Penetration testing in Dubai, UAE
iConnect provides penetration testing in Dubai for networks, applications, cloud environments and connected devices. Each finding is confirmed by exploitation, rated by the exposure it creates in your environment, and retested after remediation.
Penetration testing confirms whether security controls work as configured
Security controls are designed and configured against an expected model of how an attack will arrive. Penetration testing checks that model against what your network and applications permit today.
The weaknesses this identifies include outdated firewall rules, services exposed after a migration, credentials reused across environments, and segmentation that is not enforced in the network configuration.
Each weakness is confirmed by exploiting it within the agreed scope, so the report describes demonstrated routes into named systems, with the evidence for each one.
What penetration testing shows that a scan cannot
A vulnerability scan reports the weaknesses that are present. A penetration test establishes which of them can be exploited and what access they provide.
Penetration testing services we deliver
The scope of an engagement is set by where your systems are exposed. During scoping, iConnect confirms which of these services apply to the systems you run.
Network penetration testing
Active testing of internal and external networks for exploitable misconfiguration, weak segmentation and exposed services. Scan results are verified by exploitation to establish which entry points lead to further access.
Internal and external testing
External testing is carried out from the internet without credentials, in the position of an outside attacker. Internal testing starts from an assumed foothold on the network and measures how far it can reach, which shows whether segmentation is effective.
Wireless network assessment
Testing of wireless networks for rogue access points, weak encryption, guest network leakage and any route from a visitor network into corporate systems.
Configuration review
Review of device and server builds against hardening baselines, covering vendor default settings and temporary exceptions that remain in place.
Web application testing
Testing against the OWASP Top 10 and beyond, covering injection, access control failures, authentication logic and business logic flaws that require manual testing.
Mobile application testing
iOS and Android testing covering insecure local storage, weak authentication, certificate handling and the API traffic between the app and its back end.
API penetration testing
Testing of REST and GraphQL endpoints for authorisation flaws, missing rate limiting, object-level access control failures and data exposure, including endpoints that are not visible through the application front end.
Cloud security assessment
Review of AWS, Azure and Google Cloud configuration covering identity policy, storage exposure, network paths and privilege escalation routes within the account.
Red teaming
An objective-led engagement against your live environment, carried out without advance notice to the defending team. It tests detection and response as well as the technical controls.
Social engineering
Phishing, pretext telephone calls and physical access attempts, agreed in scope beforehand, to measure how staff respond to a realistic attempt and where awareness training needs reinforcing.
Continuous automated red teaming
Attack techniques run on a continuous basis against your environment between manual engagements, so that control effectiveness is measured against the current state of the systems.
IoT and OT testing
Testing of connected devices, firmware and industrial protocols, planned around equipment that cannot be patched or taken offline for a test window.
Vulnerability assessment
Authenticated and unauthenticated scanning across the full estate, identifying known weaknesses across a wider set of systems than a focused test covers.
Compliance-driven testing
Testing scoped to the control being examined under PCI DSS, ISO 27001, the UAE IA Standards or DESC ISR, with the report written to meet the assessor's evidence requirements.
Remediation retesting
Verification that each fix has closed the path it was meant to close, including related routes that a partial fix can leave open.
Continuous vulnerability monitoring
Ongoing identification of new exposure as your systems change, covering the period between annual tests.
UAE compliance frameworks that require penetration testing
Several UAE frameworks require security testing and specify scope and evidence requirements. The engagement is mapped to the control being examined so that the report can be used at audit.
UAE Information Assurance Standards
The IAS requires periodic technical testing with documented findings and evidence of remediation. Scope is agreed against the control set you report on, and the remediation record is included in the deliverables.
DESC ISR
Dubai government and semi-government bodies are assessed on testing frequency, scope and closure of findings. Reports are structured so that an assessor can follow each finding from discovery to confirmed closure.
PCI DSS
Cardholder environments require segmentation testing and both internal and external penetration testing at defined intervals. The test is scoped to the cardholder data environment and its boundary.
ADHICS and ISO 27001
Abu Dhabi healthcare entities and ISO 27001 certified organisations both require technical assessment evidence on a defined cycle. Findings are mapped to the relevant control to support the evidence pack.
How a penetration test runs
The systems in scope, the permitted techniques, the exclusions and the testing windows are agreed with you. This is documented and signed before testing starts.
- Systems that cannot tolerate active testing are listed and excluded
- Denial of service techniques are excluded by default and included only on written request against a test environment
- A named contact on each side and an open communication channel for the duration of the test
The testers build a picture of what is reachable from the chosen starting point and compare it with the asset inventory and the network documentation.
- External footprint enumerated, including subdomains and legacy services
- Exposed technologies and version details catalogued before any exploitation is attempted
- Significant exposures found at this stage are reported immediately so they can be closed before the test finishes
Candidate weaknesses are tested by attempting to exploit them, then chained together to establish how far an intrusion could reach from that starting point.
- Every action logged with a timestamp so your team can reconcile test activity against their alerts
- Privilege escalation and credential reuse followed to their limit within the agreed scope
- Segmentation tested against what the network permits and compared with the documented design
Findings are rated on exploitability and business impact together, so that remediation effort is directed to the routes that provide the most access.
- A chain of low-severity items is rated as the compromise it enables, not as separate minor issues
- Each finding is traced to the specific change that closes it where one exists
- The reasoning behind each rating is documented so severity can be reviewed with the system owner
You receive an executive summary and a technical report. The findings are then presented to your team in a review session, with time for questions on each item.
- Reproduction steps and captured evidence for every finding
- A remediation plan with an owner and a target date on each item, agreed with the teams responsible
- A version written for your assessor where the test is carried out to satisfy a control
After remediation, each finding is tested again. A finding is closed when the original path is confirmed closed.
- Related routes are also retested to confirm that no alternative path to the same system remains open
- Partial fixes that have left the underlying route open are identified and reported
- A closure statement suitable for presentation to an auditor
Three penetration testing approaches
Black box
The testers start with no information beyond the organisation's name, in the position of an external attacker. This measures the perimeter as an outsider sees it. It takes longer because reconnaissance is included in the work.
Grey box
The testers start with the level of access a compromised user or a contractor would hold. This represents a realistic breach scenario and is a common starting point for a first engagement.
White box
The testers are given architecture documentation, configuration and source code. Coverage is deepest with this approach because no time is spent on discovery. It suits pre-release applications and systems that hold regulated data.
What the penetration test report contains
The report is the main deliverable. It is written so that an engineer can reproduce every finding and a board member can understand the exposure.
When to schedule a penetration test
An annual test meets the minimum set by most frameworks. A test is also recommended after significant change, because a report reflects the systems as they were on the date of testing.
Sectors we test
The permitted scope of testing, the systems that can be tested actively and the evidence the report has to provide differ by sector.
Government
DESC ISR scope, segmentation evidence and a closure trail an assessor can follow.
Banking and Finance
Cardholder environments, payment boundaries and Central Bank expectations.
Healthcare
ADHICS scope, clinical applications and connected medical devices.
Manufacturing
IT and OT separation, tested without taking production offline.
Retail and E-commerce
Payment systems, store networks and customer-facing applications.
Education
Shared networks, student data and a large unmanaged device population.
Why organisations choose iConnect for penetration testing
Manual testing
Automated scanning supports the work. Exploitation, chaining and analysis are carried out by qualified testers.
Scoped before pricing
The systems you run and the compliance obligation that applies are established before pricing, so the scope covers what needs to be tested.
Local delivery
Testing and reporting are delivered by iConnect's team in Dubai, working within your change windows and available to present findings to your engineers in person.
Written for two audiences
One report serves both the engineer who will fix the findings and the board that needs to understand the exposure.
Retesting included
Verification is part of the engagement. The work is complete when the identified paths are confirmed closed.
Documented for assessors
Scope, method and closure are recorded against the control being examined, so the evidence is available when an audit is due.
What our clients say
“Whenever an issue arises, iConnect is there immediately: quick, efficient and proactive in keeping everything running without disruptions. iConnect has become a crucial part of our operations.”
Head of IT Infrastructure and Network SecurityDragon OilFrequently asked questions about penetration testing
A vulnerability assessment uses automated scanning to identify known weaknesses across a large number of systems and reports them by severity. A penetration test goes further by attempting to exploit those weaknesses, confirming which ones can be used to gain access and how far that access reaches. The assessment provides breadth of coverage and the test provides confirmed results. Both are offered, separately or as a combined engagement, and several UAE frameworks expect regular assessment supported by periodic testing.
A single external perimeter or web application test is scheduled for one to two weeks including reporting. A full internal network test on a mid-sized organisation runs two to three weeks. Red team engagements run four to eight weeks because they are scoped by objective. The duration is confirmed at the scoping stage and stated in the proposal before the engagement is booked.
Scope, permitted techniques and exclusions are agreed in writing before testing starts, and systems that cannot tolerate active testing are listed and excluded. Denial of service techniques are excluded by default. Testing windows are agreed around your operations, and a named contact on each side is available throughout the engagement so that testing can be paused or stopped if a problem is observed.
Most UAE frameworks set an annual penetration test as the minimum, and a report reflects the environment on the date of testing. A test should also be scheduled after a significant change: a new external service, a migration, a major application release or an acquisition. DESC ISR and PCI DSS both set testing intervals, and targeted retesting is available between annual tests as systems change.
Testing is carried out by named testers holding industry certifications including OSCP, CEH and CREST-aligned qualifications. Automated scanning supports the work, but exploitation, chaining and reporting are done manually. The names and qualifications of the testers assigned to your engagement are provided before it starts.
Yes. Remediation retesting is included in the engagement. After your team has applied the fixes, each finding is tested again and is closed only when the original path is confirmed closed. Retesting also identifies partial fixes that have left the underlying route open.
Several UAE frameworks require testing evidence. The UAE Information Assurance Standards, DESC ISR for Dubai government and semi-government bodies, ADHICS for Abu Dhabi healthcare and PCI DSS for cardholder environments all require it. The audit outcome depends on scope and evidence quality, so the scope of the test is mapped to the control being examined and the report is written so that both your engineers and your assessor can use it.
You receive an executive summary written for management and a technical report with reproduction steps and evidence for every finding. Each finding carries a risk rating based on exploitability and business impact, a recommended remediation, an owner and a target date. The findings are presented to your team in a review session, and a retest report follows remediation.
Talk to our team about your requirement
We’re happy to answer any questions you may have and help you determine which of our services best fit your needs.
Our Value Proposition
- Tailored Solutions for Your Organization
- Unbiased Expertise
- Proven IT Competence
- Outcome-Driven Approach
- Proactive Problem-Solving
- Transparent Processes
What happens next?
We’ll arrange a call at your convenience.
We do a discovery and consulting meeting
We’ll prepare a detailed proposal tailored to your requirements.