Penetration testing companies that serve UAE organisations can ask the Editorial Desk to review them for the ranking. Review is by email, and there is no form. This page explains the inclusion criteria, the evidence to send, how the review works and what happens next.
Inclusion criteria
The criteria are the same for every company and match the methodology. A company is considered when it meets all four:
- It offers penetration testing. Network, application, cloud, red team or related offensive security services are described on its own website.
- It serves UAE organisations. It has a UAE presence, or it lists UAE or regional clients and services for the region.
- It publishes its services. Scope, service names and delivery are visible on its website.
- It communicates in English. Its website and reports are available in English.
What to send
Send links, not attachments. The desk reads the company's own pages and checks credentials at the source.
- Company name and website. The address of the main site and the legal name used in contracts.
- Service pages. Links to the pages that describe your penetration testing services.
- Presence. Where you work in the UAE and the region, as described on your website.
- Credentials. Links to your entry on the CREST marketplace, the DESC certified-providers register or the certificate of any other credential you list.
- Report format. A description of what a client receives: evidence, risk ratings, remediation advice and retest options.
- Specialisation. Focus areas and published technical work, such as research or a technical blog.
How the review works
The desk reads the material against the six comparison points in the methodology, checks each credential at its register or issuer, and records the review date. The company then receives a reply that says whether the profile can be added at the next update. Profiles use one layout for every company, written by the desk, so the desk does not publish copy supplied by a company.
Inclusion is decided by fit with the criteria and by the shortlist's scope. Submission does not guarantee inclusion, and the position of a company in the ranking is set by the desk.
Timeline
The desk aims to confirm receipt within five working days. Reviews are completed in the next quarterly update, and any accepted change is recorded in the changelog on the methodology page. A company that is already listed can use the same route to update its profile.
Send your submission
Use the button below to open an email with the subject and the fields prefilled, or copy the template into your own message and send it to editor@best-penetration-testing-services.ae.
Company name:
Website:
Service pages (links):
Presence in the UAE and the region:
CREST marketplace entry (link):
DESC register entry (link):
Other credentials (name and certificate link):
Report format (short description):
Specialisation and published work (links):
Contact name and role:Frequently asked questions about submitting a company
How can a company be added?
Email the editorial desk at editor@best-penetration-testing-services.ae with the company name, website, service pages, presence, credentials and a description of the report format. The desk reads the material against the six comparison points, checks credentials at the CREST marketplace and the DESC register, and replies. Accepted profiles are added at the next quarterly update and recorded in the changelog.
What evidence is needed?
Links to the company's own service pages are the core evidence, together with links to the credentials it lists, such as its CREST marketplace entry, its DESC Cyber Force register entry or an ISO/IEC 27001 certificate. A short description of the report format, including evidence, risk ratings, remediation advice and retest options, helps the desk compare the company on the same points as others.
Does submission guarantee inclusion?
No. Inclusion depends on whether the company meets the inclusion criteria and fits the scope of the shortlist, and the desk sets positions. The ranking is a curated shortlist of penetration testing companies serving UAE organisations. A reviewed company that meets the criteria can be added at a quarterly update, and the changelog records each addition with its date.
How long does review take?
The desk aims to confirm receipt within five working days, and the review itself is completed in the next quarterly update. A company with a complete submission, including its CREST marketplace and DESC register links, is easier to review. Corrections to an existing profile follow the same route and are recorded in the changelog on the methodology page.
Sources and updates
Credentials are checked at these registers.
Last updated