A 6-step process for selecting a penetration testing company
A structured process keeps the decision about evidence, not sales presentations. Run the same steps with every provider so the answers are comparable.
- Build a shortlist Choose two or three providers whose services, credentials and UAE presence fit your scope. Use the ranking and its methodology, and for Dubai government work start from the DESC register.
- Send a written request Share the same scope with each provider: assets, roles, depth, standards, test window and deliverables. The cost guide lists what to include.
- Hold a scoping call Listen for questions about your architecture, data and business logic. A provider that asks little is pricing a scan.
- Review a sample report Ask for an anonymised report and read it against the section on sample reports below.
- Check references and people Ask for the testers' names and credentials, and for reference conversations where the provider's contracts allow.
- Agree the contract Confirm scope, authorisation, rules of engagement, liability, NDA, data handling and retest terms before work starts.
Run the process in parallel for every shortlisted provider and keep the answers in one comparison table, so differences in scope, method and price are visible before the contract stage. The comparison template later in this guide covers the rows.
Match the provider to your situation
Priorities change with the buyer. The table shows what to weigh first in the most common UAE situations.
| Your situation | Prioritise | Check first |
|---|---|---|
| Dubai government, semi-government or critical entity | A provider certified under DESC Cyber Force | Listing and expiry date on the DESC register, and the named consultants' credentials |
| Bank, insurer or other financial institution | Experience with payment and financial systems, and reports mapped to your regulator and PCI DSS | A sample report with framework mapping, and the retest terms |
| Healthcare entity in Abu Dhabi | Reports mapped to ADHICS control OM 7.1 and careful handling of patient data | Data handling terms and the provider's experience with clinical systems |
| E-commerce, SaaS or fintech scale-up | Depth in web application and API testing, fast retests and clear reports | Whether testers work in grey box mode and can retest after each release |
| Industrial or OT operator | Safety-aware methods for control systems | Rules of engagement for running equipment, and OT references |
| Small business | A narrow, fixed-scope test with a clear report | Scope, deliverables and the price per tester-day |
For regulated buyers, read the compliance guide first, and confirm which rule applies before you collect quotes.
Penetration testing credentials that matter
Credentials work at two levels. Company-level credentials describe how a provider operates. Individual credentials describe what its testers have proved they can do. Look for both, and verify each one at its source.
| Company credential | What it shows | How to verify |
|---|---|---|
| CREST accreditation | The company is accredited by CREST for services such as penetration testing and incident response | Search the CREST marketplace |
| DESC Cyber Force | The company is certified to provide penetration testing or incident response to Dubai government, semi-government and critical entities | Check the DESC register for the service and the expiry date |
| ISO/IEC 27001 | The company runs a certified information security management system | Ask for the certificate and its scope; it describes the company's own security, not the quality of its tests |
| PCI QSA company | The company is qualified by the PCI Security Standards Council to assess PCI DSS compliance | Relevant to who validates your PCI DSS evidence, not a test credential |
DESC Cyber Force also sets the bar for the people. According to CREST's Dubai page, team members at a certified provider hold credentials such as CRT, OSCP, ECSA, LPT, GPEN or GWAPT, and team leaders hold CCT INF, CCT APP, OSEP, OSWE or GXPN. Consultants also need a Dubai Police security clearance certificate. That list is a useful reference for any buyer who wants to see what a senior tester holds.
| Individual credential | Issuer | What it covers |
|---|---|---|
| OSCP | OffSec | A 24-hour proctored practical exam on attacking systems |
| OSEP | OffSec | Evasion techniques and breaching defended networks |
| OSWE | OffSec | White box exploitation of web applications |
| CRT, CCT INF, CCT APP | CREST | Registered penetration tester and certified tester in infrastructure and in applications |
| GPEN, GWAPT, GXPN | GIAC | Penetration testing, web application penetration testing and advanced exploitation |
| CEH | EC-Council | A 125-question, four-hour knowledge exam, with a separate CEH Practical of 20 challenges in six hours |
| CPENT | EC-Council | A fully practical exam of 24 hours or two 12-hour sessions, with a report due within seven days |
CEH, CPENT and OSCP differ in what they test. Details are on the issuers' pages for OSCP, CPENT and CEH. In plain words:
- OSCP shows that a candidate can attack systems and write up the results within a 24-hour proctored practical exam. DESC Cyber Force lists it among accepted team member credentials.
- CPENT is a fully practical exam under time pressure, and the candidate submits a report within seven days. It suits testers who want a practical credential with written reporting.
- CEH tests knowledge of attack techniques and tools in a four-hour exam, with a separate practical exam of 20 challenges. It is a useful baseline, so ask the testers who will lead your project for practical credentials as well.
A certificate shows skill at one point in time, so also ask for a sample report from the person who will lead your test.
Big 4, specialist, boutique or platform: where each fits
Providers come in four shapes. None is better in general, and each suits a different kind of project.
| Type | Where it fits | Trade-offs |
|---|---|---|
| Big 4 member firm | Large programmes that combine audit, risk, compliance and technical testing under one relationship | Broader scope can mean a larger engagement, and the testers on your project may sit inside a wider team |
| Specialist cybersecurity firm | Organisations that want penetration testing alongside managed security, monitoring or compliance services | Ask who delivers the test and how it connects to the provider's other services |
| Boutique offensive security team | Teams that want senior testers, manual depth and red team work | Check capacity and scheduling for large or urgent scopes |
| Platform or PTaaS provider | Teams that release often and want on-demand testing and a dashboard | Depth varies, so ask what is automated and who validates findings |
The Big 4 are the four largest professional services networks: Deloitte, PwC, EY and KPMG. In the UAE each operates through member firms, and the scope of offensive security services differs by firm. Check the DESC register to see which firm is listed for penetration testing.
20 questions to ask a penetration testing provider
Ask every provider the same questions, and compare the answers in writing.
Methodology
- Which methodology do you follow, such as OWASP, PTES or NIST SP 800-115?
- What share of the work is manual, and what is tool-driven?
- How do you validate findings before reporting them?
- How do you handle business-logic and authorisation testing?
- How do you protect production systems during exploitation?
People
- Who will lead my project, and which credentials do they hold?
- Which testers will do the work, and do you use subcontractors?
- How long have the testers worked on comparable systems?
- What happens if a named tester is unavailable?
Reporting
- Can I see an anonymised sample report?
- Are findings rated with CVSS and backed by proof of concept?
- Does the report include an executive summary and a remediation plan?
- Is a retest included, and how many rounds?
Legal and data
- Which authorisation letter and rules of engagement do you use?
- How do you handle NDAs, evidence storage and deletion?
- What liability and insurance terms apply?
- Do any tools or staff process my data outside the UAE?
UAE specifics
- Are you certified under DESC Cyber Force, and what is your listed expiry date?
- Do you hold CREST accreditation for penetration testing?
- Can you deliver reports mapped to PCI DSS, ISO/IEC 27001 or my regulator?
Questions to ask a provider's references
References are most useful when you ask about the work, not the relationship. Ask each reference contact the same questions:
- Which type of test did the provider run, and how large was the scope?
- Did the testers find issues that earlier scans or tests had missed?
- How clear was the report, and could your engineers reproduce the findings?
- How did the provider handle problems during the test, such as an outage or a scope question?
- Was the retest done on time, and were fixes verified properly?
- Would you use the same provider for a similar project?
Local presence, remote delivery and language
Delivery model affects cost, scheduling and data handling. Internal network, wireless and physical tests may need testers onsite in Dubai or Abu Dhabi, while application, API and external tests are usually run remotely. Ask where the testers are based, which hours they work and whether they can join your meetings.
Ask about language as well: the working language of the project, the language of the report and whether an executive briefing is available in the language your board uses. For data handling, confirm where staff and tools process evidence, as covered in the compliance guide.
Red flags when choosing a penetration testing company
- Scanner-only output. The sample report is a tool export with generic descriptions.
- No sample report. The provider declines to show any report, even anonymised.
- No retest. Fixes are never rechecked, or the retest terms are vague.
- Vague scope. The quote does not list assets, roles, depth or exclusions.
- Price pressure. The provider presses for a decision or a discount before scoping.
- Guarantees. The provider promises a system will be "unhackable" or that no issues will be found.
- No named testers. The provider will not say who does the work.
A single red flag is a reason to ask questions. Several together are a reason to choose another provider.
Signs of a strong provider
Strong providers behave consistently from the first call to the retest.
- They ask about your business first. Questions about data, users and critical processes come before the quote.
- They name the people. The lead tester and the team are identified, with credentials.
- They explain the method. A written methodology links to a standard such as OWASP or NIST SP 800-115.
- They show a sample report. The sample has proof of concept, ratings and fix advice.
- They document authorisation. A letter and rules of engagement come before testing.
- They explain the retest. Rounds, window and cost are stated up front.
After you choose: the kick-off checklist
A short kick-off meeting prevents most delays once the contract is signed.
- Confirm named contacts on both sides, including an emergency contact for the test window.
- Hand over test accounts, VPN access and allow-listing details.
- Agree a change freeze for in-scope systems during the test.
- Agree the cadence of status updates and how urgent findings are escalated.
- Confirm the report delivery date and the retest plan.
How to read a sample penetration testing report
A good report serves two readers: executives who decide on risk and engineers who fix issues. The annotations in the mock report follow the rows below in order.
| Section | What good looks like |
|---|---|
| Executive summary | One or two pages in plain language, with business impact, overall risk and the top fixes |
| Scope and method | Assets, dates, test type and the standards followed, such as the OWASP Web Security Testing Guide or NIST SP 800-115 |
| Findings list | Each finding has a CVSS rating, the affected asset and a clear title |
| Evidence | Reproducible proof of concept: requests, screenshots and steps |
| Impact | What an attacker could reach, written in terms of data and business processes |
| Remediation | Specific fixes for your technology, with references and a priority order |
| Retest results | A table showing which findings are closed, partly fixed or open |
Contract and legal checklist
The contract protects both sides. Review it with your legal team before testing starts.
- Authorisation letter. Signed by an authorised person, naming the provider, assets and dates.
- Rules of engagement. Allowed techniques, limits, test window and emergency contacts. See rules of engagement.
- Liability and insurance. Limits on liability and the provider's insurance for professional errors.
- NDA. Covers staff, subcontractors and tooling.
- Data handling. Where evidence is stored, how it is encrypted and when it is deleted.
- Ownership of the report. Who owns the report and who may receive it, including auditors.
- Retest terms. The number of rounds and the time window after delivery.
- Subcontractors. Whether any are used, and under which terms.
Have your legal team review the contract, and keep a signed copy of the authorisation letter with the final report, so the evidence trail is complete when an auditor asks for it.
Compare proposals side by side
Put the answers from each provider in one table, using the same rows. A blank cell is a question to ask, so fill it before you decide.
| Dimension | What to compare | Provider A | Provider B | Provider C |
|---|---|---|---|---|
| Scope covered | Assets, roles, depth and exclusions | |||
| Method | Standard followed, manual share, validation of findings | |||
| People | Lead tester, team size, credentials | |||
| Credentials | CREST, DESC Cyber Force, ISO/IEC 27001 status | |||
| Report | Sample, CVSS, proof of concept, remediation, executive summary | |||
| Retest | Rounds, window, included or priced | |||
| Timeline | Start date, test window, report delivery | |||
| Commercials | Tester-days, day rate, fixed items, VAT |
Printable RFP checklist
Print this page or save it as a PDF to use the checklist in a procurement meeting.
Use your browser's print command to print this checklist.
Frequently asked questions about choosing a penetration testing company
Which company is considered the best for penetration testing?
No single company is best for every buyer, because the right provider depends on your scope, sector and credentials. The ranking compares ten providers by services, listed accreditations, UAE relevance and reporting. Use the checks in this guide to test any shortlist: a written scope, verified credentials such as CREST and DESC Cyber Force, named testers and a sample report with proof of concept.
Who is the best penetration tester?
No one holds that title, and there is no official ranking of individual testers. Buyers judge testers by verifiable credentials such as OSCP, OSEP, OSWE or CREST CRT and CCT, by sample reports and by the project they will lead. For Dubai government work, DESC Cyber Force asks consultants at certified providers to hold accepted certifications and a Dubai Police security clearance certificate.
Which is better, CEH or CPENT?
They test different things. CEH is a knowledge exam of 125 questions in four hours, with a separate CEH Practical of 20 challenges in six hours. CPENT is a fully practical exam of 24 hours or two 12-hour sessions, with a report due within seven days. Choose by the skill you need to verify, and ask a provider which credentials its testers hold.
Is CPENT a better certification than OSCP?
Neither is better in general. Both are practical exams: OSCP is a 24-hour proctored exam from OffSec, and CPENT is a fully practical exam from EC-Council lasting 24 hours or two 12-hour sessions. Buyers should look at the full set of credentials, the tester's experience and a sample report, because a single certificate shows skill at one point in time.
What are the top 3 cybersecurity certifications?
There is no official top three, and the right ones depend on the role. For penetration testers, the DESC Cyber Force list is a practical reference: team members at certified providers hold credentials such as CREST CRT, OSCP, ECSA, LPT, GPEN or GWAPT, and team leaders hold CCT INF, CCT APP, OSEP, OSWE or GXPN. Ask each provider which credentials its testers hold.
What is the Big 4 in cybersecurity?
The Big 4 are Deloitte, PwC, EY and KPMG, the four largest professional services networks. Each runs a cybersecurity practice through member firms, and the scope of penetration testing differs by firm. Deloitte & Touche ME and KPMG Lower Gulf both appear on the DESC Cyber Force register for penetration testing. Big 4 firms suit programmes that combine audit, risk and testing, while specialists concentrate on offensive work.
Do penetration testers need to be certified?
Not for every engagement, but often in practice. DESC Cyber Force sets accepted certifications for consultants at certified providers, including CRT, OSCP, GPEN and OSWE. PCI DSS asks for qualified testers. Even where nothing is mandatory, certifications such as OSCP and CREST CRT show verified practical skill, and a buyer should ask for them alongside a sample report.
Sources and updates
Credential details come from the issuing bodies and the DESC and CREST pages below, read in November 2026. Check each credential at its source before you rely on it.
- DESC certified providers register
- CREST: Dubai Cyber Force programme
- CREST marketplace
- ISO/IEC 27001
- OffSec PEN-200 and OSCP
- EC-Council CPENT
- EC-Council CEH
Related guides: Is penetration testing mandatory in the UAE?, types of penetration testing and AI penetration testing.
Last updated