Top 10 Software Penetration Testing Service Providers in UAE
Software penetration testing is authorised testing of the applications you build or run, such as web apps, APIs and mobile apps, to find flaws before attackers do. In the UAE, who can test matters: Dubai government and critical entities may buy penetration testing only from Dubai CyberForce-certified firms. This guide lists six providers with UAE evidence and a stated application testing offer. CyberSapiens is first because we publish the page, and the other five follow alphabetically. Nothing here is a ranking.
Applications often hold customer data and take payments, and flaws in them are what attackers look for. A software penetration test uses skilled testers, within an agreed scope, to find and safely demonstrate those flaws so you can fix them.
We kept only firms where we found a UAE address, a CREST listing or a report of Dubai CyberForce certification, and where a source describes application testing. We have not published prices, because none of the sources gives a verified figure.
What Software Penetration Testing Covers
The OWASP Top 10:2021 is a common starting list of web application risks, and the OWASP Web Security Testing Guide gives detailed test procedures. For mobile apps, the OWASP MASVS sets out security requirements. OWASP publishes guidance, not a compliance standard, so a report cannot be “OWASP compliant” the way an audit result can.
Web applications
Access control, injection, authentication, session handling and business logic flaws.
APIs
The interfaces behind web and mobile front ends, including authorisation checks on each endpoint.
Mobile apps
How the app stores data, talks to its back end and protects sessions on the device.
Code and configuration
Some providers add static and dynamic application security testing or configuration review. Ask what is included.
A good test goes beyond a scanner. It uses several user roles to find access control flaws, tests business logic that tools cannot judge, and covers the APIs behind the front end. Ask whether testing is authenticated and how many roles are covered.
The Providers
CyberSapiens is listed first as the publisher of this page. The other five follow in alphabetical order. Each entry states what the source says.
1. CyberSapiens
CyberSapiens is a Melbourne-based cybersecurity consultancy with offices in Australia, Canada, India and the USA. Its VAPT services cover web, mobile, API, cloud, network, IoT and thick and thin client testing, using automated and manual testing, and its work is aligned with OWASP, PTES and NIST SP 800-115. CyberSapiens has no UAE office and does not hold CREST status or Dubai CyberForce certification, so it may suit private-sector work where those are not required. See our VAPT services.
States: ISO 27001:2022 certification; CVSS-rated findings with proof of concept; a free re-test on every engagement.
2. Cybranytech
A UAE-based cybersecurity team in Dubai. A May 2026 trade report says it was certified for penetration testing under the Dubai CyberForce programme. Its CREST listing shows a penetration testing offer covering web, API and mobile application testing. See the CREST listing and the trade report.
States: DESC Cyber Force penetration testing and incident response as partner assured services; 10 to 49 employees; 1 year of CREST membership (listing).
3. GBM
A Dubai-based technology and security company. A press release published on Zawya says GBM was awarded two accreditations, from CREST and from the Dubai Electronic Security Center, for penetration testing and incident response. It describes a penetration testing offer covering vulnerability assessment, configuration review, application security testing, wireless testing, red teaming and threat hunting. See the Zawya press release. The copy we read gave no date for the accreditations, so ask for the current certificate.
4. Protiviti
A trade report from 1 May 2025 says Protiviti was accredited by the Dubai Electronic Security Center for penetration testing services. The report says its offer covers vulnerability assessment, penetration testing, configuration review, static and dynamic application security testing, wireless testing and red teaming. See the trade report.
5. SecureLayer7
SecureLayer7 lists a Dubai office and AED quoting. It states its testing is CREST-accredited, covers REST and GraphQL endpoints, authentication, sessions and business logic, and maps findings to NESA IAS and SIA national infrastructure controls. Its page does not mention DESC or Dubai CyberForce certification, so ask whether it holds it. See the SecureLayer7 page.
States: re-testing is included at no extra cost.
6. ValueMentor
A pure-play information security consultancy. Its CREST listing shows penetration testing accreditation and DESC Cyber Force penetration testing as a partner assured service. Penetration testing covers internal, external, segmentation, web application and mobile application testing. The listing gives the United Kingdom as its location while the programme requires a UAE presence, so ask for its UAE trade licence. See the CREST listing.
States: CREST AI Charter, UK NCSC Cyber Essentials and PCI DSS QSA; web applications and APIs at 30% of tech focus; named in CREST’s January 2024 first group (listing).
Provider details come from each source and may change. Confirm current scope, accreditations and terms with the provider before you buy.
UAE Rules and Frameworks
The UAE has federal, emirate and free-zone rules, so the ones that apply to you depend on your sector and location. These come up most often.
Dubai CyberForce (DESC)
Dubai government, semi-government and critical information infrastructure entities must buy penetration testing and incident response only from CyberForce-certified companies. The programme began in January 2024 with an implementation date of 1 July 2024. CREST administers the penetration testing side with the Dubai Electronic Security Center (DESC).
Provider rules: companies need a UAE trade licence (or a local partner with one), CREST accreditation, and testers with qualifying CREST certifications. Reports follow the CREST Defensible Penetration Test and major gaps are disclosed to DESC within 5 working days.
Sources: CREST CyberForce page and programme requirements.
UAE Information Assurance Regulation
Developed by the Telecommunications and Digital Government Regulatory Authority (TDRA), it sets management and technical information security controls with the aim of raising protection across entities in the UAE. TDRA also designates critical entities that must implement it.
Source: UAE government portal. We could not confirm from that page what it says about testing.
Dubai ISR, PDPL and sector rules
Dubai Government entities follow the Dubai Information Security Regulation maintained by DESC, and suppliers may meet its controls through their government customers. Federal Decree-Law No. 45 of 2021 is the UAE’s personal data protection law, with separate regimes in the DIFC and ADGM. Healthcare in Abu Dhabi follows ADHICS.
Note: these points come from our UAE ISO 27001 guide and were not rechecked for this page. None of them names penetration testing as such, so confirm with your regulator or adviser.
Customers and auditors
UAE customers and auditors, and international clients of UAE companies, often ask suppliers for a recent independent test report.
Do: ask each customer or regulator what evidence they accept before you buy.
This section is general information, not legal advice. Check current requirements and take advice for your situation.
Content Reviewed By
Ketki Tidke
Cyber Security and GRC Lead Auditor
ISO 27001 Lead Auditor
Ketki is a certified ISO 27001 Lead Auditor specialised in Governance, Risk and Compliance, with experience consulting public, private, and government clients. She evaluates threats, risk impacts, and regulatory requirements across multiple industry frameworks.
Software Penetration Testing in the UAE: Frequently Asked Questions
What is software penetration testing?
It is authorised testing of the applications you build or run, such as web apps, APIs and mobile apps, in which skilled testers look for exploitable flaws and report how to fix them.
How is it different from a vulnerability scan?
A scan looks for known weaknesses automatically. A penetration test adds manual testing to confirm which flaws can really be exploited and to find issues tools miss, such as business logic and access control problems.
What is Dubai CyberForce?
It is a programme under which Dubai government, semi-government and critical information infrastructure entities must buy penetration testing and incident response only from certified companies. It began in January 2024 with an implementation date of 1 July 2024, and CREST administers the penetration testing side with the Dubai Electronic Security Center.
Does a provider need a UAE licence to do CyberForce work?
CREST states that companies need a UAE trade licence or a local partner with one, CREST accreditation, and testers with qualifying CREST certifications. Check the current programme requirements.
Which standards guide application testing?
Common references are the OWASP Top 10, the OWASP Web Security Testing Guide, ASVS and MASVS. They are guidance, not compliance standards, so ask which one the provider follows.
What should be in scope?
List the applications, environments, user roles and APIs to test, and what is off limits. Get written approval from the system owner, including for third-party and cloud components.
How much does software penetration testing cost in the UAE?
We have not published prices because we found no verified figure. Cost generally depends on the number of applications, pages, user roles and API endpoints, how much is manual, and whether a retest is included. Ask for a quote in AED against a written scope.
Should the test be authenticated?
Usually yes. Testing with several user roles is how access control flaws are found. Anonymous testing alone sees only what a visitor sees.
Is a retest included?
It depends on the provider. SecureLayer7 states re-testing is included at no extra cost, and CyberSapiens states a free re-test on every engagement. For others, confirm in writing, along with how long the retest window stays open.
Is CyberSapiens CREST accredited or CyberForce certified?
No. CyberSapiens has no UAE office and does not hold CREST status or Dubai CyberForce certification. If a contract requires them, choose a firm that holds them, and ask for proof of any accreditation you rely on.
Need to Test Your Software in the UAE?
Talk to CyberSapiens about your applications, APIs, scope and goals. We will help you decide what to test first and whether our service fits your requirements.
Email us
[email protected]Our head office
Lvl 1 206 Lorimer St, Port Melbourne, 3207
