Dubai · UAE

Penetration testing in Dubai and the UAE

We test the applications, APIs, cloud and networks of companies in the UAE, and write the report for the regulator, auditor or customer who asked for it. AI agents cover the breadth; our engineers exploit and chain the findings that matter.

Scope a pentest → How a compliance pentest runs

Who runs the test?

Cyphlon's own engineers. Cyphlon is a sole proprietorship registered in the Dubai International Financial Centre (DIFC), and CISSP, CISM, OSCP and CCSP certifications are held across our team. We contract with you directly, and the people on the scoping call are the people who test.

Which UAE regulations call for security testing?

That depends on who regulates you. These are the main UAE regulators and laws, and the organisations each applies to. Your regulator's current text decides what testing you need and how often.

Dubai Electronic Security Center (DESC) Information Security Regulation
Dubai government entities.
UAE Information Assurance Regulation
Federal and local government entities, and organisations designated as critical infrastructure.
Central Bank of the UAE (CBUAE)
Banks and other financial institutions licensed by the Central Bank.
Dubai Financial Services Authority (DFSA)
Financial services firms authorised in the DIFC.
Financial Services Regulatory Authority (FSRA)
Financial services firms authorised in Abu Dhabi Global Market (ADGM).
Virtual Assets Regulatory Authority (VARA)
Virtual asset service providers licensed in Dubai.
Dubai Health Authority (DHA) and ADHICS
Healthcare facilities licensed in Dubai, and organisations handling health information in Abu Dhabi (ADHICS).
UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021)
Organisations processing personal data in the UAE, except where a free zone or sector has its own data protection law, as the DIFC and ADGM do.
DIFC Data Protection Law 2020
Organisations processing personal data in or from the DIFC.

Some regulators require an approved or accredited provider. Check your requirement; we will tell you at scoping if we are not eligible.

What can we test?

Each of these is a service in its own right, and one pentest can combine several.

How does a pentest with Cyphlon run?

In four steps: scope, test, report and re-test.

  1. 01

    Scope

    On a call with the engineers who will test, we agree the targets, the environment, the testing windows and the regulator or customer the report has to satisfy. You then get a written proposal with a fixed quote.

  2. 02

    Test

    AI agents map the attack surface and run broad tests. Our engineers then confirm, exploit and chain the findings that matter, and raise anything serious with you as soon as it is confirmed.

  3. 03

    Report

    You receive a technical report with a proof of concept and fix for every finding, and an executive summary for leadership, auditors or your regulator.

  4. 04

    Re-test

    When your team has fixed the findings, we test them again and update the report to show what is resolved.

How much does a pentest cost?

You get a fixed quote after a scoping call. The price depends on what is in scope and how deep the testing goes, so we don't publish a rate card. The quote arrives in a written proposal before any work starts, and any change in scope is agreed with you in writing first.

What drives the cost of a penetration test in the UAE →

Book a call

Book a 30-minute call

Pick a time that suits you. We'll talk through what you're building and where your security stands, then suggest where to start.

Cyphlon

1:1 Consultation Call

30 min Google Meet

An introductory call with our engineers about any engagement: a pentest, continuous testing, managed AppSec, security engineering, agentic AI security or a fractional CISO. We'll ask about your stack, your deadlines and what your customers or auditors expect, and tell you plainly if we're not the right fit.

Or open the booking page on Calendly