Mainland Dubai, DIFC, DMCC, JAFZA and the free zones
VAPT & Penetration Testing in Dubai
Intello runs vulnerability assessment and penetration testing (VAPT) for Dubai companies. Our testers attack your web apps, networks and cloud the way a real attacker would, then give you a clear report, a fix plan and a retest to prove the gaps are closed.
- Dubai-based team since 2003
- 500+ clients
- 99% client satisfaction
What is VAPT?
VAPT (vulnerability assessment and penetration testing) combines two checks. The vulnerability assessment finds known weaknesses across your systems with scanning and review. The penetration test then tries to exploit them by hand, the way an attacker would, to show which gaps are real and what an attacker could reach.
| What we test | Web apps and APIs, external and internal networks, cloud (AWS, Azure, Google Cloud), people (phishing) and physical security |
|---|---|
| Approach | Manual testing on top of automated scanning, following OWASP and recognised testing methods |
| Typical length | 1 to 3 weeks of testing, depending on scope |
| You receive | An executive summary, a technical report with evidence, a risk-ranked fix plan and a retest report |
| How often | At least once a year and after major changes. PCI DSS and the VARA rulebook both expect this |
| Where we work | From our Dubai office in Al Qusais, on site anywhere in Dubai and remotely |
Penetration testing across Dubai
Dubai’s free zones each come with their own regulator and their own client expectations. We scope every test to the rules that apply where you are licensed.
DIFC
Banks, brokers and fund managers regulated by the DFSA. Tests are scoped to show the regulator that cyber risk is managed. See our DFSA compliance service.
Virtual asset firms
VARA licence holders must run independent penetration tests and smart contract reviews at least once a year and before launches, under the VARA Technology and Information Rulebook. See VARA compliance.
DMCC and JAFZA
Trading, logistics and manufacturing firms whose clients now ask for a recent pen test report before they sign.
Dubai Internet City and Dubai Silicon Oasis
SaaS and tech companies that need a test report for enterprise buyers, ISO 27001 or a SOC 2 audit.
Mainland Dubai
Retail, healthcare, hospitality, real estate and professional services with customer data and online payments.
Card payments
Any business that stores, processes or transmits card data needs internal and external penetration tests under PCI DSS (requirement 11.4 of the PCI DSS standard).
Also available: VAPT in Abu Dhabi · Penetration testing across the UAE · VAPT in Sharjah
Do you need a penetration test?
You almost certainly do if any of these apply to you:
- A client, bank or partner has asked for a recent penetration test report as part of due diligence
- You are working towards ISO 27001 or a SOC 2 audit, and the auditor will ask for test evidence
- You store, process or transmit card payments and must meet PCI DSS
- You hold a VARA licence, or you are regulated by the DFSA in DIFC
- You are launching a new web app or API, or moving systems to the cloud
- You have not had an independent test in the last 12 months
Dubai government, semi-government and critical infrastructure entities must use a penetration testing provider certified under the Dubai Electronic Security Center’s Cyber Force programme. Tell us if this applies to you and we will confirm the right route before scoping.
What our VAPT covers
Each test is scoped to your systems and your reason for testing. These are the areas Dubai companies ask for most.
Web application and API testing
Login, sessions, access control, injection and business-logic flaws, tested against the OWASP Top 10 and the OWASP API Security Top 10. More on web application penetration testing.
External network testing
Everything you expose to the internet: firewalls, VPNs, email, remote access and forgotten servers, tested from an attacker’s point of view.
Internal network testing
What an attacker could do once inside, for example through a phished laptop: moving between systems, gaining admin rights and reaching sensitive data. See network penetration testing.
Cloud security testing
Misconfigured storage, over-broad permissions and exposed services in AWS, Azure and Google Cloud. See cloud security.
Physical security testing
Where it is in scope and authorised: building access controls, security procedures and the physical protection of devices.
Social engineering
Controlled phishing and phone tests, with your approval, to measure how staff respond and where awareness training should focus.
Vulnerability assessment
Authenticated scanning of servers, endpoints and network devices, with false positives removed by hand so your team only fixes real issues.
Red team exercises
For mature security teams: a goal-based attack over several weeks that tests detection and response. See red team services.
How a penetration test with Intello works
A fixed sequence, agreed in writing before any testing starts, so your systems and your business stay safe.
- 1
Scoping call
We agree what is in scope, why you are testing, the testing window, any systems that must not be touched and who to call if something critical is found.
Day 0 · free
- 2
Rules of engagement
A signed authorisation, the test plan, IP ranges and test accounts. Live systems are tested in agreed windows to avoid disruption.
Before testing
- 3
Discovery and scanning
Reconnaissance and automated scanning to map the attack surface, followed by manual checks to remove false positives.
Week 1
- 4
Manual exploitation
Our testers try to exploit the real weaknesses and chain them together, to show what an attacker could actually reach. Critical findings are flagged to you during testing, not held back for the report.
Weeks 1–2
- 5
Report and walkthrough
An executive summary for management and a technical report for your team, then a call to walk through every finding.
After testing
- 6
Retest
Once you have fixed the issues, we retest them and issue a retest report showing which findings are closed.
After your fixes
A typical web application or external network test takes one to two weeks from kick-off to report.
What you get
- Executive summary in plain language for management and clients
- Technical report with evidence, screenshots and steps to reproduce each finding
- Risk rating for every finding (CVSS score plus business impact)
- Prioritised fix plan your developers and IT team can follow
- Mapping of findings to ISO 27001, SOC 2, PCI DSS or VARA where relevant
- A walkthrough call with the testers
- Retest report confirming which issues are closed
Choose your test
Vulnerability assessment
3–5 daysBest for: A fast, broad health check
- · Authenticated scanning
- · Manual validation
- · Risk-ranked report
Penetration test
1–3 weeksBest for: Client, audit and regulator evidence
- · Manual exploitation
- · Full report and walkthrough
- · Retest of fixed findings
Ongoing testing programme
Quarterly or yearlyBest for: Frequent releases and yearly obligations
- · Scheduled tests
- · Testing after major releases
- · Year-round support
Need a pen test report for a client or auditor?
Tell us what you need tested and by when. We send a written scope and a fixed quote.
Vulnerability assessment vs penetration testing
The two are often sold together as VAPT, but they answer different questions.
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Question it answers | What known weaknesses do we have? | What could an attacker actually do with them? |
| Method | Mostly automated scanning, validated by hand | Manual exploitation by experienced testers |
| Depth | Broad: many systems, less depth | Deep: chains weaknesses to reach sensitive data |
| Typical length | Days | 1 to 3 weeks |
| Best for | Regular health checks between tests | Client due diligence, audits and regulatory evidence |
What affects the cost of VAPT in Dubai
Every quote is fixed and based on your scope. These are the factors that move the price:
- Number of targets
- How many web apps, APIs, IP addresses or cloud accounts are in scope.
- Application size
- The number of user roles, pages and API endpoints to test.
- Test type
- External only, internal, or a full assumed-breach or red team exercise.
- Testing window
- Out-of-hours or weekend testing on live systems takes more planning.
- Reporting needs
- Mapping to PCI DSS, VARA, ISO 27001 or SOC 2, or a report for a specific client.
- Frequency
- A yearly or quarterly programme costs less per test than one-off tests.
Why Dubai companies choose Intello for VAPT
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
Manual testing, not just a scan. Every finding is checked by hand, so your team does not waste time on false positives.
Reports that work for audits. Findings are mapped to the framework you need, from ISO 27001 and SOC 2 to PCI DSS and VARA.
Local and on site. Our team is based in Dubai and can test on site anywhere in the emirate, including internal networks.
We help you fix it. Remediation support and a retest, so the test ends with closed gaps, not just a PDF.
Frequently asked questions
How much does VAPT cost in Dubai?
It depends on scope: the number of applications, IP addresses, cloud accounts and user roles, and whether testing is external only or internal too. A single web application test is the smallest engagement; a full internal and external network test is larger. We give a fixed quote after a free scoping call, so there are no surprises.
How long does a penetration test take?
Most web application or external network tests take one to two weeks of testing, and the report follows once testing is complete. Larger scopes, internal networks and red team exercises take longer. We agree the timeline in writing before we start.
How often should a Dubai company run a penetration test?
At least once a year, and after any major change such as a new application, a cloud migration or a big release. PCI DSS requires internal and external penetration testing at least every 12 months and after significant changes, and the VARA rulebook requires independent testing at least once a year.
Is penetration testing required for ISO 27001 or SOC 2?
Neither standard names penetration testing as a fixed requirement, but both expect you to manage technical vulnerabilities and test your controls. In practice, auditors and enterprise clients almost always ask for a recent independent test report as evidence.
Can penetration testing be done remotely?
Yes. Web applications, APIs, cloud and external networks are usually tested remotely. Internal network tests can run through a secure device on your network or on site; our team is based in Dubai and can come to your office when needed.
Will testing disrupt our live systems?
Testing is planned to avoid disruption. We agree testing windows, exclude fragile systems, avoid destructive techniques, and stop and call you at once if we find something critical. Many clients prefer to test a staging copy of the application.
What is the difference between VAPT and a vulnerability scan?
A scan is automated and lists possible weaknesses, including false positives. VAPT adds manual validation and exploitation by a tester, which shows which weaknesses are real and what an attacker could reach. Clients, auditors and regulators expect a penetration test, not only a scan.
Do Dubai government entities need a DESC-certified tester?
Yes. Dubai government, semi-government and critical infrastructure entities must use a penetration testing provider certified under the Dubai Electronic Security Center’s Cyber Force programme. Private companies are free to choose their provider, but should check what their clients and regulators expect.
Related services
Get a fixed quote for your penetration test
Tell us what you need tested. We will set up a short scoping call and send a written scope and quote.
What happens next
- 1We get in touch to arrange a call
- 2A 30-minute scoping call
- 3A written scope, timeline and fixed quote
Prefer to talk now? Call +971 55 355 6787