack simulation testing	CBUAE Rulebook
UAE PDPL	Organizations in scope of the PDPL	Measures to test and evaluate security controls; pentesting not named	UAE Legislation

What does the DESC Information Security Regulation require?

The Information Security Regulation (ISR) from the Dubai Electronic Security Center (DESC) is mandatory for Dubai Government entities and for anyone accessing their information or systems, including employees, contractors and third parties. It’s based on Resolution No. 13 of 2012, and Dubai Law No. 11 of 2014 gives DESC responsibility for it. A private company that accesses a Dubai Government entity’s information or systems can therefore be in scope, so confirm with your client which requirements apply to your work.

What is Dubai Cyber Force, and who needs it?

Dubai Cyber Force is a DESC program that certifies companies and individuals providing penetration testing and incident response to Dubai Government entities. DESC launched it with CREST International in March 2023 and also describes it as covering semi-government and critical information infrastructure (CII) engagements.

Providers must meet DESC’s certification requirements. For Dubai Government work, testers need CREST certification or must work for a CREST-accredited organization. Check the official list of certified providers before you sign.

What does the UAE Information Assurance Standard require?

The UAE Information Assurance (IA) Standard is mandatory for UAE government entities and for critical entities identified under the national Critical Information Infrastructure Protection (CIIP) policy. The framework was originally issued as the NESA standard, and the Telecommunications and Digital Government Regulatory Authority (TDRA) published UAE IA Regulation v1.1 in March 2020. The UAE Cyber Security Council now maintains it. Its management (M1 to M6) and technical (T1 to T9) controls are prioritized P1 to P4, and technical vulnerability management is among them.

Which sector rules mention penetration testing?

Abu Dhabi healthcare and CBUAE-regulated payments both have explicit testing language.

• ADHICS: The Abu Dhabi Healthcare Information and Cyber Security Standard from the Department of Health, Abu Dhabi (DoH) applies to Abu Dhabi entities handling health information. Version 2, published in May 2024, took effect in August 2024. Control OM 5 calls for vulnerability assessments and penetration tests to be conducted periodically, so set and document an interval based on your risk assessment.
• CBUAE Stored Value Facilities Regulation: Article 12 requires licensees to regularly assess the need for penetration and cyber-attack simulation testing.
• CBUAE Retail Payment Services and Card Schemes Regulation: Article 13 sets similar expectations for payment service providers at or above the regulation’s AED 10 million monthly threshold.
• Enabling Technologies Guidelines: The non-binding Guidelines for Financial Institutions Adopting Enabling Technologies (November 2021) call for vulnerability assessments and penetration tests of API-related systems at least annually.

Does the UAE PDPL require penetration testing?

Not by name. Article 20 of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, in force since 2 January 2022, requires appropriate technical and organizational measures, including measures to test and evaluate the effectiveness of security controls. A documented manual pentest is one practical way to show you do that.

What is a penetration test, and how is it different from a vulnerability assessment?

A penetration test is a controlled attack simulation in which testers exploit weaknesses to show what a real attacker could reach, while a vulnerability assessment lists potential weaknesses without proving them. ADHICS names both. Good tests follow published methods such as the OWASP Web Security Testing Guide, PTES and NIST SP 800-115. For more detail, read penetration testing vs vulnerability scanning.

Common scopes for UAE companies:

• Web application penetration testing for portals and booking platforms, covering business logic and the OWASP Top 10.
• API penetration testing for mobile back ends, payment flows and partner integrations.
• External penetration testing of internet-facing hosts and services.
• Internal penetration testing that assumes an attacker already has a foothold.

How much does a penetration test cost in Dubai and the UAE?

At Pentestica, a standard web application or API penetration test costs $2,500 to $5,500 (about AED 9,200 to 20,200), with the final price set by scope: applications, user roles, API endpoints, IP ranges and cloud accounts. AED figures use the Central Bank of the UAE’s peg of 3.6725 dirhams per US dollar and are rounded.

Test type	Pentestica price (USD)	Approx. AED	What drives the cost
Web application or API	$2,500–$5,500	AED 9,200–20,200	Business logic depth, user roles, endpoints
Mobile app (iOS or Android)	From $3,500	From AED 12,900	Platforms, depth of back-end API testing
Infrastructure or cloud (AWS, Azure)	$5,000–$12,000+	AED 18,400–44,100+	IP ranges, subnets, cloud accounts
Red teaming	From $15,000	From AED 55,100	Objectives, scenarios, duration

A full DORA TLPT is scoped and quoted individually.

Our penetration testing pricing is based on tester-days with no hidden fees, and re-testing after fixes is available. A typical engagement takes one to three weeks of testing plus a few days for the report, and critical vulnerabilities are reported during the test.

Price alone doesn’t reveal whether a quote covers manual testing or mainly scanning, so ask any provider for a sample report with evidence of manual exploitation. For a payments example, see this fintech API penetration testing case study.

How do you choose a penetration testing provider in the UAE?

Choose a provider whose testers hold hands-on offensive certifications, who knows the DESC and UAE IA requirements that apply to you, and who shows you a sample report before you sign. If you’re a Dubai Government, semi-government or critical infrastructure entity, or you access their systems, start with the DESC certified providers list.

• Check the DESC list when it applies. Pentests of Dubai Government entities need a Dubai Cyber Force certified provider, and DESC also applies the program to semi-government and CII engagements, so verify the company on the DESC list.
• Look for hands-on certifications. OSCP (Offensive Security Certified Professional) and OSCE are earned through practical exploitation exams. CISSP is a security management certification: valuable for governance, but it doesn’t test attack skills.
• Ask about UAE framework experience. Findings should map to the controls you report on, such as UAE IA vulnerability management or ADHICS OM 5.
• Agree on remote or on-site delivery. Web, API, external and cloud tests usually run remotely; internal tests can run through a VPN or on-site.
• Expect actionable reporting. You need an executive summary for leadership and a technical report with each vulnerability, proof of exploitation and step-by-step remediation.

Where does Pentestica fit?

Pentestica is an EU-based penetration testing company that delivers tests remotely. We aren’t a Dubai Cyber Force certified provider and don’t hold CREST accreditation, so if your engagement falls under Dubai Cyber Force rules, choose a provider from the DESC list. Elsewhere, check whether your regulator or contract sets tester requirements. Where it doesn’t, our OSCP, OSCE and CISSP certified team (10+ years of offensive security operations) tests web apps, APIs, mobile apps, infrastructure and cloud. We don’t audit or certify compliance; our report is evidence for your own risk assessment or auditor.

How often should you run a penetration test in the UAE?

Test at least once a year and after significant changes, unless a rule you follow is stricter. That matches the CBUAE Enabling Technologies Guidelines for API-related systems and PCI DSS v4.0.1 requirement 11.4 for card data environments (every 12 months and after significant changes). ADHICS and the CBUAE payment regulations describe testing as periodic or regular, so document the frequency you choose and why. Fast-moving teams also test after major releases, new API versions and cloud migrations.

What should you do next?

Map which frameworks apply to you, then scope a test that produces the evidence each one needs. If you’re a Dubai Government, semi-government or critical infrastructure entity, or you access their systems, confirm your provider on the DESC list. For everything else, compare our penetration testing services by test type.

Request a Pentest Quote and tell us what’s in scope. We’ll come back with a proposed scope and a price based on tester-days.