Sara Al MCustomer since 2023
Exposed
- Phone
- +971 50 4821
- sara.a@gmail.com
- Card on file
- •••• 7730
One edited link. Any customer's data.
Penetration testing in Dubai and the UAE, for companies that hold customer data.
We test your web apps, APIs, networks, cloud and mobile apps by hand. Every finding comes with proof, a severity rating you can defend, and a fix your developers can apply.
- Fixed quote after a scope call
- Written report with a fix for every finding
- Retest once you've fixed
What we test
Penetration testing scoped to what you actually run
Pick one area or combine several. We agree the scope with you up front, so you know exactly what gets tested and what doesn't.
Web application penetration testing
Customer portals, booking systems, dashboards and admin panels, tested the way a real attacker would, logged in as each of your user roles.
- Access control: can one customer reach another's data?
- Login, sessions and password reset
- Payment, booking and other business-logic flows
API penetration testing
REST and GraphQL APIs behind your apps, mobile apps and integrations, including the authorisation flaws that scanners miss.
- Object- and function-level authorisation
- Authentication, tokens and API keys
- Rate limits and data leaking in responses
External network penetration testing
Everything you expose to the internet: servers, VPNs, email, remote access and forgotten subdomains.
- Discovery of what's actually exposed
- Remote access, VPN and email services
- Outdated or misconfigured services, proven rather than listed
Internal network penetration testing
What an attacker could reach after one phished laptop or a rogue device on your office Wi-Fi.
- Active Directory and privilege escalation
- Separation between office, server and guest networks
- Office Wi-Fi and network devices
Cloud penetration testing
AWS, Azure and Google Cloud: who can access what, what's publicly exposed, and whether a small foothold can grow into control of your account.
- Identity and access, and privilege escalation
- Exposed storage, secrets and keys
- Network exposure, workloads and logging
Mobile app penetration testing
iOS and Android apps and the backends they talk to, from stored data to network traffic.
- Data stored on the device
- Traffic between the app and its backend
- The APIs and authentication the app relies on
VAPT
VAPT services
Asked for a VAPT by a client, auditor or bank?
A VAPT combines a vulnerability assessment for coverage with a penetration test for depth. See what it includes, what you receive, and what a "VAPT certificate" actually is.
When to test
When UAE companies book a penetration test
Most tests start with one of these. Tell us which applies on the scope call, so the report gives the right people what they need.
A client or partner asks for one
Larger customers, banks and partners often ask suppliers for a recent penetration test or VAPT before they sign or renew. The report and attestation letter answer that request.
An audit or certification
ISO 27001, PCI DSS and other frameworks expect regular security testing. We scope the test to cover the systems your auditor will ask about.
A launch or a major release
A new customer portal, app or API is the best time to find access-control flaws, before real customer data goes in.
A move to the cloud
New accounts, roles and storage are easy to misconfigure. A cloud penetration test checks what's exposed before attackers do.
After an incident or a near miss
If something already went wrong, a test shows whether the same route, or a similar one, is still open.
Once a year
Systems change all the time. A yearly test, plus one after big changes, keeps the picture current for your board and your clients.
How an engagement runs
From scope to retest
You always know what's being tested, when, and who to call if something looks off.
01
Scope
We agree what's in scope, test windows and emergency contacts, and send a fixed quote.
02
Testing
Tooling for coverage, then hands-on testing to chain issues together and show real impact.
03
Report
A written report with an executive summary, proof for each finding, and fixes ranked so your team knows what to tackle first.
04
Retest
Once you've fixed, we retest and issue an attestation letter confirming what's closed.
Where we spend our time
The serious issues are usually logic and access-control flaws: one customer reaching another's data, a payment step that can be skipped, an admin action anyone can call. Scanners don't find these. That's where most of our testing goes.
What you get
A report both your board and your developers can use
- Executive summaryPlain-language risk overview for leadership. No jargon.
- Proof for every findingSteps to reproduce, evidence and business impact.
- Prioritised fixesScored with CVSS, mapped to OWASP, with fix guidance for your stack.
- Attestation letterConfirmation of what was tested and what's been fixed, for auditors, insurers and your own clients.
Executive summary
Example
Web application & API assessment
Findings by severity
0Critical
4High
5Medium
4Low
AR-003Customer records readable by any userHigh
AR-001Admin panel reachable from the internetHigh
AR-007Password reset link never expiresHigh
AR-010No rate limit on login attemptsMedium
AR-012Verbose error messages reveal stackLow
Illustrative example, not a client report.
FAQ
Common questions
Something else on your mind? Ask us on the scope call.
How much does a penetration test cost in the UAE?
It depends on how much there is to test: the number of applications, user roles, API endpoints, IP addresses or cloud accounts, and so the number of testing days. We send a fixed quote after a 20-minute scope call, so the price doesn't move once testing starts. Our penetration testing cost guide explains what drives the price and how to compare quotes.
Will testing break our live systems?
We agree test windows and off-limits actions up front, avoid destructive techniques on production, and keep a direct line to your team throughout. If anything looks unstable, we stop and call you.
How long does a test take?
Most single-application or external network tests take one to two weeks from kickoff to report. The scope call gives you a firm timeline and a fixed quote.
What's the difference between a vulnerability scan and a pentest?
A scan is an automated tool checking for known issues, such as outdated software. A pentest is a person working through your systems to find what tools miss, like access-control and business-logic flaws, and proving what an attacker could actually do with them. Scans are useful between tests, but they don't replace one.
What are the stages of a penetration test?
Frameworks describe them differently, often as five stages: planning, reconnaissance, scanning, exploitation and reporting. We run them as four steps you can follow: scope (planning), testing (reconnaissance, scanning and hands-on exploitation), report, and a retest once you've fixed.
Is penetration testing legal?
Yes, when it's authorised. Before we start, you approve the scope in writing: which systems, which test windows, and what's off limits. We only test systems you own or have the right to have tested, and for cloud and hosted services we also follow the provider's own testing rules.
What do you need from us?
A list of what's in scope, a technical contact, and test accounts if you want authenticated testing. We send a short checklist after the scope call.
How do you handle our data?
We access only what's needed to prove a finding, redact personal data in reports, keep engagement data stored in the UAE, and delete it at the end of the engagement.
Get started
Know where you're exposed.
Book a 20-minute scope call. We'll ask what you run, recommend what to test, and send a fixed quote.