Services Penetration Testing DESC Certified Penetration Testing
+44 20 3996 1505

DESC Certified Penetration Testing

The Dubai Electronic Security Center (DESC) is Dubai’s cybersecurity regulator. Its Cyber Force Program, delivered in partnership with CREST, certifies penetration testing and incident response providers to Dubai government, semi-government and critical information infrastructure (CII) entities.

RedSecLabs is a DESC Cyber Force-certified provider for Penetration Testing, delivered by the same CREST-accredited security team behind our penetration testing, PCI DSS and ISO 27001 work.

DESC Cyber Force Certified Provider CREST Member Company PCI SSC Qualified Security Assessor (QSA) Company ISO 27001 Certified UKAS Accredited Certification Cyber Essentials Certification Body

Speak to Our Team

Tell us what needs testing in the UAE. A senior assessor will scope your DESC-scoped engagement directly.

✓ DESC Cyber Force certified✓ Senior testers only✓ Retest included

Your details are used only to scope your enquiry, never shared or sold.

✓ DESC Cyber Force Certified · ✓ CREST-Accredited Methodology · ✓ Listed on DESC’s Public Register · ✓ Senior Testers Only · ✓ UAE-Based Delivery · ✓ Renewed Annually
Who this is for

This page is for you if you’re..

1
Dubai government and semi-government entities
Organisations that, by programme rule, must engage a Cyber Force-certified provider for penetration testing.
2
Critical information infrastructure (CII) operators
Entities within Dubai’s designated CII sectors, within the Cyber Force programme’s stated scope.
3
Vendors needing to evidence verifiable DESC status
Suppliers whose customers or procurement processes require certification that can be independently checked, not just claimed.

DESC Cyber Force Program — Quick Facts

Last reviewed: 15 September 2026
Regulatory body
Dubai Electronic Security Center (DESC), part of Digital Dubai
Accreditation partner
CREST
Programme scope
Penetration testing and incident response (certified separately)
Registration requirements
UAE trade licence, CREST Accreditation, cleared consultants
Certification validity
Renewed annually
RedSecLabs status
Certified provider, Penetration Testing, valid to 26 Aug 2027
Certified
DESC Cyber Force
CREST
Accreditation Body
26 Aug 2027
Certified Until

What is the DESC Cyber Force Program?

DESC’s mission is to protect Dubai digitally, and the Cyber Force Program is one of the mechanisms it uses to do that: a collaboration with CREST that certifies penetration testing and incident response providers against an internationally audited standard, in support of the Dubai Cyber Security Strategy’s goal of making Dubai among the most secure cities electronically in the world.

It allows CREST-accredited companies and CREST-qualified individuals to register as certified providers to Dubai government, semi-government bodies, and CII, across two domains: penetration testing and incident response.

What DESC Cyber Force certification gives you:

Eligibility to test Dubai government, semi-government and CII entities

A verifiable listing on DESC’s public Certified Providers register

Methodology assessed against CREST’s internationally recognised standard

Confidence for procurement teams without an independent vendor assessment

Consultants vetted through Dubai Police security clearance

A programme requirement to renew and stay current annually

Why DESC certification matters

Penetration testing quality varies significantly between providers, in methodology, depth, and the skill of the people actually doing the work. DESC introduced the Cyber Force Program specifically to give Dubai’s public sector and CII a consistent, internationally benchmarked standard to rely on, rather than requiring every buyer to independently assess every vendor.

What buyers risk without a Cyber Force-certified provider:

Disqualification from Dubai government and semi-government procurement

Ineligibility to test critical information infrastructure assets

Failed vendor security reviews requiring DESC evidence

No independent way to verify the provider’s standing

Not sure whether your provider needs to be DESC Cyber Force-certified?
We can confirm your requirement before you scope a test.
→ Speak to Our Team

DESC Cyber Force Program requirements

To register, an organisation must meet three requirements:

1
Valid UAE trade licence
The licence must include cybersecurity activities within its scope.
2
CREST Accreditation
Held already, or obtained through the application process.
3
Qualified, cleared consultants
Consultants must meet the programme’s certification standards and hold a Dubai Police security clearance certificate.

Certification is renewed annually.

Our DESC Testing Methodology

The same CREST-aligned methodology RedSecLabs applies globally (OWASP, NIST SP 800-115, OSSTMM, MITRE ATT&CK), delivered by senior consultants for engagements in scope of the DESC Cyber Force Program.

01

Scoping & Rules of Engagement

Detailed scoping of in-scope and out-of-scope targets, testing windows, escalation contacts and deconfliction procedures, all documented before activity starts.

02

Reconnaissance & Enumeration

OSINT and asset discovery to establish the target footprint without disruption.

03

Vulnerability Identification

Automated and manual identification of vulnerabilities across the in-scope estate, with appropriate depth for each asset class.

04

Manual Exploitation & Validation

Senior testers manually validate findings, remove false positives, and demonstrate true impact, constructing attack chains where they exist.

05

Privilege Escalation & Lateral Movement

Where in scope, demonstration of post-compromise activity to assess realistic blast radius and segmentation effectiveness.

06

Reporting

Executive summary, technical findings with exploitation evidence, and CVSS plus exploitability prioritisation, structured for DESC Cyber Force compliance evidence.

07

Findings Review Workshop

Live walk-through with your technical team, confirming findings, validating reproduction steps, and agreeing remediation paths.

08

Remediation Retest

Retest of remediated findings to validate fixes, included in scope and documented for compliance evidence.

What you receive

Every DESC-scoped penetration test with RedSecLabs includes:

  • Signed rules of engagement
  • Executive summary for board and management consumption
  • Detailed technical findings with exploitation evidence
  • CVSS-rated and exploitability-prioritised findings
  • Practical remediation guidance for every issue
  • Reporting structured for DESC Cyber Force compliance evidence
  • Live findings walk-through with your technical team
  • Remediation retest of critical and high findings

Popular DESC-scoped engagements

Common starting points for organisations needing DESC Cyber Force-certified testing:

DESC-Scoped Web & API Penetration Test

Manual testing of your web applications and APIs, covering authenticated, business-logic and OWASP-aligned testing, delivered by DESC Cyber Force-certified consultants.

DESC-Scoped Network Penetration Test

Internal and external network testing mapped to DESC Cyber Force expectations, for organisations whose infrastructure sits in scope of Dubai government or CII requirements.

DESC-Scoped Red Team Assessment

Goal-based adversary simulation across people, process and technology, for organisations needing to validate detection and response as well as technical vulnerabilities.

Industries we serve in the UAE

RedSecLabs delivers DESC-scoped penetration testing across:

Financial Services
SaaS & Technology
E-commerce & Retail
Healthcare
Hospitality
Manufacturing & Industrial
Education & Research
Public Sector Suppliers

Why RedSecLabs for DESC testing

RedSecLabs holds DESC Cyber Force certification alongside CREST membership, PCI DSS QSA status and ISO 27001 (UKAS-accredited) certification. We staff DESC-scoped engagements with the same senior testers who deliver our CREST work internationally, so government and semi-government clients in Dubai receive the same standard of testing as our regulated clients elsewhere.

Certified provider for Penetration Testing under the DESC Cyber Force Program
Listed on DESC’s public Certified Providers register as RedSecLabs FZ LLC
Certification valid to 26 August 2027, subject to the programme’s annual renewal requirement
Senior testers, every engagement — no junior hand-offs, manual depth beyond automated scans
Reporting built for both technical teams and board-level stakeholders
Retest included as standard, so remediation can be evidenced, not just claimed
Held alongside RedSecLabs’ existing CREST membership, PCI DSS QSA status, ISO 27001 (UKAS-accredited) and Cyber Essentials certification
UAE presence: Meydan Grandstand, Nad Al Sheba, Dubai

Speak to Our Team

Tell us what needs testing in the UAE. A senior assessor will scope your DESC-scoped engagement directly.

Contact Us Book a Consultation

Where to next

Related services and industry packages worth exploring.

CREST Penetration Testing

Penetration Testing Services

Public Sector Suppliers

Questions worth asking before you commit

Four questions to ask any DESC-scoped testing provider
1) Is the provider listed on DESC’s public Certified Providers register, not just claiming certification? 2) Does testing follow CREST’s audited methodology, or an internal-only process? 3) Are consultants individually cleared under the programme’s requirements? 4) Is remediation retesting included, or a separate paid service?

RedSecLabs’ answers: yes, listed under Penetration Testing Service Providers; CREST-aligned methodology; consultants meet the programme’s clearance requirements; retest included.

What happens after you get in touch

1
Scoping call
Confirm targets, environment and DESC-scoped requirements with a senior assessor.
2
Engagement & Testing
Manual, CREST-aligned testing delivered by DESC Cyber Force-certified consultants.
3
Reporting & Retest
Findings walk-through, remediation guidance, and retest of critical and high findings.

Frequently Asked Questions

A joint CREST–DESC programme certifying organisations and individuals to deliver penetration testing and incident response services to Dubai government, semi-government, and critical information infrastructure entities.

No. CREST accreditation is a prerequisite for a company to join the Cyber Force Program; DESC Cyber Force certification is the additional, Dubai-specific registration built on top of it. RedSecLabs holds both.

Directly on DESC’s public Certified Providers register, or via the CREST Marketplace filtered to the Dubai Cyber Force programme.

The programme covers both domains, but they’re certified separately. RedSecLabs is listed as a certified provider for penetration testing.

Yes. Cyber Force registration renews annually; RedSecLabs’ current listing is valid to 26 August 2027.

DESC is the Dubai Electronic Security Center, and the Cyber Force Program’s stated scope is Dubai government, semi-government and critical infrastructure entities. It is a Dubai-specific programme, not a wider UAE-federal certification.

Yes. RedSecLabs delivers DESC-scoped engagements from its UAE office in Dubai, alongside its UK and US operations, so both regional and international clients with Dubai-scoped requirements can be supported.
📞 Call us Book a call