Every scanner finds the easy things. We find what it walked past.
Vulnerability assessment and penetration testing for UAE organisations, delivered by certified testers who exploit findings by hand, explain them in language your board can act on, then stay to help close them. Fixed AED scope. Free retest in every engagement.
Testers hold OSCP, CEH and equivalent certifications. Engagements follow OWASP, PTES and NIST SP 800-115.
7 phases
From written authorisation through to a verified closure statement
Same day
Critical findings reported the working day they are confirmed
1 free retest
Verification of your fixes is included, never an upsell
All 7 emirates
On site phases run from engineers based in Abu Dhabi and Sharjah
A typical first engagement
Findings distribution from a mid market UAE assessment
Illustrative only. Your distribution depends entirely on scope and environment maturity, and we will not predict it before testing.
NESA IAS
Annual testing for critical infrastructure, with documented methodology and remediation evidence.
ISR
Dubai government and semi government testing aligned to mandated review cycles.
UAE PDPL
Regular assessment of the measures protecting personal data from unauthorised access.
PCI DSS
Segmentation and application testing for any business handling cardholder data.
ISO 27001
Not explicitly mandated, but relied on by auditors to verify controls work as documented.
Most UAE companies do not have a testing problem. They have a remediation problem.
Plenty of firms will sell you a penetration test. Very few are still there when your IT team opens the report and realises nobody knows how to close finding number seven.
A report arrives and nothing changes
The usual outcome across the market
- An automated scan is repackaged as a penetration test, with hundreds of low value findings and no proof of exploitation.
- Findings are listed by severity but not by business impact, so leadership cannot decide what to fund first.
- Remediation is left to an internal team already at capacity, or to a separate vendor who was never in the room.
- Retesting is quoted as a second paid engagement, so the fixes are never independently verified.
- Twelve months later the same issues resurface in the next audit.
Testing and engineering from the same team
How a NetSys engagement is built
- Manual, human led exploitation on top of automated discovery, with reproducible proof for every confirmed finding.
- Every finding carries a CVSS v3.1 score, a plain language business impact statement and a named owner.
- Our engineers can implement the fixes directly, because they already run firewalls, endpoints and Microsoft 365 for UAE clients.
- One free retest of all confirmed findings is written into every engagement, with a closure statement you can hand to an auditor.
- Optional continuous vulnerability management keeps the environment monitored between annual tests.
What we test
Scope is agreed in writing before a single packet is sent. Choose an attack surface to see what an engagement covers and what we need from you.
Web application testing
Authenticated and unauthenticated testing against the OWASP Top 10 and beyond, covering broken access control, injection, authentication logic, session handling and business logic abuse specific to your application.
API and web service testing
REST, GraphQL and SOAP endpoints tested for broken object level authorisation, mass assignment, rate limit failures, token handling weaknesses and excessive data exposure that scanners routinely miss.
Mobile application testing
iOS and Android binaries assessed for insecure local storage, certificate pinning gaps, hardcoded secrets, weak cryptography and unsafe interprocess communication, alongside the backend the app talks to.
Database security assessment
Configuration review, privilege escalation paths, weak authentication, unencrypted sensitive columns and excessive service account rights across SQL Server, MySQL, PostgreSQL and Oracle estates.
Source assisted review
Where source access is available, targeted static review of authentication, authorisation and cryptographic routines gives deeper coverage than black box testing alone and reduces false negatives.
Pre release testing
Focused reassessment before a major release or after significant architectural change, so a new feature does not quietly reopen a finding you already paid to close.
External network testing
Everything an attacker can reach from the internet: exposed services, forgotten hosts, VPN and remote access endpoints, misconfigured mail security and credentials already leaked in public breach data.
Internal network testing
Assumed breach testing from inside the LAN. We model what happens after one laptop is compromised: lateral movement, privilege escalation, credential harvesting and reachability of your crown jewel systems.
Wireless security assessment
Corporate and guest wireless reviewed for weak authentication, rogue access points, guest network bleed into corporate VLANs and enterprise authentication misconfiguration across multi floor UAE offices.
Firewall and segmentation review
Rule base analysis and practical segmentation testing to prove that the boundaries you documented actually hold, which is the specific evidence PCI DSS assessors ask for.
Endpoint and build review
Standard laptop and server builds tested against hardening baselines: local admin rights, application allowlisting gaps, EDR bypass exposure, disk encryption and removable media controls.
Network device review
Switches, routers, printers, IP cameras and building systems checked for default credentials, unsupported firmware and flat network exposure, the quiet entry points that full scope tests keep finding.
Microsoft 365 security assessment
Tenant configuration reviewed for legacy authentication, conditional access gaps, over permissive mailbox delegation, unmanaged guest access, OAuth consent abuse and Defender policy coverage.
Azure and AWS configuration testing
Cloud posture assessed for public storage exposure, over privileged IAM roles, unrestricted security groups, missing logging and privilege escalation paths within the subscription or account structure.
Active Directory security review
Attack path analysis across your domain: kerberoastable accounts, unconstrained delegation, stale privileged accounts, weak password policy and the shortest route from a standard user to Domain Admin.
Email security and spoofing testing
SPF, DKIM and DMARC posture validated in practice rather than on paper, alongside inbound filtering effectiveness and the real world spoofability of your executive domains.
Identity and access testing
MFA coverage and bypass resilience, single sign on configuration, service principal permissions and joiner mover leaver hygiene, the controls that decide whether stolen credentials become a breach.
Data residency and exposure review
Where your regulated data physically sits, who can reach it and which third party integrations quietly move it outside the UAE, assessed against your PDPL and contractual obligations.
Phishing simulation
Controlled, consent based phishing campaigns measuring click rate, credential submission and reporting rate, delivered with the training follow up that turns a bad result into a better one.
Open source intelligence review
What an attacker can learn about your organisation before touching it: exposed credentials in breach corpora, staff detail, technology fingerprints, leaked documents and forgotten subdomains.
Physical and access control review
Server room access, badge cloning exposure, unattended workstations, network port accessibility in public areas and visitor handling procedures, assessed at your Abu Dhabi, Dubai or Sharjah premises.
Policy and procedure gap review
Your written security policies compared against what is actually configured, because the gap between the two is exactly what an auditor is trained to find.
Third party and supplier exposure
Vendor remote access paths, shared credentials, integration permissions and the supplier connections that sit outside your normal change control but inside your network boundary.
Incident readiness tabletop
A facilitated scenario walkthrough testing whether your team knows who to call, what to isolate and how to report, before a real incident makes those decisions for you.
How a NetSys VAPT engagement runs
Seven phases, benchmarked against recognised public methodologies rather than an internal checklist nobody can inspect. Auditors ask which methodology you followed, so we name it in every report.
Scoping and rules of engagement
We agree exactly what is in scope, what is explicitly excluded, testing windows, escalation contacts and the conditions under which we stop immediately. You receive a signed authorisation document and a named engagement lead before anything begins. Scope exclusions are recorded with written justification, which is precisely what NESA assessors examine.
Reconnaissance and asset discovery
Passive and active discovery to build the real attack surface, which is almost always larger than the asset register suggests. Forgotten subdomains, shadow IT, decommissioned hosts still resolving and third party integrations are mapped and confirmed with you before testing proceeds.
Vulnerability assessment
Authenticated and unauthenticated scanning across the agreed scope, with results correlated against the National Vulnerability Database and vendor advisories. This is the assessment half of VAPT, and on its own it is not a penetration test. It is the input to the next phase.
Manual exploitation and validation
This is where the value sits. Our testers manually verify findings, chain lower severity issues into meaningful attack paths and discard false positives, working to the OWASP Web Security Testing Guide, PTES and NIST SP 800-115, with techniques classified against the MITRE ATT and CK knowledge base. Exploitation is proof of concept only. We never exfiltrate real data, deploy persistence or take a destructive action.
Risk rating and reporting
Every confirmed finding receives a CVSS v3.1 base score adjusted for your environment, reproduction steps, evidence, business impact in plain language and specific remediation guidance. Critical findings are reported the same working day they are confirmed, not held back for the final document.
Remediation support
A working session with your technical team to walk through every finding and agree a prioritised plan with owners and dates. Where NetSys already provides managed IT or managed security, our engineers can implement the fixes directly under your existing agreement. Where you have an internal team or another provider, we support them instead.
Free retest and closure statement
One retest of all confirmed findings is included at no additional cost within the agreed remediation window. You receive an updated report and a formal closure statement recording which findings were verified as remediated, which remain open and why, which is the evidence auditors, insurers and boards actually ask to see.
9.0 to 10.0
CRITICAL
Reported to you the same working day. Direct route to system compromise or regulated data exposure.
7.0 to 8.9
HIGH
Serious exposure requiring prompt remediation, usually within the current change cycle.
4.0 to 6.9
MEDIUM
Meaningful weakness, often valuable to an attacker when chained with another finding.
0.1 to 3.9
LOW AND INFORMATIONAL
Hardening opportunities and information disclosure worth closing during routine maintenance.
What you actually receive
A penetration test is only as useful as the document it produces. Ours is written to serve three readers at once: the board member who needs to understand exposure in two pages, the engineer who needs to reproduce and fix the issue, and the auditor who needs evidence that the work was done to a recognised standard.
Reports are delivered encrypted, retained according to an agreed retention period and destroyed on request. We will never publish your organisation name, findings or logo without written permission, which is a commitment we hold ourselves to across the whole website.
Typical delivery is five to ten working days after testing concludes, depending on scope. Critical findings reach you immediately rather than waiting for the report.
VAPT Engagement Report
CONFIDENTIAL / CLIENT DISTRIBUTION ONLY
01
Executive summary
Two pages, no jargon, written for a board or audit committee. Overall risk position and the three things that matter most.
02
Scope and methodology statement
Exactly what was tested, what was excluded and why, dates, testing type and the named standards followed.
03
Findings register
Each finding with CVSS v3.1 score and vector, affected assets, reproduction steps, evidence and business impact.
04
Prioritised remediation plan
Ordered by risk and effort, with specific technical guidance rather than a generic vendor link.
05
Compliance control mapping
Findings mapped to the framework you report against, so the report drops straight into your audit evidence pack.
06
Retest and closure statement
Issued after the free retest, recording verified remediation and any accepted residual risk.
Which UAE frameworks drive your testing requirement
Most organisations are not testing because they want to. They are testing because a regulator, an auditor, a bank or a customer contract requires it. Here is where the requirement usually comes from.
| FRAMEWORK | WHO IT APPLIES TO | WHAT IT EXPECTS FROM TESTING |
|---|---|---|
| NESA IAS | UAE government, semi government and critical information infrastructure operators, plus private entities supporting them | Regular technical vulnerability management and penetration testing with documented scope, a recognised methodology and evidence of remediation. Scan only engagements are not accepted as penetration testing. |
| ISR | Dubai government and semi government entities | Testing aligned to mandated information security review cycles, with findings feeding the entity risk register. |
| UAE PDPL | Organisations processing personal data of individuals in the UAE | Appropriate technical measures kept under review, which in practice means periodic security assessment of systems holding personal data. |
| ADHICS | Abu Dhabi healthcare providers and their service partners | Technical control validation across systems handling health information, with evidence retained for inspection. |
| CBUAE | Banks and licensed financial institutions in the UAE | Regular penetration testing of core banking, payment and customer facing systems, with board level reporting of outcomes. |
| PCI DSS | Any business storing, processing or transmitting cardholder data | Annual internal and external penetration testing plus segmentation testing, following an industry accepted methodology. |
| ISO/IEC 27001 | Certified organisations and those preparing for certification | Penetration testing is not explicitly mandated, but auditors rely on it as technical assurance that controls work as documented. |
An honest note on accreditation. Dubai government entities and critical information infrastructure operators are frequently required to engage a provider accredited under the Dubai Cyber Force programme, run by the Dubai Electronic Security Center in partnership with CREST. NetSys does not currently hold that accreditation. If your requirement specifies it, we will tell you at the scoping call rather than three weeks into an engagement, and we will help you write a scope you can take to an accredited provider. For every other UAE organisation, our certified testers and documented methodology meet the standard your auditor is looking for.
Engagement models
Every engagement is quoted as a fixed AED price after scoping. We do not price by day rate guesswork, and we do not quote before we understand the environment.
Single Surface Test
One defined target: a web application, an external perimeter or a Microsoft 365 tenant. The right starting point when a customer contract or a single audit finding is driving the requirement.
- One agreed attack surface
- Automated discovery plus manual exploitation
- Full findings register with CVSS v3.1 scoring
- Remediation walkthrough session
- One free retest and closure statement
FIXED AED QUOTE AFTER SCOPING CALL
Full Scope Assessment
External and internal network, applications, cloud and identity assessed together, because real attackers do not respect the boundaries between them. Built for annual compliance cycles, and the model most clients choose.
- External and internal network testing
- Application, API and Active Directory review
- Microsoft 365, Azure or AWS configuration testing
- Attack path analysis across combined findings
- Compliance control mapping to your framework
- Board ready executive summary
- One free retest and closure statement
FIXED AED QUOTE AFTER SCOPING CALL
Managed Vulnerability Programme
An annual test is a snapshot. This keeps the environment under continuous assessment between tests, which is what NESA style reporting and cyber insurers increasingly expect to see.
- Everything in Full Scope Assessment, annually
- Continuous vulnerability scanning and triage
- Quarterly external attack surface review
- Monthly posture report with trend data
- Remediation delivered by NetSys engineers
- Phishing simulation and awareness programme
FIXED MONTHLY AED CONTRACT
The vulnerability you have not found is already someone else’s opportunity
Testing tells you where you stand. Remediation is what changes it. NetSys delivers both, from engineers based in Abu Dhabi and Sharjah.
Why UAE businesses choose NetSys for VAPT
Six reasons that are checkable rather than decorative.
Certified testers, named in your report
Testing is performed by engineers holding OSCP, CEH and equivalent offensive security certifications. The lead tester is named in the engagement documentation, so you know exactly who did the work.
Manual exploitation, not a rebranded scan
Automated tooling is where we start, never where we finish. Findings are manually verified and chained into real attack paths, and false positives are removed before the report reaches you.
We can close the findings we open
As an established UAE managed IT and managed security provider, our engineers already run firewalls, endpoints, servers and Microsoft 365 for clients. Remediation does not need a second vendor and a second procurement cycle.
Free retest written into every engagement
One retest of all confirmed findings is included as standard, with a closure statement. Verification of your fixes is not an upsell, because a test that is never verified is not assurance.
On the ground in Abu Dhabi and Sharjah
Internal testing, wireless assessment and physical review require someone physically present. Our engineers are based in the UAE, so on site phases do not depend on flying a consultant in.
Fixed AED scope, no scope creep invoicing
Engagements are quoted as a fixed AED price against a written scope. If the scope genuinely needs to change mid engagement, we stop and agree it with you in writing first.
On independence, because someone should say it
If NetSys manages your infrastructure and also tests it, that is not independent testing. Some auditors and some regulators will not accept it, and they are right not to.
So we say it plainly at the scoping call. Where you need auditor accepted separation between the party that builds and the party that tests, we will tell you, and we will not quote for both. Where independence is not a requirement, having the same team test and remediate is faster, cheaper and produces better outcomes.
You should not have to work this out after the invoice.
Standards, tooling and vendor ecosystem
The public methodologies our testing is benchmarked against, and the security platforms we deploy and manage when findings need closing.
OWASP
Web Security Testing Guide and Top 10 risk categories
NIST SP 800-115
Technical guide to information security testing
MITRE ATT and CK
Adversary technique classification for every finding
CVSS v3.1
Consistent, comparable severity scoring
NVD and CVE
Authoritative vulnerability correlation source
Fortinet
Next generation firewall and perimeter remediation
Microsoft Defender
Endpoint and Microsoft 365 hardening
WithSecure
Endpoint detection and response deployment
KnowBe4
Phishing simulation and security awareness training
Veeam
Immutable backup and ransomware recovery
DESC Dubai
Dubai Electronic Security Center regulations reference
ISO/IEC 27001
Information security management standard
Sectors we test across the Emirates
NetSys supports 50 plus managed clients across the UAE, with a dedicated cybersecurity practice established in 2024. Client names are never published without written permission, so we describe the work instead of decorating a page with logos.
Financial and professional services
Firms facing customer security questionnaires, CBUAE expectations or ISO 27001 audit cycles.
Healthcare and clinics
Abu Dhabi providers working to ADHICS control requirements across clinical and administrative systems.
Construction and engineering
Multi site operations with distributed networks, site offices and heavy supplier integration.
Logistics and trading
Businesses running exposed portals and EDI integrations that partners require assurance over.
Retail and hospitality
Card processing environments needing PCI DSS aligned segmentation and application testing.
Government suppliers
Private firms tendering for public sector work and asked to evidence security testing.
Education
Schools and training institutions protecting student data across cloud and on premise systems.
SaaS and technology
Product teams whose enterprise customers make an annual pentest report a condition of renewal.
VAPT questions UAE businesses ask before they buy
Direct answers, including the ones that are not flattering to us.
VAPT stands for Vulnerability Assessment and Penetration Testing, and it is two activities in sequence. The vulnerability assessment uses automated tooling to identify potential weaknesses across the agreed scope. The penetration test is the human phase: a tester manually attempts to exploit those weaknesses, chains them into realistic attack paths and discards false positives. A vulnerability scan on its own tells you what might be wrong. A penetration test proves what actually is. Compliance frameworks including NESA IAS distinguish between the two, and a scan only engagement is generally not accepted where penetration testing is required.
Cost is driven by scope, not by company size. The variables are the number of live IP addresses in scope, the number and complexity of applications, whether internal testing requires an on site phase, whether cloud and identity are included, and the level of compliance mapping needed in the report. NetSys quotes a fixed AED price after a scoping call, and we will not give a number before we understand the environment because any figure quoted blind is either padded or will grow later. Be cautious of providers quoting a flat price with no scoping conversation.
No. NetSys does not currently hold CREST membership or Dubai Cyber Force accreditation. Our testers hold individual offensive security certifications including OSCP and CEH, and our engagements follow OWASP, PTES and NIST SP 800-115 methodologies. If your organisation is a Dubai government entity, a semi government body or a critical information infrastructure operator required to use a Dubai Cyber Force accredited provider, we will tell you that at the scoping call and help you scope the work for an accredited firm. For the majority of UAE private sector organisations, accreditation is not a requirement and our approach meets what auditors ask for.
A single web application or external perimeter test typically involves three to five days of active testing. A full scope assessment covering external, internal, applications, cloud and identity usually runs two to three weeks of testing. Reporting adds a further five to ten working days after testing concludes, though critical findings are reported to you the same working day they are confirmed rather than waiting for the document. Scoping and authorisation normally take a week before testing starts.
Disruption risk is real and we manage it rather than dismissing it. Testing windows are agreed in advance, higher risk techniques such as denial of service testing are excluded by default unless you specifically request them, and we maintain a live escalation contact throughout so testing can be halted within minutes. Exploitation is proof of concept only, meaning we demonstrate that access is possible without exfiltrating real data, installing persistence or altering production records. Where an application is fragile, we recommend testing a staging environment that mirrors production.
Annually is the baseline that most UAE frameworks and auditors expect, including NESA IAS for covered entities and PCI DSS for card processing environments. Beyond that, testing should be triggered by change: a major application release, a cloud migration, a merger, a new office network or a significant infrastructure redesign. Organisations with frequent development cycles benefit from a continuous vulnerability management programme between annual tests, since a once yearly snapshot says very little about the other eleven months.
The UAE Information Assurance Standards, issued by the authority commonly known as NESA and now operating as the Signals Intelligence Agency, include technical vulnerability management controls that covered entities must satisfy with evidence. In practice this means documented scope with justification for exclusions, a recognised testing methodology, and proof that findings were remediated. Automated scanning alone is generally not sufficient. NESA compliance is mandatory for UAE government and semi government entities and organisations classified as critical information infrastructure, and increasingly expected of private firms supplying them.
Black box testing gives the tester no prior knowledge, simulating an external attacker starting from zero. Grey box provides limited information such as user level credentials or an architecture overview, which is usually the best value approach because testers spend their time finding issues rather than mapping. White box provides full access including source code and configuration, producing the deepest coverage and the fewest false negatives. For most UAE organisations we recommend grey box for network and application engagements, moving to white box where regulated data or safety critical systems are involved.
Yes, and it is included rather than sold separately. One retest of all confirmed findings is written into every NetSys engagement, carried out within the agreed remediation window. You receive an updated report plus a formal closure statement recording which findings were verified as remediated, which remain open and the accepted residual risk against each. That closure statement is usually the document your auditor, insurer or enterprise customer actually wants to see, more than the original findings report.
We can, but you should understand the trade off. If the same provider builds, manages and tests an environment, that engagement is not independent, and some auditors and regulators will not accept it as assurance. We raise this at the scoping call rather than after the invoice. Where independence is required, we will say so and support you in engaging a separate testing firm. Where it is not required, having one team test and remediate is faster and produces better outcomes, because the people fixing the issue already understand the environment.
Our engineers are based in Abu Dhabi and Sharjah and cover all seven emirates for on site phases including internal network testing, wireless assessment and physical access review. Dubai, Ajman, Ras Al Khaimah, Fujairah and Umm Al Quwain are all within standard coverage. External network, application, API and cloud testing is performed remotely, so those phases can begin as soon as authorisation is signed regardless of location.
A signed authorisation to test from someone with authority to grant it, a defined scope listing in scope and out of scope assets, an agreed testing window, and a named technical escalation contact available during testing. Depending on scope we may also need test accounts for each application role, read only reviewer access to your cloud tenant, and written approval from any third party hosting provider whose infrastructure is in scope. We supply templates for all of this, and the whole pack typically takes under a week to complete.
Related NetSys security and infrastructure services
Testing rarely stands alone. These are the services UAE clients most often combine with a VAPT engagement.
Managed Security Service Provider Dubai
Continuous monitoring, threat detection and incident response once testing has established your baseline.
Managed IT and MSSP Services
Fixed AED managed IT and security operations, the delivery arm that closes findings after a test.
Networking and Security Solutions Abu Dhabi
Firewall, segmentation and network architecture work driven by internal testing findings.
Data Loss Prevention
Discovery and classification controls for the sensitive data a test shows is reachable.
Disaster Recovery Solutions
Tested failover and immutable backup, the control that decides how a ransomware incident ends.
Cloud Migration Services UAE
Azure, AWS and Microsoft 365 migration with security posture designed in, not retrofitted.
IT Consulting
Vendor neutral roadmap work when findings point at architecture rather than configuration.
IT AMC Contracts UAE
Annual maintenance with patching discipline, which prevents most findings recurring.
NetSys Security Insights
Guides and analysis on UAE cybersecurity, compliance and infrastructure from our engineering team.
Start with a scoping call, not a sales pitch
Thirty minutes with an engineer to understand your environment, your compliance driver and what actually needs testing. You leave with a written scope and a fixed AED quote, whether or not you proceed with us.
- Thirty minute technical scoping call, no obligation
- Written scope document and fixed AED quotation
- Honest answer on whether you need accredited testing
- Free retest included in every engagement we quote
NetSys IT Infrastructure
DIRECT LINE
+971 56 690 6916EMAIL
sales@netsys.aeCOVERAGE
Abu Dhabi, Sharjah, all UAE