A real penetration test in Dubai starts from around AED 9,000 for a focused scope, with most full engagements landing between AED 15,000 and 50,000 [1]. These are our own figures, not a market survey. The quotes that come in far cheaper than that are almost always an automated scan with a branded cover page. That gap, between a scan and a real test, is where most UAE buyers get burned, because the report looks similar and the price looks like a bargain. This guide covers the real cost by scope, which UAE laws actually require testing, and how to tell a pentest from a scan before you pay for the wrong one.
We do security work for UAE businesses out of our Dubai and Bengaluru teams, in a market where attacks on internet-facing systems are constant and, in the projects we see, phishing is still the most common way in [1]. Against that backdrop, a test is cheap. Paying for the wrong kind of test is expensive, because it gives you a clean report and a false sense of safety.
How much does a penetration test cost in Dubai?
Most SME engagements land between AED 15,000 and 50,000, with a focused scope starting around AED 9,000 [1]. Cost scales with scope, methodology, and the seniority of the testers. Here is the 2026 picture by what you are testing, taken from the projects we see rather than from a published market survey:
| Scope | Cost (AED) |
|---|---|
| Web application (single app) | 15,000 to 55,000 |
| Mobile application (iOS + Android + API) | 18,000 to 110,000 |
| API | 18,000 to 73,000 |
| Network, external perimeter | 35,000 to 75,000 |
| Network, internal / Active Directory | external + 10 to 30% |
| Cloud config review | 2,200 to 3,700 |
| Cloud infrastructure (comprehensive) | up to 150,000 |
| Web + API + cloud combined | from 75,000, scoped in discovery |
| Enterprise red team | scoped in discovery (large custom engagements) |
In the engagements we scope, five things move the price: scope, methodology, infrastructure complexity, the compliance standard you are testing against, and the testers' credentials [1]. A CREST or OSCP-certified team charges a premium because they find what tools miss. Final pricing always depends on scope and is confirmed during discovery.
The cheap quote is a scan, not a pentest
In the quotes we see, anything under about AED 15,000 for a full penetration test is almost always an automated vulnerability scan relabelled as a test [1]. This is the single most common way UAE businesses overpay for under-protection, and it is easy to avoid once you know the tell.
In the engagements we run, a real penetration test is roughly 30 to 40 percent automated scanning and 60 to 70 percent manual exploitation [1]. The manual part is where senior testers think like attackers, find business-logic flaws no scanner knows about, and chain small issues into a real breach path. A scanner runs in hours against a database of known issues and produces false positives. A pentest runs over one to three weeks and proves real-world impact.
Straight talk: the clearest red flag is the deliverable. If the report you get back is a Qualys or Nessus export with the vendor's logo on the cover, you bought a scan [1]. A genuine pentest report has a narrative: what the tester tried, what worked, screenshots of the exploit, and the attack chain. The difference is not cosmetic. A scan tells you a door is unlocked. A pentest walks through it and shows you it reaches the customer database.
Which UAE laws require penetration testing?
If you are in a regulated sector or supply the government, annual penetration testing is a requirement, not a choice [5][6]. Here is how the main UAE frameworks map, because this is the part most cost guides leave out:
- DESC ISR (Dubai). Version 3 mandates annual penetration testing of external-facing services plus quarterly vulnerability assessments for Dubai government, semi-government, and their suppliers [5].
- NESA / UAE IAS (federal). Mandates periodic VAPT for government and critical-infrastructure entities, with findings scored in CVSS v3.1 for the audit evidence [6].
- CBUAE (banking and fintech). Annual penetration testing and quarterly vulnerability assessments for financial institutions [7]. Our fintech and CBUAE compliance guide covers the wider picture.
- ADHICS (Abu Dhabi healthcare). Testing required for health information systems. See our healthcare app and DHA compliance guide for the sector context.
- PCI DSS and ISO 27001. PCI requires annual testing and after significant changes [4]. ISO 27001 expects technical controls to be tested under a risk-based approach [8].
- UAE PDPL. The law does not name penetration testing, but its requirement for appropriate technical measures and breach detection makes regular VAPT the practical way to demonstrate compliance [9].
Non-compliance with UAE critical-asset regulations can bring financial penalties and operational restrictions, on top of the cost of the breach itself. The test is the cheap part.
What you actually get, and how to choose
A credible penetration test follows a named methodology, OWASP for web and mobile, PTES for the lifecycle, NIST or OSSTMM for compliance-heavy work, and delivers a report you can act on and defend in an audit [2][3]. The report should contain a plain-language executive summary, every finding with evidence and a CVSS score, prioritised remediation with owners, the testers' credentials, and the regulatory mapping for your framework.
The two things buyers most often forget to confirm:
- The retest. A reputable provider includes at least one retest cycle to verify that critical and high findings are actually fixed, marked verified-fixed, risk-accepted, or partially remediated [1]. A test without a retest leaves you with a problem list and no proof you closed anything, which fails an audit.
- Who is testing. Ask for the named testers and their certifications. OSCP, CREST, CHECK, and GIAC are the credible, hands-on credentials. CEH and similar prove knowledge, not skill. A firm that will not say who is doing the work is a warning sign.
It also helps to agree the rules of engagement in writing before testing starts: what is in scope, what is explicitly out, the testing window, and who to call if something breaks. A clear scope document protects both sides and is itself a sign of a professional firm, because the cheap operators rarely bother with one.
Common mistake: buying on price and scope alone, then accepting a scan because the report has findings in it. Ask for a redacted sample report before you sign. It tells you more than any sales deck, because it shows whether the firm exploits and explains findings or just forwards scanner output. If a vendor will not share even a redacted sample, assume there is nothing worth showing.
How often, and the case for continuous testing
Test at least annually, plus after any major change: a new app, an API release, a cloud migration, or an architecture change [4][5]. Finance and healthcare test quarterly, and public-facing apps under NESA, DESC, or CBUAE are usually tested quarterly too. Last year's clean report says nothing about the system you shipped last month.
For teams shipping frequently, especially on cloud, PTaaS (Penetration Testing as a Service) tests on every change rather than once a year. It suits fast-moving products where an annual snapshot goes stale, but verify there is real manual depth behind it, not automated rescans dressed up as continuous testing. For the cloud side specifically, a config review is cheap, but a full cloud pentest across identity and access is a different engagement, which our cloud solutions team scopes properly rather than running a single scan and calling it done.
How to lower the cost without cutting corners
You can reduce a pentest bill honestly, and it is worth knowing how, because the alternative most people choose, the cheap scan, is not a saving at all. Three levers actually work:
- Scope tightly. Test what matters most first, your internet-facing web app and API, rather than everything at once. A focused engagement on your real attack surface beats a thin test spread across systems nobody attacks.
- Choose grey box. Giving the testers partial access and credentials, rather than making them break in from zero, is the cost-effective middle ground most mid-size UAE firms use. It costs less than black box and goes deeper than a blind external test.
- Supply documentation upfront. Network diagrams, API docs, and credentials cut the reconnaissance time the testers would otherwise bill for, which lowers the hours without lowering the depth of testing [1].
Quick math: what you should never trade away is the manual testing ratio and the retest. A AED 30,000 grey-box test of your core app, with documentation supplied and a retest included, protects you far better than a AED 8,000 scan of everything that finds nothing real. The cheap option is expensive the day you are breached, because containing an incident and rebuilding trust costs far more than the test would have. Scope down, do not test down.
How this played out for three clients
Real situations from our security work. Names and details changed for privacy.
A Dubai fintech. They had passed a "penetration test" from a cheap vendor and showed it to a banking partner, who rejected it as a scan. We ran a proper CBUAE-aligned engagement, found a real authentication flaw the scan had missed entirely, and delivered an audit-ready report with a retest. "The cheap report cost us a partnership delay," the CTO says. "The real one cost less than the delay."
An Abu Dhabi healthcare provider. Their ADHICS audit needed evidence with CVSS scores and a retest, which their previous tool-run report did not have. We tested to the standard and mapped every finding to the framework. "We thought any report would pass," they say. "Auditors want the methodology and the retest, not a list."
A SaaS company (DIFC). They were testing once a year but shipping weekly, so their report was stale within a month. We moved them to a quarterly cadence with testing after major releases. A flaw introduced in a mid-year release was caught months before the annual test would have found it. "Annual testing matched a world where we shipped annually," the founder says. "We don't."
How SKIMBOX approaches VAPT
We scope to what you actually run, test with certified people using a named methodology, and deliver an audit-ready report with CVSS scores, prioritised fixes, regulatory mapping, and a retest included, not a scanner export with our logo on it. We tell you honestly whether you need an annual test or continuous validation. If you want a straight assessment of where you stand, see our cybersecurity services, or contact us.
References
[1] SKIMBOX - Our own pricing and internal experience running VAPT and compliance-aligned testing for UAE clients across fintech, healthcare, and SaaS, covering cost by scope, the drivers that move a quote, the manual-to-automated testing balance, report and retest practice, and how to scope a test down honestly, 2026. skimbox.co
[2] OWASP - Web Security Testing Guide and the OWASP Top Ten, web and mobile testing methodology. owasp.org
[3] NIST - Special Publication 800-115, Technical Guide to Information Security Testing and Assessment. nist.gov
[4] PCI Security Standards Council - PCI DSS penetration testing requirements, including testing after significant change. pcisecuritystandards.org
[5] Dubai Electronic Security Centre (DESC) - Information Security Regulation (ISR) and its testing requirements for Dubai government entities and their suppliers. desc.gov.ae
[6] UAE Cyber Security Council - UAE Information Assurance Standards (NESA / UAE IAS) for government and critical-infrastructure entities. csc.gov.ae
[7] Central Bank of the UAE - regulatory framework and technology risk requirements for licensed financial institutions. centralbank.ae
[8] ISO - ISO/IEC 27001:2022, Annex A control 8.8 on the management of technical vulnerabilities. iso.org
[9] The United Arab Emirates Government portal - Federal Decree-Law on the Protection of Personal Data (PDPL). u.ae
