Active Directory and lateral movement coverage
Whether the vendor's documented methodology explicitly covers domain enumeration, credential abuse and lateral movement between hosts — the core of any internal engagement.
How we rank internal penetration testing companies
This page explains how the companies compared on this site are selected, evaluated and ordered, and what our scoring can and cannot tell you.
What we evaluate
Every company in the comparison is assessed against the same six criteria, in the same order, using publicly available material.
Privileged access and Domain Admin path validation
Whether the vendor documents attack-path validation toward Tier‑0 assets rather than reporting isolated findings without a demonstrated route to domain compromise.
Named team certifications
Verifiable credentials stated by name — CREST, OSCP, GPEN, OSCE/OSWE, CEH, CISSP — rather than generic “certified experts” language that cannot be checked.
Compliance mapping
Whether services are positioned against the frameworks that trigger most internal pentest budgets: PCI DSS, SOC 2, HIPAA, ISO/IEC 27001 and the UAE PDPL.
Reporting and retesting
Whether an attack-chain narrative, supporting evidence and a defined retest cycle form part of the standard deliverable rather than a paid extra.
UAE presence and regulatory fluency
Physical presence, local case history, or explicit reference to UAE frameworks such as NESA/SIA and ADHICS, all of which change scope and reporting expectations.
Where our information comes from
Each company profile is built from publicly available sources: vendor websites and service pages, published case studies and methodology documentation, industry coverage, and where available third-party review platforms. During each review pass we also confirm that the vendor's linked URL still resolves and note where a corporate change — a rebrand, an acquisition, a moved domain — has altered what the vendor publishes.
We do not conduct our own hands-on technical audit of any vendor's testing quality. This is a comparison of publicly documented capability and positioning, not an independent lab test. Where a vendor's public materials do not confirm a specific claim — a certification, a price point, a client rating — the profile marks it as not published rather than presenting it as fact.
What we do not do
We do not invent certifications, client quotes, third-party ratings or pricing figures that are not sourced from public material. Where information is not publicly available, our profiles say so directly rather than filling the gap with a plausible-sounding claim. We do not publish star ratings or review counts, because we have no verified review corpus to derive them from.
These rules apply identically to every company in the comparison, including any company whose services are referenced elsewhere on this site. Every profile uses the same template, the same fields and a comparable length, so that position in the list is the only thing that differs.
How companies are selected
Companies appear in this ranking if they offer internal penetration testing services with a documented or verifiable presence in the UAE market, or explicit UAE service delivery. We prioritise vendors whose public materials describe internal-network-specific methodology — Active Directory testing, lateral movement, privilege escalation — rather than only general penetration testing or web application testing.
Vendors that believe they meet these criteria and are not currently listed can request inclusion through our company submission page. Submission does not guarantee a listing, and there is no paid route onto the page.
Update frequency and independence
The ranking is reviewed periodically to reflect changes in vendor capability, new public information and market developments, including corporate events such as acquisitions that change who delivers a service. Ordering reflects the scoring criteria above at the time of the most recent review; it is not sold as a paid placement.
For our broader content standards, including how corrections are handled, see the editorial policy. For the limits of what a comparison like this can tell you before you sign a contract, see the risk disclosure.